Function at 0x405ca0
Capabilities:
Create process on windows
Delete file
Persist via run registry key

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x42363d
push eax
mov eax, 0x2b00
mov dword fs:[0], esp
call fcn.0041a8f0
push ebx
push ebp
push esi
push edi
push 0x5b
mov ecx, 0x432418
call fcn.00401160
lea eax, [esp + 0x2bc]
push 0x104
push eax
xor ebx, ebx
push str.UPDD_Folder
push ebx
call fcn.00410fa4
mov edi, str.TBSystry.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2bc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x2b20]
mov ecx, ebp
and ecx, 3
cmp al, bl
rep movsb byte es:[edi], byte [esi]
je 0x405d6c
mov ebp, dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea eax, [esp + 0x60]
push eax
call ebp
lea ecx, [esp + 0x50]
lea edx, [esp + 0x60]
push ecx
push edx
push ebx
push ebx
push 0x200
push ebx
push ebx
lea eax, [esp + 0x2d8]
push ebx
push eax
push ebx
mov dword [esp + 0xb4], 1
mov word [esp + 0xb8], 5
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x405d72
mov ebp, dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00413a5a
test eax, eax
je 0x405dee
mov edi, str.net_start__TBKeyPad_System_Daemon_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2bc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, byte [esp + 0x2b20]
and ecx, 3
cmp al, bl
rep movsb byte es:[edi], byte [esi]
je 0x405e8c
lea ecx, [esp + 0x60]
push ecx
call ebp
lea edx, [esp + 0x50]
lea eax, [esp + 0x60]
push edx
push eax
push ebx
push ebx
push 0x200
push ebx
push ebx
lea ecx, [esp + 0x2d8]
push ebx
mov dword [esp + 0xac], 1
mov word [esp + 0xb0], bx
push ecx
jmp 0x405e85
call fcn.00407c50
test eax, eax
je 0x405e8c
lea edx, [esp + 0x2bc]
push 0x104
push edx
push str.UPDD_Folder
push ebx
call fcn.00410fa4
mov edi, str.TBKeyPad.exe__i0
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2bc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x2b20]
mov ecx, edx
and ecx, 3
cmp al, bl
rep movsb byte es:[edi], byte [esi]
je 0x405e8c
lea eax, [esp + 0x60]
push eax
call ebp
lea ecx, [esp + 0x50]
lea edx, [esp + 0x60]
push ecx
push edx
push ebx
push ebx
push 0x200
push ebx
push ebx
lea eax, [esp + 0x2d8]
push ebx
mov dword [esp + 0xac], 1
mov word [esp + 0xb0], bx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [esp + 0x44]
push ecx
push str.ExtInSvc
push ebx
call fcn.0041103b
cmp dword [esp + 0x44], ebx
je 0x405f65
call fcn.00415668
test eax, eax
je 0x405f65
lea edx, [esp + 0xb4]
push 0x104
push edx
push str.UPDD_Folder
push ebx
call fcn.00410fa4
mov edi, str._tbextsvc.exe__i
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x2b20]
mov ecx, edx
and ecx, 3
cmp al, bl
rep movsb byte es:[edi], byte [esi]
je 0x405f46
lea eax, [esp + 0x60]
push eax
call ebp
lea ecx, [esp + 0x50]
lea edx, [esp + 0x60]
push ecx
push edx
push ebx
push ebx
push 0x200
push ebx
push ebx
lea eax, [esp + 0xd0]
push ebx
push eax
push ebx
mov dword [esp + 0xb4], 1
mov word [esp + 0xb8], bx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x405f65
lea ecx, [esp + 0xb4]
push ecx
push str.tbextsvc
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call fcn.00404690
add esp, 0x10
lea edx, [esp + 0x404]
push 0x104
push edx
push str.UPDD_Folder
push ebx
call fcn.00410fa4
mov edi, 0x42a310
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x404]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x42a990
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x408]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x42a980
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x408]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.0041a731
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x406350
test byte [ebp + 0xc], 0x10
jne 0x406339
push ebp
lea ecx, [esp + 0x610]
push 0x400
push ecx
call fcn.0041a91f
mov al, byte [ebp + 0xc]
add esp, 0xc
test al, 0x10
jne 0x406339
lea edx, [esp + 0xb4]
push 0x104
push edx
