Function at 0x406d8a
Capabilities:
Move file
Persist via run registry key
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x406d91
call fcn.00415fb0
mov edx, dword [esp + 0x54]
lea ecx, [esp]
call fcn.00409000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 4]
call fcn.00409000
mov edx, dword [esp + 0x5c]
lea ecx, [esp + 8]
call fcn.00409000
mov edx, dword [esp + 0x60]
lea ecx, [esp + 0xc]
call fcn.00409000
mov edx, dword [esp + 0x64]
lea ecx, [esp + 0x10]
call fcn.00409000
mov edx, dword [esp + 0x68]
lea ecx, [esp + 0x14]
call fcn.00409000
mov edx, dword [esp + 0x6c]
lea ecx, [esp + 0x18]
call fcn.00409000
mov edx, dword [esp + 0x70]
lea ecx, [esp + 0x1c]
call fcn.00409000
mov edx, dword [esp + 0x74]
lea ecx, [esp + 0x20]
call fcn.00409000
mov edx, dword [esp + 0x78]
lea ecx, [esp + 0x24]
call fcn.00409000
mov edx, dword [esp + 0x7c]
lea ecx, [esp + 0x28]
call fcn.00409000
mov edx, 0x41902a
lea ecx, [esp + 0x2c]
call fcn.00409008
push edx
call fcn.00415e40
pop edx
push eax
push 6
mov eax, 0x41902a
push eax
push edx
call fcn.00415e40
pop edx
push eax
mov edx, str._IM
push edx
call fcn.00415e80
mov edx, dword [esp + 0x14]
push edx
call fcn.00415e80
mov edx, 0x419046
push edx
call fcn.00415e80
call fcn.00416040
mov eax, str.Taskkill
push eax
call fcn.00409082
add dword [esp + 4], edx
call fcn.004095c4
call fcn.004090a0
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
je 0x406ee6
push dword [esp + 0x30]
call fcn.00409b0b
and eax, eax
je 0x406eb2
jmp 0x406ea3
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e40
pop edx
push eax
push dword [esp + 0x38]
call fcn.00409b52
cdq
push edx
push eax
call fcn.00414570
lea eax, [esp + 0x30]
push eax
call fcn.00415ee0
push dword [esp + 0x30]
call fcn.00409b72
push dword [esp + 0x2c]
mov edx, 0x419196
pop ecx
call fcn.004090c0
jne 0x406f0a
push dword [esp + 0x2c]
mov edx, 0x4191be
pop ecx
call fcn.004090c0
jne 0x406f0a
jmp 0x406f11
mov eax, 1
jmp 0x406f13
xor eax, eax
and eax, eax
je 0x407de7
mov edx, 0x41902a
lea ecx, [esp + 0x2c]
call fcn.00409008
push edx
call fcn.00415e40
pop edx
push eax
push 6
mov eax, 0x41902a
push eax
push edx
call fcn.00415e40
pop edx
push eax
mov edx, str.delete
push edx
call fcn.00415e80
mov edx, dword [esp + 0x30]
push edx
call fcn.00415e80
call fcn.00416040
mov edx, dword [esp + 0x38]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, str.sc.exe
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.00409082
add dword [esp + 4], edx
call fcn.004095c4
call fcn.004090a0
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
je 0x406fe4
push dword [esp + 0x30]
call fcn.00409b0b
and eax, eax
je 0x406fb0
jmp 0x406fa1
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e40
pop edx
push eax
push dword [esp + 0x38]
call fcn.00409b52
cdq
push edx
push eax
call fcn.00414570
lea eax, [esp + 0x30]
push eax
call fcn.00415ee0
push dword [esp + 0x30]
call fcn.00409b72
push dword [esp + 0x2c]
mov edx, 0x419196
pop ecx
call fcn.004090c0
jne 0x40702a
push dword [esp + 0x2c]
mov edx, str.1072
pop ecx
call fcn.004090c0
jne 0x40702a
push dword [esp + 0x2c]
mov edx, str.1060
pop ecx
call fcn.004090c0
jne 0x40702a
push dword [esp + 0x2c]
mov edx, str.1639
pop ecx
call fcn.004090c0
jne 0x40702a
jmp 0x407031
mov eax, 1
jmp 0x407033
xor eax, eax
and eax, eax
je 0x40707a
push dword [esp + 0x2c]
mov edx, str.1072
pop ecx
call fcn.004090c0
jne 0x40705b
push dword [esp + 0x2c]
