Function at 0x476430
Capabilities:
Find taskbar
Persist via run registry key
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x476438
push ecx
push ebx
push esi
push edi
mov eax, 0x475fb0
call fcn.00406484
xor eax, eax
push ebp
push 0x476761
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, 1
call fcn.00402a4c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408554
mov eax, dword [ebp - 0x14]
mov edx, 0x476778
call fcn.004044ac
je 0x4764a6
push 0x104
mov ecx, 0x476788
mov edx, 0x476794
mov eax, dword [0x48af08]
mov eax, dword [eax]
call fcn.004533b8
cmp eax, 6
jne 0x47672c
push 0x476878
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.0045b044
lea eax, [ebp - 0x1c]
mov edx, 0x476888
call fcn.004049c8
mov eax, dword [ebp - 0x1c]
mov ecx, 0x4768b0
mov edx, 0x80000001
call fcn.00475df0
call fcn.00475954
test al, al
jne 0x476540
push 0
push 0x1a3
push 0x111
push 0
push 0x4768e0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_PostMessageA
jmp 0x47651b
push 0
push 0x1a3
push 0x111
push 0
push 0x4768e0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_PostMessageA
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.0045b044
mov eax, dword [ebp - 0x20]
mov ecx, 5
mov edx, 0x4768f4
call fcn.00475a94
test eax, eax
je 0x4764fd
jmp 0x47672c
mov ecx, 0x476878
mov edx, 0x4768b0
mov eax, 0x80000001
call fcn.00475d5c
push 0x476918
lea edx, [ebp - 0x2c]
xor eax, eax
call fcn.0045b044
push dword [ebp - 0x2c]
push 0x47699c
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00404a8c
mov eax, dword [ebp - 0x28]
call fcn.004049ac
mov edx, eax
lea eax, [ebp - 0x24]
call fcn.004048d8
mov eax, dword [ebp - 0x24]
xor edx, edx
call fcn.00475b48
xor eax, eax
call fcn.004759b0
mov edi, eax
cmp edi, 1
jne 0x476691
xor ebx, ebx
lea edx, [ebp - 0x30]
mov eax, ebx
call fcn.00408964
mov ecx, dword [ebp - 0x30]
mov eax, 0x48d79c
mov edx, 0x4769c8
call fcn.004043ac
lea eax, [ebp - 0x34]
mov ecx, 0x4769e4
mov edx, dword [0x48d79c]
call fcn.004043ac
mov eax, dword [ebp - 0x34]
call fcn.00408f50
test al, al
je 0x476687
push 0
push 0
push 2
push 0
push 3
push 0x10000000
lea eax, [ebp - 0x38]
mov ecx, 0x4769e4
mov edx, dword [0x48d79c]
call fcn.004043ac
mov eax, dword [ebp - 0x38]
call fcn.00404560
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
push 0
push 0x48d7a4
push 0xde00
push 0x47cd04
push esi
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_CloseHandle
lea eax, [ebp - 0x3c]
mov ecx, 0x476a04
mov edx, dword [0x48d79c]
call fcn.004043ac
mov eax, dword [ebp - 0x3c]
call fcn.00408f60
lea eax, [ebp - 0x40]
mov ecx, 0x476a30
mov edx, dword [0x48d79c]
call fcn.004043ac
mov eax, dword [ebp - 0x40]
call fcn.00408f60
lea eax, [ebp - 0x44]
mov ecx, 0x476a58
mov edx, dword [0x48d79c]
call fcn.004043ac
mov eax, dword [ebp - 0x44]
call fcn.00408f60
inc ebx
cmp ebx, 0x11
jne 0x4765a8
test edi, edi
jne 0x4766cd
push 0
push 0
push 3
push 0
push 3
push 0x10000000
push 0x476a78
call sub.kernel32.dll_CreateFileA
mov esi, eax
push 0
push 0x48d7a4
push 0x1000
push 0x47bd04
push esi
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_CloseHandle
mov eax, 0x48d7a0
mov edx, 0x476a94
call fcn.004040f4
mov eax, dword [0x48d7a0]
mov edx, 0x476aa0
call fcn.004044ac
jne 0x476702
test edi, edi
jne 0x4766f8
call fcn.0047587c
jmp 0x476702
mov eax, 6
call fcn.00475eac
mov eax, dword [0x48d7a0]
mov edx, 0x476aac
call fcn.004044ac
jne 0x47671d
mov eax, 6
call fcn.00475eac
mov eax, dword [0x48d7a0]
mov edx, 0x476ab8
call fcn.004044ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476768
lea eax, [ebp - 0x44]
mov edx, 6
call fcn.004040c4
lea eax, [ebp - 0x2c]
mov edx, 5
call fcn.00404798
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004040c4
ret