Function at 0x40a440
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x3e8
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push eax
push str.d3dupdate.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebp, dword [sym.imp.MSVCRT.dll__strlwr]
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
add esp, 0x10
test eax, eax
je 0x40a4f6
lea ecx, [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push str.system
push edx
call ebx
add esp, 0xc
test eax, eax
je 0x40a4f6
lea eax, [esp + 0x10]
push str.bbeagle.exe
push eax
call ebx
add esp, 8
test eax, eax
je 0x40a4f6
push str.d3dupdate.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40a4f6
mov eax, dword [0x415e54]
test eax, eax
je 0x40a4f6
push str.W32_Bagle.A.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov ecx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.au.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40a589
lea eax, [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
push str.system
push ecx
call ebx
add esp, 0xc
test eax, eax
je 0x40a589
lea edx, [esp + 0x10]
push str.au.exe
push edx
call ebx
add esp, 8
test eax, eax
je 0x40a589
push str.au.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40a589
mov eax, dword [0x415e54]
test eax, eax
je 0x40a589
push str.W32_Bagle.B.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov eax, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
push str.gouday.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40a6ac
lea edx, [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x14]
push str.system
push eax
call ebx
add esp, 0xc
test eax, eax
je 0x40a6ac
lea ecx, [esp + 0x10]
push str.readme.exe
push ecx
call ebx
add esp, 8
test eax, eax
je 0x40a6ac
push str.gouday.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40a629
mov eax, dword [0x415e54]
test eax, eax
je 0x40a629
push str.W32_Bagle.C.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov edx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push edx
call edi
push str.SoftwareDateTime2
push 0x80000001
call fcn.004051a0
add esp, 8
test eax, eax
je 0x40a66a
mov eax, dword [0x415e54]
test eax, eax
je 0x40a66a
push str.W32_Bagle.C.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov eax, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push eax
call edi
push str.SoftwareDateTime3
push 0x80000001
call fcn.004051a0
add esp, 8
test eax, eax
je 0x40a6ac
mov eax, dword [0x415e54]
test eax, eax
je 0x40a6ac
push str.W32_Bagle.D.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov ecx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.rate.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40a78d
lea eax, [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
push str.system
push ecx
call ebx
add esp, 0xc
test eax, eax
je 0x40a78d
lea edx, [esp + 0x10]
push str.i1ru74n4.exe
push edx
call ebx
add esp, 8
test eax, eax
je 0x40a78d
push str.rate.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40a74b
mov eax, dword [0x415e54]
test eax, eax
je 0x40a74b
push str.W32_Bagle.E.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov eax, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push eax
call edi
push str.SoftwareDateTime4
push 0x80000001
call fcn.004051a0
add esp, 8
test eax, eax
je 0x40a78d
mov eax, dword [0x415e54]
test eax, eax
je 0x40a78d
push str.W32_Bagle.E.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov ecx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.rate.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40a86e
lea eax, [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
push str.system
push ecx
call ebx
add esp, 0xc
test eax, eax
je 0x40a86e
lea edx, [esp + 0x10]
push str.i1ru54n4.exe
push edx
call ebx
add esp, 8
test eax, eax
je 0x40a86e
push str.rate.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40a82c
mov eax, dword [0x415e54]
test eax, eax
je 0x40a82c
push str.W32_Bagle.F.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov eax, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push eax
call edi
push str.Softwarewinword
push 0x80000001
call fcn.004051a0
add esp, 8
test eax, eax
je 0x40a86e
mov eax, dword [0x415e54]
test eax, eax
je 0x40a86e
push str.W32_Bagle.F.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov ecx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.rate.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40a901
lea eax, [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
push str.system
push ecx
call ebx
add esp, 0xc
test eax, eax
je 0x40a901
lea edx, [esp + 0x10]
push str.i11r54n4.exe
push edx
call ebx
add esp, 8
test eax, eax
je 0x40a901
push str.rate.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40a901
mov eax, dword [0x415e54]
test eax, eax
je 0x40a901
push str.W32_Bagle.G.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov eax, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
push str.ssate.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40a995