mov edx, str.1639
pop ecx
call fcn.004090c0
jne 0x40705b
jmp 0x407062
mov eax, 1
jmp 0x407064
xor eax, eax
and eax, eax
je 0x407072
mov dword [esp + 0x34], 2
jmp 0x40707a
mov dword [esp + 0x34], 1
push edx
call fcn.00415e40
pop edx
push eax
mov edx, str.delete__HKLMSoftware_
push edx
call fcn.00415e80
mov edx, dword [esp + 0x14]
push edx
call fcn.00415e80
mov edx, 0x41902c
push edx
call fcn.00415e80
lea eax, [esp + 0x3c]
push eax
call fcn.00415ee0
push 6
mov eax, 0x41902a
push eax
push dword [esp + 0x40]
mov eax, str.reg.exe
push eax
call fcn.004095c4
push edx
call fcn.00415e40
pop edx
push eax
mov edx, str.delete__HKCUSoftware_
push edx
call fcn.00415e80
mov edx, dword [esp + 0x14]
push edx
call fcn.00415e80
mov edx, 0x41902c
push edx
call fcn.00415e80
lea eax, [esp + 0x3c]
push eax
call fcn.00415ee0
push 6
mov eax, 0x41902a
push eax
push dword [esp + 0x40]
mov eax, str.reg.exe
push eax
call fcn.004095c4
push edx
call fcn.00415e40
pop edx
push eax
mov edx, str.delete__HKLMSoftwareMicrosoftWindowsCurrentVersionRun___v__
push edx
call fcn.00415e80
mov edx, dword [esp + 0x20]
push edx
call fcn.00415e80
mov edx, 0x41902c
push edx
call fcn.00415e80
lea eax, [esp + 0x3c]
push eax
call fcn.00415ee0
push 6
mov eax, 0x41902a
push eax
push dword [esp + 0x40]
mov eax, str.reg.exe
push eax
call fcn.004095c4
push edx
call fcn.00415e40
pop edx
push eax
push 0x24
call fcn.00401e77
mov edx, str.iTrash_
push edx
call fcn.00415e80
lea eax, [esp + 0x40]
push eax
call fcn.00415ee0
push edx
call fcn.00415e40
pop edx
push eax
push 2
mov eax, 0x41902a
push eax
mov edx, dword [esp + 0xc]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, str.pluginscom_
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.0040e3b1
call fcn.004090a0
push edx
call fcn.00415e40
pop edx
push eax
push 2
mov eax, 0x41902a
push eax
mov edx, dword [esp + 0xc]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, str.plugins_svc_
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.0040e3b1
call fcn.004090a0
push edx
call fcn.00415e40
pop edx
push eax
push 2
mov eax, 0x41902a
push eax
mov edx, dword [esp + 0xc]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, str.plugins_
push edx
call fcn.00415e80
mov edx, dword [esp + 0x34]
push edx
call fcn.00415e80
mov edx, 0x4192bc
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.0040e3b1
call fcn.004090a0
push edx
call fcn.00415e40
pop edx
push eax
push 2
mov eax, 0x41902a
push eax
mov edx, dword [esp + 0xc]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, str.plugins_
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.0040e3b1
call fcn.004090a0
push 2
mov eax, 0x41902a
push eax
push dword [esp + 8]
call fcn.0040e3b1
push edx
call fcn.00415e40
pop edx
push eax
push 2
mov edx, dword [esp + 0x30]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, dword [esp + 0x14]
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.0040e755
call fcn.004090a0
push edx
call fcn.00415e40
pop edx
push eax
push 2
mov edx, dword [esp + 0x30]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, str.drivers_
push edx
call fcn.00415e80
mov edx, dword [esp + 0x18]
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.0040e755
call fcn.004090a0
push edx
call fcn.00415e40
pop edx
push eax
push 2
mov edx, dword [esp + 0x30]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, 0x419ed6
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.0040e755
