Function at 0x4a60fc
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1d
push 0
push 0
dec ecx
jne 0x4a6104
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a69b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x29], 0
lea eax, [ebp - 8]
call fcn.0049c568
xor eax, eax
push ebp
push 0x4a6168
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 8]
push 0x4a69cc
push 0x4a69d8
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.004044b8
mov eax, dword [ebp - 0x38]
call fcn.00408d28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a6172
xor ecx, ecx
mov dl, 1
mov eax, dword [0x41999c]
call fcn.0041dd90
mov dword [ebp - 0x14], eax
push 0x4a69ec
push 0x4a69fc
mov ecx, dword [0x4ad668]
mov dl, 1
mov eax, dword [0x419a24]
call fcn.0041dec0
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0041db20
mov eax, ebx
call fcn.004033e8
mov dl, 1
mov eax, dword [0x419630]
call fcn.004033b8
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
lea eax, [ebp - 0x14]
call fcn.0040dae4
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x380]
mov ecx, dword [eax]
call dword [ecx + 0xd8]
mov dl, 1
mov eax, dword [0x419920]
call fcn.004033b8
mov dword [ebp - 0x18], eax
mov dl, 1
mov eax, dword [0x419920]
call fcn.004033b8
mov dword [ebp - 0x1c], eax
xor edx, edx
push ebp
push 0x4a6914
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4a67c7
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x10]
inc edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x380]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
push dword [ebp - 4]
push 0x4a69cc
lea ecx, [ebp - 0x3c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
call fcn.0041c458
push dword [ebp - 0x3c]
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004044b8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x384]
mov edx, dword [ebp - 0x24]
call fcn.0043fab8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x384]
mov edx, dword [eax]
call dword [edx + 0x88]
mov al, byte [0x4a6a04]
push eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
call fcn.0041c458
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov edx, 0x4a6a10
call fcn.0040d44c
mov eax, dword [ebp - 0x40]
push eax
push 0x4a6a14
mov ecx, dword [0x4ad668]
mov dl, 1
mov eax, dword [0x419a24]
call fcn.0041dec0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
call fcn.0041dbbc
mov eax, dword [ebp - 0x1c]
call fcn.0041dbbc
lea ecx, [ebp - 0x4c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
call fcn.0041c458
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.0040824c
mov edx, dword [ebp - 0x48]
mov eax, 0x4a6a24
call fcn.0040473c
test eax, eax
jle 0x4a6323
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
call fcn.0041db20
jmp 0x4a6339
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
call fcn.0041db20
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0049c3f4
lea ecx, [ebp - 0x54]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
call fcn.0041c458
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.0040824c
mov eax, dword [ebp - 0x50]
mov edx, 0x4a6a38
call fcn.00404544
je 0x4a6409
lea ecx, [ebp - 0x5c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
call fcn.0041c458
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x58]
call fcn.0040824c
mov eax, dword [ebp - 0x58]
mov edx, 0x4a6a58
call fcn.00404544
je 0x4a6409
lea ecx, [ebp - 0x64]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
call fcn.0041c458
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.0040824c
mov eax, dword [ebp - 0x60]
mov edx, 0x4a6a80
call fcn.00404544
je 0x4a6409
lea ecx, [ebp - 0x6c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
call fcn.0041c458
mov eax, dword [ebp - 0x6c]
lea edx, [ebp - 0x68]
call fcn.0040824c
mov eax, dword [ebp - 0x68]
mov edx, 0x4a6a90
call fcn.00404544
je 0x4a6409
lea ecx, [ebp - 0x74]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
call fcn.0041c458
mov eax, dword [ebp - 0x74]
lea edx, [ebp - 0x70]
call fcn.0040824c
mov eax, dword [ebp - 0x70]
mov edx, 0x4a6aa4
call fcn.00404544
jne 0x4a6539
lea ecx, [ebp - 0x78]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
call fcn.0041c458
mov eax, dword [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
call fcn.0049c568
mov edx, dword [ebp - 0x7c]
lea eax, [ebp - 0x24]
pop ecx
call fcn.00404444
xor edx, edx
push ebp
push 0x4a64c3
