Function at 0x421540
Capabilities:
Persist via run registry key
Print debug messages
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x459cd4
mov eax, dword fs:[0]
push eax
sub esp, 0x2c4
mov eax, dword [0x4724e4]
xor eax, ebp
mov dword [ebp - 0xb0], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x290], ecx
mov eax, dword [ebp - 0x290]
mov byte [eax + 0xc4], 0
mov ecx, dword [ebp - 0x290]
cmp dword [ecx + 0xbc], 0
je 0x421ca0
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00402600
mov ecx, dword [ebp - 0x290]
call fcn.00422af0
test eax, eax
jne 0x4215c7
push 0
mov ecx, dword [ebp - 0x290]
call fcn.00422b60
test eax, eax
jne 0x4215c7
jmp 0x421607
push 0x462cd0
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0x462cdc
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x290]
call fcn.004246d0
mov ecx, dword [ebp - 0x290]
call fcn.00421220
test eax, eax
je 0x421bf6
mov ecx, dword [ebp - 0x290]
call fcn.004211f0
test eax, eax
jne 0x4216c7
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00402600
push str.NEWVERSION
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0x462cec
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x290]
call fcn.004246d0
push ecx
mov ecx, esp
mov dword [ebp - 0x250], esp
push 0x462cf0
call fcn.00402580
mov dword [ebp - 0x294], eax
mov ecx, dword [ebp - 0x290]
call fcn.004213b0
mov edx, dword [ebp - 0x290]
mov dword [edx + 0xb4], 1
mov eax, dword [ebp - 0x290]
mov dword [eax + 0xc0], 1
jmp 0x421bf1
lea ecx, [ebp - 0x10]
push ecx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 0
push str.InstallReboot_QDCCB_For_CheckTool
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4217a2
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00402600
push str.NEWVERSION2
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0x462d70
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x290]
call fcn.004246d0
mov eax, dword [ebp - 0x290]
mov byte [eax + 0xc4], 1
mov ecx, dword [ebp - 0x290]
push ecx
lea ecx, [ebp - 0x8c]
call fcn.0040d320
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x8c]
call fcn.00426f03
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.0040d380
jmp 0x421bf1
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00402600
push str.VERSION
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0x462d7c
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x290]
call fcn.004246d0
mov edx, dword [ebp - 0x290]
mov byte [edx + 0xc4], 0
mov ecx, dword [ebp - 0x290]
call fcn.00421060
test eax, eax
je 0x421b6c
mov ecx, dword [ebp - 0x290]
call fcn.00421100
test eax, eax
je 0x421b6c
push 0x462d80
lea ecx, [ebp - 0x94]
call fcn.00402580
mov dword [ebp - 4], 1
lea eax, [ebp - 0x254]
push eax
mov ecx, dword [ebp - 0x290]
call fcn.004212f0
mov dword [ebp - 0x298], eax
mov ecx, dword [ebp - 0x298]
mov dword [ebp - 0x29c], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x29c]
push edx
lea ecx, [ebp - 0x94]
call fcn.00411520
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x254]
call fcn.00403140
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00402600
push str.UKEY_WQ2322
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
lea eax, [ebp - 0x94]
push eax
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00402ab0
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x290]
call fcn.004246d0
push ecx
mov ecx, esp
mov dword [ebp - 0x258], esp
push 0x462db0
call fcn.00402580
mov dword [ebp - 0x2a0], eax
mov ecx, dword [ebp - 0x290]
call fcn.004213b0
mov ecx, dword [ebp - 0x290]
mov dword [ecx + 0xa8], 0
mov ecx, dword [ebp - 0x290]
call fcn.00420d90
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jne 0x4219b5
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00402600
push str.MONITOR_CERTD
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0x462ddc
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x290]
call fcn.004246d0
push ecx
mov ecx, esp
mov dword [ebp - 0x25c], esp
push 0x462de0
call fcn.00402580
mov dword [ebp - 0x2a4], eax
mov ecx, dword [ebp - 0x290]
call fcn.004213b0
mov edx, dword [ebp - 0x290]
mov dword [edx + 0xb4], 1
jmp 0x421b55
cmp dword [ebp - 0x90], 2