call fcn.004090a0
push edx
call fcn.00415e40
pop edx
push eax
push 2
mov edx, dword [esp + 0x30]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, 0x41a1e2
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.0040e755
call fcn.004090a0
push edx
call fcn.00415e40
pop edx
push eax
push 2
mov edx, dword [esp + 0x30]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, 0x41a260
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.0040e755
call fcn.004090a0
push dword [esp]
call fcn.0040e1da
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x407401
cmp edi, 0xffffffff
je 0x407405
xor eax, eax
jmp 0x40740a
mov eax, 1
or eax, eax
je 0x40747e
push dword [esp + 0x3c]
call fcn.00401b3d
mov ebx, eax
cmp ebx, 1
jne 0x40747e
mov dword [esp + 0x34], 2
push edx
call fcn.00415e40
pop edx
push eax
mov edx, dword [esp + 0x40]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
push edx
call fcn.00415e40
pop edx
push eax
push 8
call fcn.00406611
mov edx, dword [esp]
push edx
call fcn.004090a0
push eax
call fcn.00415e80
pop eax
call fcn.00416040
push dword [esp + 8]
call fcn.00409082
add dword [esp + 4], edx
call sub.KERNEL32.dll_MoveFileW
call fcn.004090a0
push edx
call fcn.00415e40
pop edx
push eax
mov edx, dword [esp + 0x2c]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, dword [esp + 0x10]
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.0040e1da
call fcn.004090a0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4074c8
jl 0x4074c4
cmp ebx, 0
ja 0x4074c8
xor eax, eax
jmp 0x4074cd
mov eax, 1
or eax, eax
je 0x407574
push dword [esp + 0x3c]
call fcn.00401b3d
mov ebx, eax
cmp ebx, 1
jne 0x407574
mov dword [esp + 0x34], 2
push edx
call fcn.00415e40
pop edx
push eax
mov edx, dword [esp + 0x40]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, 0x4192bc
push edx
call fcn.00415e80
push edx
call fcn.00415e40
pop edx
push eax
push 8
call fcn.00406611
mov edx, dword [esp]
push edx
call fcn.004090a0
push eax
call fcn.00415e80
pop eax
call fcn.00416040
mov edx, dword [esp + 0x30]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, dword [esp + 0x14]
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.00409082
add dword [esp + 4], edx
call fcn.00401f00
call fcn.004090a0
push edx
call fcn.00415e40
pop edx
push eax
mov edx, dword [esp + 0x2c]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, str.drivers_
push edx
call fcn.00415e80
mov edx, dword [esp + 0x14]
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.0040e1da
call fcn.004090a0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4075c9
jl 0x4075c5
cmp ebx, 0
ja 0x4075c9
xor eax, eax
jmp 0x4075ce
mov eax, 1
or eax, eax
je 0x407680
push dword [esp + 0x3c]
call fcn.00401b3d
mov ebx, eax
cmp ebx, 1
jne 0x407680
mov dword [esp + 0x34], 2
push edx
call fcn.00415e40
pop edx
push eax
mov edx, dword [esp + 0x40]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, 0x4192bc
push edx
call fcn.00415e80
push edx
call fcn.00415e40
pop edx
push eax
push 8
call fcn.00406611
mov edx, dword [esp]
push edx
call fcn.004090a0
push eax
call fcn.00415e80
pop eax
call fcn.00416040
mov edx, dword [esp + 0x30]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, str.drivers_
push edx
call fcn.00415e80
mov edx, dword [esp + 0x18]
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.00409082
add dword [esp + 4], edx
call fcn.00401f00
call fcn.004090a0
push edx
call fcn.00415e40
pop edx
push eax
