Function at 0x40cdb4
Capabilities:
Accept command line arguments
Check mutex on windows
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1300
call fcn.0040dc60
or dword [ebp - 0x24], 0xffffffff
push ebx
push esi
xor esi, esi
push edi
push 0x418b6c
mov dword [0x418b8c], 0x40ca97
mov byte [ebp - 5], 0
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], 2
mov byte [ebp - 6], 0
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
mov byte [ebp - 4], 0
mov byte [ebp - 3], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x40d8b4
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x401728
push dword [ebp + 8]
call fcn.00414704
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x6c]
push 1
rep stosd dword es:[edi], eax
call dword [sym.imp.SHLWAPI.dll_IsOS]
cmp eax, esi
mov dword [0x419a38], eax
je 0x40ce78
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
inc esi
lea eax, [esi + esi]
push eax
push 0
call ebx
test eax, eax
mov dword [ebp - 0x40], eax
je 0x40ceae
push esi
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
jmp 0x40ceae
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
inc esi
lea eax, [esi + esi]
push eax
push 0
call ebx
test eax, eax
mov dword [ebp - 0x40], eax
je 0x40ceae
push esi
push eax
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
and dword [ebp - 0x48], 0
lea eax, [ebp - 0x10f8]
push eax
push dword [ebp - 0x40]
mov dword [ebp - 0x4c], 4
call fcn.0040ca45
test eax, eax
mov dword [ebp - 0x30], eax
je 0x40d2af
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0x40171c
lea eax, [ebp - 0x10f8]
push eax
call edi
test eax, eax
jne 0x40cf28
lea eax, [ebp - 0x10b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
inc esi
lea eax, [esi + esi]
push eax
push 0
call ebx
mov dword [ebp - 0x44], eax
test eax, eax
je 0x40d295
push esi
lea ecx, [ebp - 0x10b8]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
jmp 0x40d295
push 0x4016fc
lea eax, [ebp - 0x10f8]
push eax
call edi
test eax, eax
jne 0x40cf57
lea eax, [ebp - 0x10b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
inc esi
lea eax, [esi + esi]
push eax
push 0
call ebx
mov dword [ebp - 0x48], eax
jmp 0x40cf0c
push 0x4016ec
lea eax, [ebp - 0x10f8]
push eax
call edi
test eax, eax
jne 0x40d01c
push 0x4016e4
lea eax, [ebp - 0x10b8]
push eax
call edi
test eax, eax
jne 0x40cf8b
mov dword [ebp - 0x4c], 6
jmp 0x40d295
push 0x4016d4
lea eax, [ebp - 0x10b8]
push eax
call edi
test eax, eax
jne 0x40cfa9
mov dword [ebp - 0x4c], 5
jmp 0x40d295
push 0x4016c4
lea eax, [ebp - 0x10b8]
push eax
call edi
test eax, eax
jne 0x40cfc7
mov dword [ebp - 0x4c], 7
jmp 0x40d295
push 0x4016b8
lea eax, [ebp - 0x10b8]
push eax
call edi
test eax, eax
jne 0x40cfe2
mov byte [ebp - 1], 1
jmp 0x40d295
push 0x4016a4
lea eax, [ebp - 0x10b8]
push eax
call edi
test eax, eax
jne 0x40cffd
mov byte [ebp - 4], 1
jmp 0x40d295
push 0x40168c
lea eax, [ebp - 0x10b8]
push eax
call edi
test eax, eax
jne 0x40d295
mov byte [ebp - 3], 1
jmp 0x40d295
push 0x401680
lea eax, [ebp - 0x10f8]
push eax