lea edx, [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x14]
push str.system
push eax
call ebx
add esp, 0xc
test eax, eax
je 0x40a995
lea ecx, [esp + 0x10]
push str.irun4.exe
push ecx
call ebx
add esp, 8
test eax, eax
je 0x40a995
push str.ssate.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40a995
mov eax, dword [0x415e54]
test eax, eax
je 0x40a995
push str.W32_Bagle.J.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov edx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push edx
call edi
lea eax, [esp + 0x10]
push eax
push str.ssate.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40aa29
lea ecx, [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push str.system
push edx
call ebx
add esp, 0xc
test eax, eax
je 0x40aa29
lea eax, [esp + 0x10]
push str.winsys.exe
push eax
call ebx
add esp, 8
test eax, eax
je 0x40aa29
push str.ssate.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40aa29
mov eax, dword [0x415e54]
test eax, eax
je 0x40aa29
push str.W32_Bagle.K.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov ecx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.winupd.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40aabc
lea eax, [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
push str.system
push ecx
call ebx
add esp, 0xc
test eax, eax
je 0x40aabc
lea edx, [esp + 0x10]
push str.winupd.exe
push edx
call ebx
add esp, 8
test eax, eax
je 0x40aabc
push str.winupd.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40aabc
mov eax, dword [0x415e54]
test eax, eax
je 0x40aabc
push str.W32_Bagle.N.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov eax, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
push str.directs.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40ab50
lea edx, [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x14]
push str.system
push eax
call ebx
add esp, 0xc
test eax, eax
je 0x40ab50
lea ecx, [esp + 0x10]
push str.directs.exe
push ecx
call ebx
add esp, 8
test eax, eax
je 0x40ab50
push str.directs.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40ab50
mov eax, dword [0x415e54]
test eax, eax
je 0x40ab50
push str.W32_Bagle.Q.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov edx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push edx
call edi
lea eax, [esp + 0x10]
push eax
push str.gigabit.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40ac32
lea ecx, [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push str.system
push edx
call ebx
add esp, 0xc
test eax, eax
je 0x40ac32
lea eax, [esp + 0x10]
push str.gigabit.exe
push eax
call ebx
add esp, 8
test eax, eax
je 0x40ac32
push str.gigabit.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40abf0
mov eax, dword [0x415e54]
test eax, eax
je 0x40abf0
push str.W32_Bagle.U.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov ecx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push ecx
call edi
push str.SoftwareWindows2004
push 0x80000001
call fcn.004051a0
add esp, 8
test eax, eax
je 0x40ac32
mov eax, dword [0x415e54]
test eax, eax
je 0x40ac32
push str.W32_Bagle.U.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov edx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push edx
call edi
lea eax, [esp + 0x10]
push eax
push str.sysinfo.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40ad14
lea ecx, [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push str.system
push edx
call ebx
add esp, 0xc
test eax, eax
je 0x40ad14
lea eax, [esp + 0x10]
push str.sysinfo.exe
push eax
call ebx
add esp, 8
test eax, eax
je 0x40ad14
push str.sysinfo.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40acd2
mov eax, dword [0x415e54]
test eax, eax
je 0x40acd2
push str.W32_Bagle.V.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov ecx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push ecx
call edi
push str.SoftwareWindows2005
push 0x80000001
call fcn.004051a0
add esp, 8
test eax, eax
je 0x40ad14
mov eax, dword [0x415e54]
test eax, eax
je 0x40ad14
push str.W32_Bagle.V.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov edx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push edx
call edi
lea eax, [esp + 0x10]
push eax
push str.drvsys.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40ada8
lea ecx, [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push str.system
push edx
call ebx
add esp, 0xc
test eax, eax
je 0x40ada8
lea eax, [esp + 0x10]
push str.drvsys.exe
push eax
call ebx
add esp, 8
test eax, eax
je 0x40ada8
push str.drvsys.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40ada8
mov eax, dword [0x415e54]
test eax, eax
je 0x40ada8
push str.W32_Bagle.Z.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov ecx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.drvddll.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40ae3b
lea eax, [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
push str.system
push ecx
call ebx
add esp, 0xc
test eax, eax
je 0x40ae3b