mov edx, dword [esp + 0x2c]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, 0x419ed6
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.0040e1da
call fcn.004090a0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4076cb
jl 0x4076c7
cmp ebx, 0
ja 0x4076cb
xor eax, eax
jmp 0x4076d0
mov eax, 1
or eax, eax
je 0x40774e
push dword [esp + 0x3c]
call fcn.00401b3d
mov ebx, eax
cmp ebx, 1
jne 0x40774e
mov dword [esp + 0x34], 2
push edx
call fcn.00415e40
pop edx
push eax
mov edx, dword [esp + 0x40]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, str._vcruntime140.dll
push edx
call fcn.00415e80
call fcn.00416040
mov edx, dword [esp + 0x30]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, 0x419ed6
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.00409082
add dword [esp + 4], edx
call fcn.00401f00
call fcn.004090a0
push edx
call fcn.00415e40
pop edx
push eax
mov edx, dword [esp + 0x2c]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, 0x41a1e2
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.0040e1da
call fcn.004090a0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x407799
jl 0x407795
cmp ebx, 0
ja 0x407799
xor eax, eax
jmp 0x40779e
mov eax, 1
or eax, eax
je 0x40781c
push dword [esp + 0x3c]
call fcn.00401b3d
mov ebx, eax
cmp ebx, 1
jne 0x40781c
mov dword [esp + 0x34], 2
push edx
call fcn.00415e40
pop edx
push eax
mov edx, dword [esp + 0x40]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, str._vcruntime140_1.dll
push edx
call fcn.00415e80
call fcn.00416040
mov edx, dword [esp + 0x30]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, 0x41a1e2
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.00409082
add dword [esp + 4], edx
call fcn.00401f00
call fcn.004090a0
push edx
call fcn.00415e40
pop edx
push eax
mov edx, dword [esp + 0x2c]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, 0x41a260
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.0040e1da
call fcn.004090a0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x407867
jl 0x407863
cmp ebx, 0
ja 0x407867
xor eax, eax
jmp 0x40786c
mov eax, 1
or eax, eax
je 0x4078ea
push dword [esp + 0x3c]
call fcn.00401b3d
mov ebx, eax
cmp ebx, 1
jne 0x4078ea
mov dword [esp + 0x34], 2
push edx
call fcn.00415e40
pop edx
push eax
mov edx, dword [esp + 0x40]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, 0x41a472
push edx
call fcn.00415e80
call fcn.00416040
mov edx, dword [esp + 0x30]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, 0x41a260
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.00409082
add dword [esp + 4], edx
call fcn.00401f00
call fcn.004090a0
push 2
push dword [0x96eb1c]
call fcn.0040e755
push edx
call fcn.00415e40
pop edx
push eax
mov edx, 0x41944c
push edx
call fcn.00415e80
mov edx, dword [esp + 0x18]
push edx
call fcn.00415e80
mov edx, 0x4191ba
push edx
call fcn.00415e80
mov edx, dword [esp + 0x1c]
push edx
call fcn.00415e80
mov edx, 0x41902c
push edx
call fcn.00415e80
lea eax, [esp + 0x3c]
push eax
call fcn.00415ee0
push 6
mov eax, 0x41902a
push eax
push dword [esp + 0x40]
mov eax, str.reg.exe
push eax
call fcn.004095c4
mov edx, str.delete__HKCUNetwork___f__reg:64
lea ecx, [esp + 0x38]
call fcn.00409008
push 6
mov eax, 0x41902a
push eax
push dword [esp + 0x40]
mov eax, str.reg.exe
push eax
call fcn.004095c4
mov edx, str.add__HKCUNetwork___f__reg:64
lea ecx, [esp + 0x38]
call fcn.00409008
push 6
mov eax, 0x41902a
push eax
