Function at 0x4014b0
Capabilities:
Accept command line arguments
Persist via run registry key
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa4f4
call fcn.00424090
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [0x46e3ac], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.00401280
mov dword [0x46e310], 1
push 0x432534
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.00423fb0
add esp, 8
test eax, eax
jne 0x40154e
push 0x43253c
push 0x432548
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xa4d8], eax
push 0x42
push 0x41
push 0x402
mov ecx, dword [ebp - 0xa4d8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x432550
push 0x43255c
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xa4d8], eax
push 0x42
push 0x41
push 0x402
mov edx, dword [ebp - 0xa4d8]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push str._MpX:
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.00423fb0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40159b
mov eax, dword [ebp - 4]
add eax, 5
push eax
call fcn.00423b90
add esp, 4
test eax, eax
je 0x40159b
push 9
mov ecx, dword [ebp - 4]
add ecx, 5
push ecx
push 0x46e3b4
call fcn.00423e80
add esp, 0xc
mov byte [0x46e3bc], 0
mov dword [0x46e3b0], 1
mov dword [0x46e308], 0
push 0
call fcn.00423e3f
add esp, 4
push eax
call fcn.00423e10
add esp, 4
call fcn.00423e1d
call fcn.00423e1d
call fcn.00423e1d
call fcn.00423e1d
call fcn.00423e1d
mov esi, eax
shl esi, 0x10
call fcn.00423e1d
or esi, eax
mov dword [0x46e5f0], esi
push 1
mov ecx, 0x46e700
call fcn.0041afe0
push 0xa000
push 0
lea edx, [ebp - 0xa050]
push edx
call fcn.00423d20
add esp, 0xc
mov dword [ebp - 0xa4d0], 0x200
lea eax, [ebp - 0xa4d0]
push eax
lea ecx, [ebp - 0xa4c8]
push ecx
lea edx, [ebp - 0xa4d4]
push edx
push str.ProductId
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041fb20
add esp, 0x18
mov dword [ebp - 0xa4cc], eax
cmp dword [ebp - 0xa4cc], 0
jne 0x40166a
lea eax, [ebp - 0xa4c8]
push eax
lea ecx, [ebp - 0xa050]
push ecx
call fcn.00423c30
add esp, 8
mov dword [ebp - 0xa4dc], 0
jmp 0x401685
mov edx, dword [ebp - 0xa4dc]
add edx, 1
mov dword [ebp - 0xa4dc], edx
cmp dword [ebp - 0xa4dc], 0xa
jge 0x4016c2
call fcn.00423e1d
push eax
push 0x4325a8
lea eax, [ebp - 0xa050]
push eax
call fcn.00423b90
add esp, 4
lea ecx, [ebp + eax - 0xa050]
push ecx
call fcn.00423db8
add esp, 0xc
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401676
push str.SYSTEMCurrentControlSetEnumPCI
push reloc.OLEAUT32.dll_SysReAllocString
lea edx, [ebp - 0xa050]
push edx
call fcn.00401430
add esp, 0xc
push 0x4325d0
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0xa050]
push eax
call fcn.00401430
add esp, 0xc
push str.SoftwareMicrosoft
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0xa050]
push ecx
call fcn.00401430
add esp, 0xc
push str.SYSTEMCurrentControlSetEnumIDE
push reloc.OLEAUT32.dll_SysReAllocString
lea edx, [ebp - 0xa050]
push edx
call fcn.00401430
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
mov dword [ebp - 0xa08c], eax
cmp dword [ebp - 0xa08c], 0
je 0x401757
cmp dword [ebp - 0xa08c], 0x720
je 0x401757
cmp dword [ebp - 0xa08c], 0x6cb
jne 0x40178f
lea ecx, [ebp - 0xa058]