push str.UPDD_Folder
push ebx
call fcn.00410fa4
mov edi, 0x42a310
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x10
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0xa8]
and ecx, 3
push eax
push str.Language
push ebx
rep movsb byte es:[edi], byte [esi]
call fcn.00410fa4
lea ecx, [esp + 0x60c]
push ecx
lea ecx, [esp + 0x2c]
call fcn.00413e2e
lea edx, [esp + 0xa4]
lea ecx, [esp + 0x18]
push edx
mov dword [esp + 0x2b1c], ebx
call fcn.00413e2e
push str._LANG_
lea ecx, [esp + 0x4c]
mov byte [esp + 0x2b1c], 1
call fcn.00413e2e
lea eax, [esp + 0x18]
lea ecx, [esp + 0x48]
push eax
lea edx, [esp + 0x2c]
push ecx
push edx
mov byte [esp + 0x2b24], 2
call fcn.00412f81
add esp, 0xc
lea ecx, [esp + 0x48]
mov byte [esp + 0x2b18], 1
call fcn.00413e8c
lea ecx, [esp + 0x18]
mov byte [esp + 0x2b18], bl
call fcn.00413e8c
lea ecx, [esp + 0x28]
call fcn.00413ead
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
lea edx, [esp + 0xb4]
rep movsb byte es:[edi], byte [esi]
mov edi, str._Bundle
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1000
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [0x432408]
mov ecx, edx
and ecx, 3
mov byte [esp + 0xb14], al
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0xb15]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xb14]
stosw word es:[edi], ax
push ecx
push str.Installing_Bundle
push 0x4257d4
push 0x80000002
stosb byte es:[edi], al
call fcn.0040ae30
lea edi, [esp + 0xb24]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xb4]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x3c0]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
cmp byte [esp + 0x2b20], bl
je 0x406266
lea ecx, [esp + 0x50]
lea edx, [esp + 0x3c0]
push ecx
push edx
push ebx
push ebx
push 0x200
push ebx
push ebx
lea eax, [esp + 0xd0]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, 0x400
call fcn.00415668
test eax, eax
je 0x406230
mov esi, 0x100400
mov ecx, dword [esp + 0x58]
push ecx
push 1
push esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x64
mov ecx, 0x432418
mov esi, eax
call fcn.00401160
push 0x65
mov ecx, 0x432418
call fcn.00401160
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x40631b
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebx
sub esp, 8
mov byte [esp + 0x2b20], 3
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x42a63c
call fcn.00413e2e
sub esp, 8
lea edx, [esp + 0x61c]
mov ecx, esp
mov dword [esp + 0x50], esp
push edx
mov byte [esp + 0x2b2c], 4
call fcn.00413e2e
lea eax, [esp + 0x40]
mov byte [esp + 0x2b28], 3
push eax
call fcn.00415816
add esp, 0x14
lea ecx, [esp + 0xb4]
push ecx
mov ecx, dword [esp + 0x34]
call fcn.00413ead
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call fcn.00404690
mov esi, dword [esp + 0x40]
add esp, 0x10
cmp esi, ebx
mov byte [esp + 0x2b18], bl
je 0x40631b
mov eax, dword [esp + 0x34]
cmp eax, ebx
je 0x406312
lea edi, [eax]
mov ecx, esi
call fcn.00413e8c
add esi, 8
dec edi
jne 0x406301
mov esi, dword [esp + 0x30]
push esi
call fcn.00419f48
add esp, 4
lea ecx, [esp + 0x28]
mov dword [esp + 0x2b18], 0xffffffff
call fcn.00413e8c
test byte [ebp + 0xc], 0x10
je 0x406006
push ebp
call fcn.0041a683
add esp, 4
lea edx, [esp + 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x508]
push 0x104
push eax
push str.UPDD_Folder
push ebx
call fcn.00410fa4
or ebp, 0xffffffff
mov edi, 0x42a310
mov ecx, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x508]
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x508]
and ecx, 3
push 0x42a990
rep movsb byte es:[edi], byte [esi]
mov edi, str.Autorun.txt
mov ecx, ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x50c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.0041a731
mov esi, eax
add esp, 8
cmp esi, ebx
mov dword [esp + 0x14], esi
je 0x4067ac
mov cl, byte [0x432408]
xor eax, eax
mov byte [esp + 0x1b10], cl
mov ecx, 0x3ff
lea edi, [esp + 0x1b11]