call edi
test eax, eax
jne 0x40d03a
mov dword [ebp - 0x60], 1
jmp 0x40d295
push 0x40167c
lea eax, [ebp - 0x10f8]
push eax
call edi
test eax, eax
jne 0x40d055
mov byte [ebp - 5], 1
jmp 0x40d295
push 0x401654
lea eax, [ebp - 0x10f8]
push eax
call edi
test eax, eax
jne 0x40d078
lea eax, [ebp - 0x10b8]
push eax
call esi
mov dword [ebp - 0x10], eax
jmp 0x40d295
push 0x401624
lea eax, [ebp - 0x10f8]
push eax
call edi
test eax, eax
jne 0x40d09b
lea eax, [ebp - 0x10b8]
push eax
call esi
mov dword [ebp - 0x14], eax
jmp 0x40d295
push 0x401618
lea eax, [ebp - 0x10f8]
push eax
call edi
test eax, eax
jne 0x40d0be
lea eax, [ebp - 0x10b8]
push eax
call esi
mov dword [ebp - 0x1c], eax
jmp 0x40d295
push 0x401608
lea eax, [ebp - 0x10f8]
push eax
call edi
test eax, eax
jne 0x40d0e1
lea eax, [ebp - 0x10b8]
push eax
call esi
mov dword [ebp - 0xc], eax
jmp 0x40d295
push 0x4015fc
lea eax, [ebp - 0x10f8]
push eax
call edi
test eax, eax
jne 0x40d104
lea eax, [ebp - 0x10b8]
push eax
call esi
mov dword [ebp - 0x18], eax
jmp 0x40d295
push 0x4015f4
lea eax, [ebp - 0x10f8]
push eax
call edi
test eax, eax
jne 0x40d127
lea eax, [ebp - 0x10b8]
push eax
call esi
mov dword [ebp - 0x20], eax
jmp 0x40d295
push 0x4015e0
lea eax, [ebp - 0x10f8]
push eax
call edi
test eax, eax
jne 0x40d14e
lea eax, [ebp - 0x10b8]
push eax
call fcn.0040e25a
pop ecx
mov dword [ebp - 0x28], eax
jmp 0x40d295
push 0x4015c8
lea eax, [ebp - 0x10f8]
push eax
call edi
test eax, eax
jne 0x40d175
lea eax, [ebp - 0x10b8]
push eax
call fcn.0040e25a
pop ecx
mov dword [ebp - 0x2c], eax
jmp 0x40d295
push 0x4015b8
lea eax, [ebp - 0x10f8]
push eax
call edi
test eax, eax
jne 0x40d193
mov dword [ebp - 0x5c], 1
jmp 0x40d295
push 0x4015b0
lea eax, [ebp - 0x10f8]
push eax
call edi
test eax, eax
jne 0x40d1b1
mov dword [ebp - 0x58], 1
jmp 0x40d295
push 0x4015a0
lea eax, [ebp - 0x10f8]
push eax
call edi
test eax, eax
jne 0x40d1d5
push 0x401594
push dword [ebp + 8]
call fcn.004149ba
jmp 0x40d295
push 0x401584
lea eax, [ebp - 0x10f8]
push eax
call edi
test eax, eax
jne 0x40d1f3
mov dword [ebp - 0x54], 1
jmp 0x40d295
push 0x40157c
lea eax, [ebp - 0x10b8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x40d24b
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
push 4
push 0x401570
lea eax, [ebp - 0x10b8]
push eax
call esi
test eax, eax
je 0x40d24b
push 7
push 0x401560
lea eax, [ebp - 0x10b8]
push eax
call esi
test eax, eax
je 0x40d24b
push 0xb
push 0x401548
lea eax, [ebp - 0x10b8]
push eax
call esi
test eax, eax
jne 0x40d271
cmp dword [ebp - 0x3c], 0
jne 0x40d271
lea eax, [ebp - 0x10b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
inc esi
lea eax, [esi + esi]
push eax
push 0
call ebx
mov dword [ebp - 0x3c], eax
jmp 0x40cf0c
push 0x401538
lea eax, [ebp - 0x10b8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x40d295
push 0x401534
lea eax, [ebp - 0x10f8]
push eax
call edi
lea eax, [ebp - 0x10f8]
push eax
push dword [ebp - 0x30]
call fcn.0040ca45
test eax, eax
mov dword [ebp - 0x30], eax
jne 0x40ced9