push ecx
lea edx, [ebp - 0x50]
push edx
call dword [sym.imp.RPCRT4.dll_UuidToStringA]
test eax, eax
jne 0x40178f
mov eax, dword [ebp - 0xa058]
push eax
lea ecx, [ebp - 0xa050]
push ecx
call fcn.00423c20
add esp, 8
lea edx, [ebp - 0xa058]
push edx
call dword [sym.imp.RPCRT4.dll_RpcStringFreeA]
lea ecx, [ebp - 0xa088]
call fcn.00420620
push eax
lea eax, [ebp - 0xa050]
push eax
call fcn.00423b90
add esp, 4
push eax
lea ecx, [ebp - 0xa050]
push ecx
call fcn.004205c0
add esp, 0xc
mov edx, 1
test edx, edx
je 0x401850
push 0
lea ecx, [ebp - 0xa088]
call fcn.00420600
mov esi, eax
push 1
lea ecx, [ebp - 0xa088]
call fcn.00420600
mov ecx, dword [esi]
xor ecx, dword [eax]
and ecx, 0x7fffffff
push ecx
push 0x432614
push 0x46e288
call fcn.00423db8
add esp, 0xc
push 2
lea ecx, [ebp - 0xa088]
call fcn.00420600
mov esi, eax
push 3
lea ecx, [ebp - 0xa088]
call fcn.00420600
mov esi, dword [esi]
xor esi, dword [eax]
push 4
lea ecx, [ebp - 0xa088]
call fcn.00420600
xor esi, dword [eax]
push esi
push str._.8x
push 0x46e288
call fcn.00423b90
add esp, 4
add eax, 0x46e288
push eax
call fcn.00423db8
add esp, 0xc
push 0
push 0x2e
mov ecx, 0x46e9a8
call fcn.00421660
push eax
push SysReAllocStringLen
mov ecx, 0x46e970
call fcn.0041ed50
push 0x46e368
call fcn.00423b90
add esp, 4
test eax, eax
je 0x4018ae
push 0x46e368
push 0x432624
mov ecx, 0x46e970
call fcn.0041f3f0
push 8
push 0x46e368
push 0x46e3b4
call fcn.00423e80
add esp, 0xc
mov byte [0x46e3bc], 0
push 0x432628
mov ecx, 0x46e970
call fcn.0041f9d0
test eax, eax
jne 0x4018ca
call fcn.00421ce0
test eax, eax
je 0x4018d4
push 0
call fcn.004136d0
add esp, 4
push 0x46e328
call fcn.00423b90
add esp, 4
test eax, eax
je 0x401a43
push 0x46e328
call fcn.00423d80
add esp, 4
fstp qword [ebp - 0xa4e8]
call fcn.00421ce0
test eax, eax
je 0x401981
fld qword [ebp - 0xa4e8]
fcomp qword [0x4327b8]
fnstsw ax
test ah, 0x41
jne 0x401981
fld qword [ebp - 0xa4e8]
fcomp qword [0x4327b0]
fnstsw ax
test ah, 5
jp 0x401981
push str._PReVeR
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.00423fb0
add esp, 8
test eax, eax
je 0x40197c
push 0x432634
push 0x432640
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xa4ec], eax
push 0x45
push 0x45
push 0x401
mov edx, dword [ebp - 0xa4ec]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0
call fcn.00423b4b
jmp 0x401a43
push 0
push 0x432648
call fcn.00422810
add esp, 8
push eax
push 0x432650
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041fbe0
add esp, 0xc
push 0x432680
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041fbe0
add esp, 0xc
mov dword [0x46e320], 1
push 0x46e328
push 0x46e288
push 0
push str.683AB8DCFF9AE789C8D4D9E282B49BC722DFF685AB491DC4
call fcn.00422d00
add esp, 8
push eax
push 0x46e700
call fcn.0041b4f0
add esp, 0x10
push str.windBBAA
push str.BYAwnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xa4f0], eax
push 0x42
push 0x41
push 0x402
mov eax, dword [ebp - 0xa4f0]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x432700
push 0x43270c
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xa4f0], eax
push 0x42
push 0x41
push 0x402
mov ecx, dword [ebp - 0xa4f0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [ebp - 4], 0