lea edx, [esp + 0x1b10]
rep stosd dword es:[edi], eax
push 0x1000
push edx
stosw word es:[edi], ax
push str.Installing_Bundle
push 0x4257d4
push 0x80000002
stosb byte es:[edi], al
call fcn.0040ae30
mov al, byte [esi + 0xc]
add esp, 0x14
test al, 0x10
jne 0x4067a3
push esi
lea eax, [esp + 0x610]
push 0x400
push eax
call fcn.0041a91f
mov al, byte [esi + 0xc]
add esp, 0xc
test al, 0x10
jne 0x4067a3
lea ecx, [esp + 0x60c]
push 0xd
push ecx
mov byte [esp + 0x1b], 1
call fcn.0041a490
add esp, 8
test eax, eax
je 0x40649c
lea edx, [esp + 0x60c]
push 0xd
push edx
call fcn.0041a490
mov byte [eax], bl
lea eax, [esp + 0x614]
push 0xd
push eax
call fcn.0041a490
add esp, 0x10
test eax, eax
jne 0x406475
lea ecx, [esp + 0x60c]
push 0xa
push ecx
call fcn.0041a490
add esp, 8
test eax, eax
je 0x4064d9
lea edx, [esp + 0x60c]
push 0xa
push edx
call fcn.0041a490
mov byte [eax], bl
lea eax, [esp + 0x614]
push 0xa
push eax
call fcn.0041a490
add esp, 0x10
test eax, eax
jne 0x4064b2
lea ecx, [esp + 0x60c]
push str.NOBUNDLE
push ecx
call fcn.0041a750
add esp, 8
test eax, eax
je 0x40650d
lea edx, [esp + 0x60c]
push str.NOBUNDLE
push edx
call fcn.0041a750
add esp, 8
mov byte [eax], bl
mov byte [esp + 0x13], bl
lea eax, [esp + 0x1b8]
push 0x104
push eax
push str.UPDD_Folder
push ebx
call fcn.00410fa4
mov edi, 0x42a310
mov ecx, ebp
xor eax, eax
lea edx, [esp + 0x1b8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x1bc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x610]
mov ecx, ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x1bc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
cmp byte [esp + 0x13], bl
je 0x406602
mov edi, str._Bundle
mov ecx, ebp
xor eax, eax
lea edx, [esp + 0x1b8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x1b8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1b10]
mov ecx, ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [esp + 0x2b20], bl
je 0x40664c
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea ecx, [esp + 0x30]
lea edx, [esp + 0x60]
push ecx
push edx
push ebx
push ebx
push 0x200
push ebx
push ebx
lea eax, [esp + 0x1d4]
push ebx
push eax
push ebx
mov dword [esp + 0xb4], 1
mov word [esp + 0xb8], bx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
sub esp, 8
mov dword [esp + 0x2b20], 5
mov ecx, esp
mov dword [esp + 0x48], esp
push 0x42a63c
call fcn.00413e2e
sub esp, 8
lea edx, [esp + 0x61c]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
mov byte [esp + 0x2b2c], 6
call fcn.00413e2e
lea eax, [esp + 0x28]
mov byte [esp + 0x2b28], 5
push eax
call fcn.00415816
add esp, 0x14
lea ecx, [esp + 0x1b8]
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00413ead
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.00404690
add esp, 0x10
lea edx, [esp + 0xa0c]
push 0x104
push edx
push str.UPDD_Folder
push ebx
call fcn.00410fa4
mov edi, str.uninst.dat
mov ecx, ebp
xor eax, eax
lea edx, [esp + 0xa0c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x42a438
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0xa10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.0041a731
mov esi, eax
push esi
push str.REGHKEY_LOCAL_MACHINE_SOFTWAREMicrosoftWindowsCurrentVersionRun_
call fcn.0041a635
mov ecx, dword [esp + 0x28]
add esp, 0x10
push esi
call fcn.00413ead
push eax
call fcn.0041a635
push esi
push 0x42a3e8
call fcn.0041a635
push esi
call fcn.0041a683
mov eax, dword [esp + 0x2c]
add esp, 0x14
mov dword [esp + 0x2b18], ebp
cmp eax, ebx
je 0x406793
mov ecx, dword [esp + 0x1c]
mov esi, eax
cmp ecx, ebx
je 0x40678a
lea edi, [ecx]
mov ecx, esi
call fcn.00413e8c
add esi, 8
dec edi
jne 0x406779
mov eax, dword [esp + 0x18]
push eax
call fcn.00419f48
add esp, 4
mov ecx, dword [esp + 0x14]
mov esi, ecx
test byte [ecx + 0xc], 0x10
je 0x406439
push esi
call fcn.0041a683
add esp, 4
mov ecx, dword [esp + 0x2b10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x2b0c
ret