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0x84]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
call fcn.0041c458
mov eax, dword [ebp - 0x84]
lea edx, [ebp - 0x80]
call fcn.0040824c
mov eax, dword [ebp - 0x80]
mov edx, 0x4a6a80
call fcn.00404544
jne 0x4a64ab
lea ecx, [ebp - 0x8c]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
call fcn.0041c458
mov eax, dword [ebp - 0x8c]
lea edx, [ebp - 0x88]
call fcn.0040824c
mov eax, dword [ebp - 0x88]
mov edx, 0x4a6a80
call fcn.00404544
jne 0x4a64b6
mov eax, dword [ebp - 0x24]
call fcn.00408c0c
test al, al
jne 0x4a64b6
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
call fcn.0041db38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a65e1
xor eax, eax
push ebp
push 0x4a655f
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
call fcn.0041db38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a65e1
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
call fcn.0041cd58
mov eax, dword [ebp - 0x28]
mov edx, 0x4a6ac0
call fcn.00404544
jne 0x4a665e
push 5
push 0x4a6a04
push 0x4a6b38
push dword [ebp - 0x24]
push 0x4a6b48
lea eax, [ebp - 0xa8]
mov edx, 3
call fcn.004044b8
mov eax, dword [ebp - 0xa8]
call fcn.004045f8
push eax
lea eax, [ebp - 0xac]
mov ecx, 0x4a6b54
mov edx, dword [ebp - 8]
call fcn.00404444
mov eax, dword [ebp - 0xac]
call fcn.004045f8
push eax
push 0x4a6b64
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4a67b3
mov eax, dword [ebp - 0x28]
mov edx, 0x4a6b74
call fcn.00404544
jne 0x4a67b3
cmp byte [ebp - 0x29], 0
jne 0x4a6701
mov eax, 0x4a6b80
call fcn.004a31a0
mov eax, 0x4a6b80
call fcn.004a32b4
lea edx, [ebp - 0xb4]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3ec]
call fcn.00482254
mov eax, dword [ebp - 0xb4]
lea edx, [ebp - 0xb0]
call fcn.0040849c
mov eax, dword [ebp - 0xb0]
push eax
lea edx, [ebp - 0xbc]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3e4]
call fcn.00482254
mov eax, dword [ebp - 0xbc]
lea edx, [ebp - 0xb8]
call fcn.0040849c
mov eax, dword [ebp - 0xb8]
push eax
mov eax, 0x4a6b80
pop edx
pop ecx
call fcn.004a33bc
mov eax, 0x4a6b80
call fcn.004a3b58
mov byte [ebp - 0x29], 1
mov eax, 0x4a6b80
mov edx, dword [ebp - 0x24]
call fcn.004a3520
mov eax, 0x4a6b80
call fcn.004a3678
mov eax, 0x4a6b80
call fcn.004a31a0
lea edx, [ebp - 0xc4]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3e4]
call fcn.00482254
mov eax, dword [ebp - 0xc4]
lea edx, [ebp - 0xc0]
call fcn.0040849c
mov eax, dword [ebp - 0xc0]
push eax
mov ecx, 0x4a6b98
mov edx, 0x4a6ba8
mov eax, 0x80000002
call fcn.0049cb54
lea edx, [ebp - 0xd0]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3ec]
call fcn.00482254
mov eax, dword [ebp - 0xd0]
lea edx, [ebp - 0xcc]
call fcn.0040849c
mov eax, dword [ebp - 0xcc]
lea edx, [ebp - 0xc8]
call fcn.0049c31c
mov eax, dword [ebp - 0xc8]
push eax
mov edx, 0x4a6ba8
mov ecx, 0x4a6bc4
mov eax, 0x80000002
call fcn.0049cb54
mov eax, dword [ebp - 0x34]
call fcn.004033e8
inc dword [ebp - 0x10]
dec dword [ebp - 0x30]
jne 0x4a623a
lea edx, [ebp - 0xd8]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xd8]
lea edx, [ebp - 0xd4]
call fcn.0040824c
mov edx, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0x4a6bd8
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x58]
inc eax
jle 0x4a6864
push 5
push 0x4a6a04
push 0x4a6b38
push dword [ebp - 4]
push 0x4a6bf0
push 0x4a6b48
lea eax, [ebp - 0xdc]
mov edx, 4
call fcn.004044b8
mov eax, dword [ebp - 0xdc]
call fcn.004045f8
push eax
lea eax, [ebp - 0xe0]
mov ecx, 0x4a6b54
mov edx, dword [ebp - 8]
call fcn.00404444
mov eax, dword [ebp - 0xe0]
call fcn.004045f8
push eax
push 0x4a6b64
push 0
call sub.shell32.dll_ShellExecuteA
mov edx, 0x4a6c08
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x58]
inc eax
jle 0x4a68d9
push 5
push 0x4a6a04
push 0x4a6c18
lea eax, [ebp - 0xe4]
mov ecx, 0x4a6c28
mov edx, dword [ebp - 4]
call fcn.00404444
mov eax, dword [ebp - 0xe4]
call fcn.004045f8
push eax
push 0x4a6b64
push 0
call sub.shell32.dll_ShellExecuteA
lea eax, [ebp - 0xe8]
mov ecx, 0x4a6c40
mov edx, dword [ebp - 4]
call fcn.00404444
mov eax, dword [ebp - 0xe8]
push eax
mov ecx, 0x4a6c5c
mov edx, 0x4a6c74
mov eax, 0x80000002
call fcn.0049cb54
push ebp
call fcn.004a5d34
pop ecx
push ebp
call fcn.004a5e40
pop ecx
push ebp
call fcn.004a600c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a691b
lea eax, [ebp - 0x20]
call fcn.0040dae4
lea eax, [ebp - 0x18]
call fcn.0040dae4
lea eax, [ebp - 0x1c]
call fcn.0040dae4
ret