je 0x401a72
mov edx, dword [ebp - 4]
add edx, 5
push edx
call fcn.00423b90
add esp, 4
test eax, eax
je 0x401a72
push 0x46e3b4
push 0x432718
mov ecx, 0x46e970
call fcn.0041f3f0
jmp 0x401ab9
push 0x43271c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.00423fb0
add esp, 8
test eax, eax
je 0x401ab9
push 0x46e368
push 0x432724
mov ecx, 0x46e970
call fcn.0041f3f0
push 8
push 0x46e368
push 0x46e3b4
call fcn.00423e80
add esp, 0xc
mov byte [0x46e3bc], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x40]
call fcn.00411460
push 0x432728
mov ecx, 0x46e970
call fcn.0041f4a0
mov dword [ebp - 0xa098], eax
cmp dword [ebp - 0xa098], 0
je 0x401b2e
mov ecx, dword [ebp - 0xa098]
add ecx, 1
mov dword [ebp - 0xa098], ecx
mov edx, dword [ebp - 0xa098]
push edx
push 0x43272c
mov ecx, 0x46e970
call fcn.0041f450
push 0x1000
push str.DENIED
push 0x27
mov ecx, 0x46e9a8
call fcn.00421660
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.00423b4b
push 0x432738
mov ecx, 0x46e970
call fcn.0041f4a0
mov dword [0x45a32c], eax
lea eax, [ebp - 0x40]
mov dword [0x45e140], eax
mov dword [ebp - 0xa090], 0x6f
mov dword [ebp - 0xa0c8], 0
mov ecx, 0xb
xor eax, eax
lea edi, [ebp - 0xa0c4]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xa0b4], ecx
mov dword [ebp - 0xa0c8], 0x30
mov dword [ebp - 0xa0c0], 0x4011d0
mov dword [ebp - 0xa0a0], str.wwBYAwnd
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0xa0ac], eax
mov dword [ebp - 0xa0c4], 3
lea edx, [ebp - 0xa0c8]
push edx
call dword [sym.imp.USER32.dll_RegisterClassExA]
movzx eax, ax
mov dword [ebp - 0xa094], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.windWWAA
mov edx, dword [ebp - 0xa0a0]
push edx
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 8], eax
call fcn.00423e1d
mov esi, eax
shl esi, 0x10
call fcn.00423e1d
or esi, eax
sar esi, 8
mov dword [ebp - 0xa054], esi
push 0x432754
mov ecx, 0x46e970
call fcn.0041f4a0
test eax, eax
je 0x401c36
push 0x43275c
mov ecx, 0x46e970
call fcn.0041f4a0
mov dword [ebp - 0xa054], eax
jmp 0x401c4c
mov eax, dword [ebp - 0xa054]
push eax
push 0x432764
mov ecx, 0x46e970
call fcn.0041f450
mov ecx, dword [ebp - 0xa054]
push ecx
push 0xffffffffffffffeb
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
push 0x4110c0
mov eax, dword [ebp - 8]
push eax
movzx ecx, word [ebp - 0xa090]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x45b444], eax
mov eax, dword [0x45b444]
mov dword [ebp - 0x2c], eax
mov ecx, dword [0x45b444]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
mov edx, dword [ebp + 8]
push edx
push 0
mov ecx, 0x45b448
call fcn.00402660
call fcn.00402940
push 0
push 0
push 0
lea eax, [ebp - 0xa074]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401ce0
lea ecx, [ebp - 0xa074]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0xa074]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x401cad
call fcn.004028e0
mov ecx, 0x45b448
call fcn.00402710
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0xa06c]
mov dword [ebp - 0xa4f4], eax
lea ecx, [ebp - 0x40]
call fcn.00413690
mov eax, dword [ebp - 0xa4f4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10