jne 0x421a4c
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00402600
push str.MONITOR_SLOTD
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0x462e0c
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x290]
call fcn.004246d0
push ecx
mov ecx, esp
mov dword [ebp - 0x260], esp
push 0x462e10
call fcn.00402580
mov dword [ebp - 0x2a8], eax
mov ecx, dword [ebp - 0x290]
call fcn.004213b0
mov eax, dword [ebp - 0x290]
mov dword [eax + 0xb4], 1
jmp 0x421b55
cmp dword [ebp - 0x90], 3
jne 0x421ae0
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00402600
push str.MONITOR_ERR
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0x462e38
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x290]
call fcn.004246d0
push ecx
mov ecx, esp
mov dword [ebp - 0x264], esp
push 0x462e3c
call fcn.00402580
mov dword [ebp - 0x2ac], eax
mov ecx, dword [ebp - 0x290]
call fcn.004213b0
mov ecx, dword [ebp - 0x290]
mov dword [ecx + 0xb4], 1
jmp 0x421b55
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00402600
push str.MONITOR_OK
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0x462e68
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x290]
call fcn.004246d0
push ecx
mov ecx, esp
mov dword [ebp - 0x268], esp
push 0x462e6c
call fcn.00402580
mov dword [ebp - 0x2b0], eax
mov ecx, dword [ebp - 0x290]
call fcn.004213b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.00403140
jmp 0x421bf1
push ecx
mov ecx, esp
mov dword [ebp - 0x26c], esp
push 0x462e8c
call fcn.00402580
mov dword [ebp - 0x2b4], eax
mov ecx, dword [ebp - 0x290]
call fcn.004213b0
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00402600
push str.UKEY_WQ2321
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0x462eb4
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x290]
call fcn.004246d0
mov edx, dword [ebp - 0x290]
mov dword [edx + 0xb4], 1
jmp 0x421c9b
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00402600
push str.UKEY_NO_DRIVER
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0x462ec8
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x290]
call fcn.004246d0
push ecx
mov ecx, esp
mov dword [ebp - 0x270], esp
push 0x462ecc
call fcn.00402580
mov dword [ebp - 0x2b8], eax
mov ecx, dword [ebp - 0x290]
call fcn.004213b0
mov eax, dword [ebp - 0x290]
mov dword [eax + 0xa8], 0
mov ecx, dword [ebp - 0x290]
mov dword [ecx + 0xb4], 1
mov edx, dword [ebp - 0x290]
mov dword [edx + 0xc0], 1
jmp 0x42224f
mov ecx, dword [ebp - 0x290]
call fcn.00422af0
test eax, eax
jne 0x421cc2
push 0
mov ecx, dword [ebp - 0x290]
call fcn.00422b60
test eax, eax
jne 0x421cc2
jmp 0x421d13
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00402600
push str.UKEY_WQ2301
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0x462ef8
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x290]
call fcn.004246d0
push 0x462efc
mov eax, dword [ebp - 0x290]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xa4], eax
push 0x462f0c
mov edx, dword [ebp - 0x290]
mov eax, dword [edx + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xac], eax
push 0x462f18
mov ecx, dword [ebp - 0x290]
mov edx, dword [ecx + 0xac]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xa0], eax
push 0x462f2c
mov eax, dword [ebp - 0x290]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x9c], eax
call dword [ebp - 0xa0]
mov dword [ebp - 0xa8], eax
mov ecx, dword [ebp - 0x290]
add ecx, 0x268
call fcn.00409b70
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x421dc8
mov ecx, dword [ebp - 0x290]
add ecx, 0x268
call fcn.0040a0b0
cmp dword [ebp - 0xa8], 0
jne 0x422093
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00402600
push str.UKEY_WQ2325
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0x462f4c
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x290]
call fcn.004246d0
push ecx
mov ecx, esp
mov dword [ebp - 0x274], esp
push 0x462f50
call fcn.00402580
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0x290]
call fcn.004213b0
push 0x462f6c
lea ecx, [ebp - 0x1c0]
call fcn.00402580
mov dword [ebp - 4], 3
push str.run_11111111111111111111111111111111111111111
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [ebp - 0x1bc], 0