push dword [esp + 0x40]
mov eax, str.reg.exe
push eax
call fcn.004095c4
push edx
call fcn.00415e40
pop edx
push eax
mov edx, str.delete__HKLMSYSTEMControlSet001Services_
push edx
call fcn.00415e80
mov edx, dword [esp + 0x24]
push edx
call fcn.00415e80
mov edx, 0x41902c
push edx
call fcn.00415e80
lea eax, [esp + 0x3c]
push eax
call fcn.00415ee0
push 6
mov eax, 0x41902a
push eax
push dword [esp + 0x40]
mov eax, str.reg.exe
push eax
call fcn.004095c4
push edx
call fcn.00415e40
pop edx
push eax
mov eax, 0x41a84a
push eax
mov eax, str.SYSTEMControlSet001ControlNetworkProviderHwOrder
push eax
push 0x80000002
call fcn.0040173f
lea eax, [esp + 0x44]
push eax
call fcn.00415ee0
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e40
pop edx
push eax
mov edx, 0x41918a
push edx
call fcn.00415e80
mov edx, dword [esp + 0x28]
push edx
call fcn.00415e80
mov edx, 0x41918a
push edx
call fcn.00415e80
call fcn.00416040
push edx
call fcn.00415e40
pop edx
push eax
mov edx, 0x41918a
push edx
call fcn.00415e80
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e40
pop edx
push eax
push dword [esp + 0x54]
call fcn.004149d0
pop eax
mov edx, 0x41918a
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.00409082
add dword [esp + 4], edx
call fcn.00414f30
call fcn.004090a0
mov ebx, eax
and ebx, ebx
jle 0x407bd2
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e40
pop edx
push eax
mov eax, 0x41902a
push eax
mov edx, dword [esp + 0x2c]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, 0x41918a
push edx
call fcn.00415e80
call fcn.00416040
push dword [esp + 0x50]
call fcn.00409082
add dword [esp + 4], edx
call fcn.00414d80
lea eax, [esp + 0x48]
push eax
call fcn.00415ee0
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e40
pop edx
push eax
mov eax, 0x41902a
push eax
push edx
call fcn.00415e40
pop edx
push eax
mov edx, 0x41918a
push edx
call fcn.00415e80
mov edx, dword [esp + 0x30]
push edx
call fcn.00415e80
call fcn.00416040
push dword [esp + 0x54]
call fcn.00409082
add dword [esp + 4], edx
call fcn.00414d80
lea eax, [esp + 0x48]
push eax
call fcn.00415ee0
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e40
pop edx
push eax
mov eax, 0x41902a
push eax
push dword [esp + 0x2c]
push dword [esp + 0x54]
call fcn.00414d80
lea eax, [esp + 0x48]
push eax
call fcn.00415ee0
push edx
call fcn.00415e40
pop edx
push eax
mov edx, str.add__HKLMSYSTEMControlSet001ControlNetworkProviderHwOrder___v_ProviderOrder__t_REG_SZ__d__
push edx
call fcn.00415e80
mov edx, dword [esp + 0x48]
push edx
call fcn.00415e80
mov edx, 0x41902c
push edx
call fcn.00415e80
lea eax, [esp + 0x3c]
push eax
call fcn.00415ee0
push 6
mov eax, 0x41902a
push eax
push dword [esp + 0x40]
mov eax, str.reg.exe
push eax
call fcn.004095c4
push edx
call fcn.00415e40
pop edx
push eax
mov eax, 0x41a84a
push eax
mov eax, str.SYSTEMControlSet001ControlNetworkProviderOrder
push eax
push 0x80000002
call fcn.0040173f
lea eax, [esp + 0x44]
push eax
call fcn.00415ee0
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e40
pop edx
push eax
mov edx, 0x41918a
push edx
call fcn.00415e80
mov edx, dword [esp + 0x28]
push edx
call fcn.00415e80
mov edx, 0x41918a
push edx
call fcn.00415e80
call fcn.00416040
push edx
call fcn.00415e40
pop edx
push eax
mov edx, 0x41918a
push edx
call fcn.00415e80
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e40
pop edx
push eax
push dword [esp + 0x54]
call fcn.004149d0
pop eax
mov edx, 0x41918a