lea edx, [esp + 0x10]
push str.drvddll.exe
push edx
call ebx
add esp, 8
test eax, eax
je 0x40ae3b
push str.drvddll.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
invalid
or al, 0x85
invalid
je 0x40ae3b
mov eax, dword [0x415e54]
test eax, eax
je 0x40ae3b
push str.W32_Bagle.Aa.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov eax, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
push str.reg_key
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40aecf
lea edx, [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x14]
push str.system
push eax
call ebx
add esp, 0xc
test eax, eax
je 0x40aecf
lea ecx, [esp + 0x10]
push str.loader_name.exe
push ecx
call ebx
add esp, 8
test eax, eax
je 0x40aecf
push str.reg_key
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40aecf
mov eax, dword [0x415e54]
test eax, eax
je 0x40aecf
push str.W32_Bagle.Ae.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov edx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push edx
call edi
lea eax, [esp + 0x10]
push eax
push str.reg_key
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40af63
lea ecx, [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push str.system
push edx
call ebx
add esp, 0xc
test eax, eax
je 0x40af63
lea eax, [esp + 0x10]
push str.loader_name.exe
push eax
call ebx
add esp, 8
test eax, eax
je 0x40af63
push str.reg_key
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40af63
mov eax, dword [0x415e54]
test eax, eax
je 0x40af63
push str.W32_Bagle.Ac.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov ecx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push 0x413948
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40aff6
lea eax, [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
push str.system
push ecx
call ebx
add esp, 0xc
test eax, eax
je 0x40aff6
lea edx, [esp + 0x10]
push str.sysxp.exe
push edx
call ebx
add esp, 8
test eax, eax
je 0x40aff6
push 0x413948
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40aff6
mov eax, dword [0x415e54]
test eax, eax
je 0x40aff6
push str.W32_Bagle.Af.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov eax, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
push 0x413948
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40b08a
lea edx, [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x14]
push str.system
push eax
call ebx
add esp, 0xc
test eax, eax
je 0x40b08a
lea ecx, [esp + 0x10]
push str.sys_xp.exe
push ecx
call ebx
add esp, 8
test eax, eax
je 0x40b08a
push 0x413948
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40b08a
mov eax, dword [0x415e54]
test eax, eax
je 0x40b08a
push str.W32_Bagle.Ag.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov edx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push edx
call edi
lea eax, [esp + 0x10]
push eax
push 0x413948
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40b11e
lea ecx, [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push str.system
push edx
call ebx
add esp, 0xc
test eax, eax
je 0x40b11e
lea eax, [esp + 0x10]
push str.winxp.exe
push eax
call ebx
add esp, 8
test eax, eax
je 0x40b11e
push 0x413948
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40b11e
mov eax, dword [0x415e54]
test eax, eax
je 0x40b11e
push str.W32_Bagle.Ah.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov ecx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.win_upd2.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40b1b1
lea eax, [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
push str.system
push ecx
call ebx
add esp, 0xc
test eax, eax
je 0x40b1b1
lea edx, [esp + 0x10]
push str.windirect.exe
push edx
call ebx
add esp, 8
test eax, eax
je 0x40b1b1
push str.win_upd2.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40b1b1
mov eax, dword [0x415e54]
test eax, eax
je 0x40b1b1
push str.W32_Bagle.Aq.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov eax, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
push str.win_upd2.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40b245
lea edx, [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x14]
push str.system
push eax
call ebx
add esp, 0xc
test eax, eax
je 0x40b245
lea ecx, [esp + 0x10]
push str.windirect.exe
push ecx
call ebx
add esp, 8
test eax, eax
je 0x40b245
push str.win_upd2.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40b245
mov eax, dword [0x415e54]
test eax, eax
je 0x40b245
push str.W32_Bagle.Aq.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov edx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push edx
call edi
lea eax, [esp + 0x10]
push eax
push str.wersds.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40b2f0
lea ecx, [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push str.sysdir
push edx
call ebx
add esp, 0xc
test eax, eax
jne 0x40b2a9
lea eax, [esp + 0x10]
push str.system
push eax
call ebx
add esp, 8
test eax, eax
je 0x40b2f0
lea ecx, [esp + 0x10]
push str.doriot.exe
push ecx