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor esi, esi
cmp dword [ebp - 0x60], esi
mov ebx, 0x80000001
je 0x40d2ea
push 0x104
lea eax, [ebp - 0x1300]
push eax
push esi
call edi
lea eax, [ebp - 0x1300]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push 0x4014d8
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp dword [ebp - 0x40], esi
je 0x40d429
push 0x401270
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x40d347
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40d33d
and dword [ebp - 0x68], 0
cmp byte [ebp - 1], 0
jne 0x40d32f
cmp byte [ebp - 4], 0
jne 0x40d32f
cmp byte [ebp - 3], 0
je 0x40d403
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x40d347
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x6c], esi
cmp byte [ebp - 4], 0
je 0x40d357
call fcn.0040c569
jmp 0x40d403
cmp byte [ebp - 3], 0
je 0x40d367
call fcn.0040cb83
jmp 0x40d403
cmp dword [ebp - 0x68], 0
je 0x40d403
cmp byte [ebp - 1], 0
jne 0x40d403
cmp byte [ebp - 5], 0
je 0x40d3a3
push dword [ebp - 0x18]
push dword [ebp - 0xc]
push dword [ebp - 0x1c]
push dword [ebp - 0x2c]
push dword [ebp - 0x28]
push dword [ebp - 0x44]
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push dword [ebp - 0x20]
call fcn.0040cbf4
jmp 0x40d3f4
call fcn.00413eee
test eax, eax
jne 0x40d3ff
call fcn.004148a1
test eax, eax
je 0x40d3f9
push 0x104
lea eax, [ebp - 0x1300]
push eax
xor esi, esi
push esi
call edi
lea eax, [ebp - 0x1300]
push eax
push 0x4014c0
push 0x401490
push ebx
call fcn.00413fbd
cmp dword [ebp - 0x68], esi
je 0x40d3eb
cmp dword [ebp - 0x50], 1
je 0x40d3eb
mov dword [ebp - 0x50], esi
lea eax, [ebp - 0x6c]
push eax
call fcn.0040cb35
mov dword [ebp - 0x24], eax
jmp 0x40d403
mov byte [ebp - 6], 1
jmp 0x40d403
mov byte [ebp - 2], 1
cmp dword [ebp - 0x38], 0
je 0x40d41a
push dword [ebp - 0x38]
call fcn.0040c7bd
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x40], 0
je 0x40d429
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor esi, esi
cmp dword [ebp - 0x3c], esi
je 0x40d439
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x48], esi
je 0x40d447
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x44], esi
je 0x40d455
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor edi, edi
cmp dword [ebp - 0x10], edi
je 0x40d467
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0x14], edi
je 0x40d471
push dword [ebp - 0x14]
call esi
cmp dword [ebp - 0x1c], edi
je 0x40d47b
push dword [ebp - 0x1c]
call esi
cmp dword [ebp - 0xc], edi
je 0x40d485
push dword [ebp - 0xc]
call esi
cmp dword [ebp - 0x18], edi
je 0x40d48f
push dword [ebp - 0x18]
call esi
cmp dword [ebp - 0x20], edi
je 0x40d499
push dword [ebp - 0x20]
call esi
call fcn.00413d53
cmp byte [ebp - 6], 0
pop edi
pop esi
pop ebx
jne 0x40d4da
cmp byte [ebp - 2], 0
je 0x40d4c8
cmp byte [ebp - 2], 0
je 0x40d4c8
push 0x89
call fcn.0040c722
cmp eax, 2
pop ecx
jne 0x40d4c8
call fcn.0040c569
push 0x418b6c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [ebp - 0x24]
leave
ret 0x10
push 0x82
jmp 0x40d4b8