push 0x103
push 0
lea edx, [ebp - 0x1bb]
push edx
call fcn.004463a0
add esp, 0xc
mov dword [ebp - 0x1c8], 0
lea eax, [ebp - 0x1c8]
push eax
push 1
push 0
lea ecx, [ebp - 0x1c0]
call fcn.00412a00
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
jne 0x421fcd
push str.run_2222222222222222222222222222222222222222222
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 0x1d0], 0x104
mov dword [ebp - 0x1cc], 1
lea ecx, [ebp - 0x1d0]
push ecx
lea edx, [ebp - 0x1bc]
push edx
lea eax, [ebp - 0x1cc]
push eax
push 0
push str.Shuttle2000auto_BQD
mov ecx, dword [ebp - 0x1c8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
jne 0x421f3c
mov edx, dword [ebp - 0x290]
mov dword [edx + 0x78], 1
push str.run_33333333333333
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x421fcd
mov eax, dword [ebp - 0x290]
mov dword [eax + 0x78], 0
push 0x78
call fcn.00410690
mov dword [ebp - 0x27c], eax
mov byte [ebp - 4], 4
cmp dword [ebp - 0x27c], 0
je 0x421f78
push 0
mov ecx, dword [ebp - 0x27c]
call fcn.0040df30
mov dword [ebp - 0x2c0], eax
jmp 0x421f82
mov dword [ebp - 0x2c0], 0
mov ecx, dword [ebp - 0x2c0]
mov dword [ebp - 0x278], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x278]
push edx
lea ecx, [ebp - 0x24c]
call fcn.0040df30
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x24c]
call fcn.00426f03
push str.run_rrrrrrrrrrrrrrrr
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x24c]
call fcn.0040dfe0
mov eax, dword [ebp - 0x290]
cmp dword [eax + 0xc8], 0
jne 0x422081
call dword [ebp - 0xa4]
cmp eax, 1
jne 0x422081
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00402600
push str.NEWVERSION1
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0x463048
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x290]
call fcn.004246d0
push ecx
mov ecx, esp
mov dword [ebp - 0x280], esp
push 0x46304c
call fcn.00402580
mov dword [ebp - 0x2c4], eax
mov ecx, dword [ebp - 0x290]
call fcn.004213b0
mov ecx, dword [ebp - 0x290]
mov byte [ecx + 0xc4], 1
mov edx, dword [ebp - 0x290]
mov dword [edx + 0xb4], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c0]
call fcn.00403140
mov eax, dword [ebp - 0xa8]
and eax, 1
je 0x422127
mov ecx, dword [ebp - 0x290]
mov dword [ecx + 0xb4], 1
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00402600
push str.UKEY_WQ2326
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0x463074
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x290]
call fcn.004246d0
push ecx
mov ecx, esp
mov dword [ebp - 0x284], esp
push 0x463078
call fcn.00402580
mov dword [ebp - 0x2c8], eax
mov ecx, dword [ebp - 0x290]
call fcn.004213b0
mov edx, dword [ebp - 0xa8]
and edx, 2
je 0x4221bb
mov eax, dword [ebp - 0x290]
mov dword [eax + 0xb4], 1
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00402600
push str.UKEY_WQ2327
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0x4630a0
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x290]
call fcn.004246d0
push ecx
mov ecx, esp
mov dword [ebp - 0x288], esp
push 0x4630a4
call fcn.00402580
mov dword [ebp - 0x2cc], eax
mov ecx, dword [ebp - 0x290]
call fcn.004213b0
mov ecx, dword [ebp - 0xa8]
and ecx, 4
je 0x42224f
mov edx, dword [ebp - 0x290]
mov dword [edx + 0xb4], 1
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00402600
push str.UKEY_WQ2328
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0x4630d0
mov ecx, dword [ebp - 0x290]
add ecx, 0x90
call fcn.00424670
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x290]
call fcn.004246d0
push ecx
mov ecx, esp
mov dword [ebp - 0x28c], esp
push 0x4630d4
call fcn.00402580
mov dword [ebp - 0x2d0], eax
mov ecx, dword [ebp - 0x290]
call fcn.004213b0
mov eax, dword [ebp - 0x290]
cmp dword [eax + 0x78], 0
jne 0x422276
push str.run_zzzzzzzzzzzzzzzzzzz
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x290]
mov dword [ecx + 0xb4], 1
mov edx, dword [ebp - 0x290]
cmp dword [edx + 0xb4], 0
jne 0x422291
mov eax, dword [ebp - 0x290]
cmp dword [eax + 0x78], 0
jne 0x422295
xor eax, eax
jmp 0x42229a
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0xb0]
xor ecx, ebp
call fcn.00441f6e
mov esp, ebp
pop ebp
ret