call ebx
add esp, 8
test eax, eax
je 0x40b2f0
push str.wersds.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40b2f0
mov eax, dword [0x415e54]
test eax, eax
je 0x40b2f0
push str.W32_Bagle.Dl.A.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov edx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push edx
call edi
lea eax, [esp + 0x10]
push eax
push str.wersds.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40b39b
lea ecx, [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push str.sysdir
push edx
call ebx
add esp, 0xc
test eax, eax
jne 0x40b354
lea eax, [esp + 0x10]
push str.system
push eax
call ebx
add esp, 8
test eax, eax
je 0x40b39b
lea ecx, [esp + 0x10]
push str.doriot.exe
push ecx
call ebx
add esp, 8
test eax, eax
je 0x40b39b
push str.wersds.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40b39b
mov eax, dword [0x415e54]
test eax, eax
je 0x40b39b
push str.W32_Bagle.Dl.A.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov edx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push edx
call edi
lea eax, [esp + 0x10]
push eax
push str.erthgdr
push str.SoftwareMicrosoftWindowsCurrentVersionRu1n
push 0x80000002
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40b446
lea ecx, [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push str.sysdir
push edx
call ebx
add esp, 0xc
test eax, eax
jne 0x40b3ff
lea eax, [esp + 0x10]
push str.system
push eax
call ebx
add esp, 8
test eax, eax
je 0x40b446
lea ecx, [esp + 0x10]
push str.windll.exe
push ecx
call ebx
add esp, 8
test eax, eax
je 0x40b446
push str.erthgdr
push str.SoftwareMicrosoftWindowsCurrentVersionRu1n
push 0x80000002
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40b446
mov eax, dword [0x415e54]
test eax, eax
je 0x40b446
push str.W32_Bagle.Al.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov edx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push edx
call edi
lea eax, [esp + 0x10]
push eax
push str.erthgdr
push str.SoftwareMicrosoftWindowsCurrentVersionRu1n
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40b4f1
lea ecx, [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push str.sysdir
push edx
call ebx
add esp, 0xc
test eax, eax
jne 0x40b4aa
lea eax, [esp + 0x10]
push str.system
push eax
call ebx
add esp, 8
test eax, eax
je 0x40b4f1
lea ecx, [esp + 0x10]
push str.windll.exe
push ecx
call ebx
add esp, 8
test eax, eax
je 0x40b4f1
push str.erthgdr
push str.SoftwareMicrosoftWindowsCurrentVersionRu1n
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40b4f1
mov eax, dword [0x415e54]
test eax, eax
je 0x40b4f1
push str.W32_Bagle.Al.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov edx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push edx
call edi
lea eax, [esp + 0x10]
push eax
push str.bawindo
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40b603
lea ecx, [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push str.sysdir
push edx
call ebx
add esp, 0xc
test eax, eax
jne 0x40b555
lea eax, [esp + 0x10]
push str.system
push eax
call ebx
add esp, 8
test eax, eax
je 0x40b59c
lea ecx, [esp + 0x10]
push str.bawindo.exe
push ecx
call ebx
add esp, 8
test eax, eax
je 0x40b59c
push str.bawindo
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40b59c
mov eax, dword [0x415e54]
test eax, eax
je 0x40b59c
push str.W32_Bagle.Az.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov edx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push edx
call edi
lea eax, [esp + 0x10]
push eax
push str.TimeKey
push str.SoftwareMicrosoftParams
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40b603
push str.TimeKey
push str.SoftwareMicrosoftParams
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40b603
mov eax, dword [0x415e54]
test eax, eax
je 0x40b603
push str.W32_Bagle.Av.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov ecx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.wingo
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40b71c
lea eax, [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
push str.sysdir
push ecx
call ebx
add esp, 0xc
test eax, eax
jne 0x40b66f
lea edx, [esp + 0x10]
push str.system
push edx
call ebx
add esp, 8
test eax, eax
je 0x40b71c
lea eax, [esp + 0x10]
push str.wingo.exe
push eax
call ebx
add esp, 8
test eax, eax
je 0x40b71c
push str.wingo
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40b6b6
mov eax, dword [0x415e54]
test eax, eax
je 0x40b6b6
push str.W32_Bagle.At.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov ecx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.TimeKey
push str.SoftwareMicrosoftParams
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40b71c
push str.TimeKey
push str.SoftwareMicrosoftParams
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40b71c
mov eax, dword [0x415e54]
test eax, eax
je 0x40b71c
push str.W32_Bagle.At.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov eax, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
push str.bawindo