push edx
call fcn.00415e80
call fcn.00409082
add dword [esp], edx
call fcn.00409082
add dword [esp + 4], edx
call fcn.00414f30
call fcn.004090a0
mov ebx, eax
and ebx, ebx
jle 0x407dad
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e40
pop edx
push eax
mov eax, 0x41902a
push eax
mov edx, dword [esp + 0x2c]
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e80
mov edx, 0x41918a
push edx
call fcn.00415e80
call fcn.00416040
push dword [esp + 0x50]
call fcn.00409082
add dword [esp + 4], edx
call fcn.00414d80
lea eax, [esp + 0x48]
push eax
call fcn.00415ee0
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e40
pop edx
push eax
mov eax, 0x41902a
push eax
push edx
call fcn.00415e40
pop edx
push eax
mov edx, 0x41918a
push edx
call fcn.00415e80
mov edx, dword [esp + 0x30]
push edx
call fcn.00415e80
call fcn.00416040
push dword [esp + 0x54]
call fcn.00409082
add dword [esp + 4], edx
call fcn.00414d80
lea eax, [esp + 0x48]
push eax
call fcn.00415ee0
push edx
call fcn.00415e40
pop edx
push eax
push edx
call fcn.00415e40
pop edx
push eax
mov eax, 0x41902a
push eax
push dword [esp + 0x2c]
push dword [esp + 0x54]
call fcn.00414d80
lea eax, [esp + 0x48]
push eax
call fcn.00415ee0
push edx
call fcn.00415e40
pop edx
push eax
mov edx, str.add__HKLMSYSTEMControlSet001ControlNetworkProviderOrder___v_ProviderOrder__t_REG_SZ__d__
push edx
call fcn.00415e80
mov edx, dword [esp + 0x48]
push edx
call fcn.00415e80
mov edx, 0x41902c
push edx
call fcn.00415e80
lea eax, [esp + 0x3c]
push eax
call fcn.00415ee0
push 6
mov eax, 0x41902a
push eax
push dword [esp + 0x40]
mov eax, str.reg.exe
push eax
call fcn.004095c4
push dword [esp + 0x3c]
call fcn.0040e1da
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x407dc4
cmp edi, 0xffffffff
je 0x407dc8
xor eax, eax
jmp 0x407dcd
mov eax, 1
or eax, eax
je 0x407de5
push 2
mov eax, 0x41902a
push eax
push dword [esp + 0x44]
call fcn.0040e3b1
jmp 0x407def
mov dword [esp + 0x34], 3
push dword [esp + 0x3c]
call fcn.0040e1da
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x407e06
cmp edi, 0xffffffff
je 0x407e0a
xor eax, eax
jmp 0x407e0f
mov eax, 1
or eax, eax
je 0x407e5f
push edx
call fcn.00415e40
pop edx
push eax
mov edx, str.add__HKLMSoftwareMicrosoftWindowsCurrentVersionRunOnce___v_itrash__t_REG_SZ__d__cmd__c_rmdir__s
push edx
call fcn.00415e80
mov edx, dword [esp + 0x40]
push edx
call fcn.00415e80
mov edx, str.__q__reg_delete_HKLMSoftwareMicrosoftWindowsCurrentVersionRunOnce__v_itrash__f__reg:64___f__reg:64
push edx
call fcn.00415e80
lea eax, [esp + 0x3c]
push eax
call fcn.00415ee0
push 6
mov eax, 0x41902a
push eax
push dword [esp + 0x40]
mov eax, str.reg.exe
push eax
call fcn.004095c4
mov eax, dword [esp + 0x34]
jmp 0x407e67
push dword [esp + 0x20]
call fcn.00416070
push dword [esp + 0x18]
call fcn.00416070
push dword [esp + 0x40]
call fcn.00416070
push dword [esp + 4]
call fcn.00416070
push dword [esp + 0x10]
call fcn.00416070
push dword [esp + 0x28]
call fcn.00416070
push dword [esp + 0x2c]
call fcn.00416070
push dword [esp + 0x24]
call fcn.00416070
push dword [esp + 0x44]
call fcn.00416070
push dword [esp + 0x38]
call fcn.00416070
push dword [esp + 0x14]
call fcn.00416070
push dword [esp + 0x1c]
call fcn.00416070
push dword [esp + 0xc]
call fcn.00416070
push dword [esp + 8]
call fcn.00416070
push dword [esp]
call fcn.00416070
push dword [esp + 0x3c]
call fcn.00416070
add esp, 0x48
pop edi
pop ebx
ret 0x2c