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40b835
lea edx, [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x14]
push str.sysdir
push eax
call ebx
add esp, 0xc
test eax, eax
jne 0x40b788
lea ecx, [esp + 0x10]
push str.system
push ecx
call ebx
add esp, 8
test eax, eax
je 0x40b835
lea edx, [esp + 0x10]
push str.bawindo.exe
push edx
call ebx
add esp, 8
test eax, eax
je 0x40b835
push str.bawindo
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40b7ce
mov eax, dword [0x415e54]
test eax, eax
je 0x40b7ce
push str.W32_Bagle.Av.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov eax, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
push str.TimeKey
push str.SoftwareMicrosoftParams
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40b835
push str.TimeKey
push str.SoftwareMicrosoftParams
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40b835
mov eax, dword [0x415e54]
test eax, eax
je 0x40b835
push str.W32_Bagle.Av.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov edx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push edx
call edi
lea eax, [esp + 0x10]
push eax
push str.sysformat
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40b9b5
lea ecx, [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push str.sysdir
push edx
call ebx
add esp, 0xc
test eax, eax
jne 0x40b8a1
lea eax, [esp + 0x10]
push str.system
push eax
call ebx
add esp, 8
test eax, eax
je 0x40b9b5
lea ecx, [esp + 0x10]
push str.sysformat.exe
push ecx
call ebx
add esp, 8
test eax, eax
je 0x40b9b5
push str.sysformat
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40b8e8
mov eax, dword [0x415e54]
test eax, eax
je 0x40b8e8
push str.W32_Bagle.Ax.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov edx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push edx
call edi
lea eax, [esp + 0x10]
push eax
push str.TimeKey
push str.SoftwareMicrosoftParams
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40b94f
push str.TimeKey
push str.SoftwareMicrosoftParams
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40b94f
mov eax, dword [0x415e54]
test eax, eax
je 0x40b94f
push str.W32_Bagle.Ax.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov ecx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.riga
push str.SoftwareMicrosoftParams
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40b9b5
push str.riga
push str.SoftwareMicrosoftParams
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40b9b5
mov eax, dword [0x415e54]
test eax, eax
je 0x40b9b5
push str.W32_Bagle.Ay.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov eax, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
push str.Syskey
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40ba5f
lea edx, [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x14]
push str.sysdir
push eax
call ebx
add esp, 0xc
test eax, eax
jne 0x40ba19
lea ecx, [esp + 0x10]
push str.system
push ecx
call ebx
add esp, 8
test eax, eax
je 0x40ba5f
lea edx, [esp + 0x10]
push str.sysinit.exe
push edx
call ebx
add esp, 8
test eax, eax
je 0x40ba5f
push str.Syskey
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40ba5f
mov eax, dword [0x415e54]
test eax, eax
je 0x40ba5f
push str.W32_Bagle.Aw.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov eax, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
push str.winshost.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40bb09
lea edx, [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x14]
push str.sysdir
push eax
call ebx
add esp, 0xc
test eax, eax
jne 0x40bac3
lea ecx, [esp + 0x10]
push str.system
push ecx
call ebx
add esp, 8
test eax, eax
je 0x40bb09
lea edx, [esp + 0x10]
push str.winshost.exe
push edx
call ebx
add esp, 8
test eax, eax
je 0x40bb09
push str.winshost.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40bb09
mov eax, dword [0x415e54]
test eax, eax
je 0x40bb09
push str.W32_Bagle.Be.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov eax, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
push str.winshost.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40bbb3
lea edx, [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x14]
push str.sysdir
push eax
call ebx
add esp, 0xc
test eax, eax
jne 0x40bb6d
lea ecx, [esp + 0x10]
push str.system
push ecx
call ebx
add esp, 8
test eax, eax
je 0x40bbb3
lea edx, [esp + 0x10]
push str.winshost.exe
push edx
call ebx
add esp, 8
test eax, eax
je 0x40bbb3
push str.winshost.exe
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40bbb3
mov eax, dword [0x415e54]
test eax, eax
je 0x40bbb3
push str.W32_Bagle.Be.Worm
push str.System_Registry______s_removed
push 0x416190
call esi
mov eax, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push eax
call edi
mov al, byte [0x4181ec]
pop edi
pop esi
pop ebp
test al, al
pop ebx
je 0x40bbe1
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.0040d700
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.0040d700
add esp, 0x10
mov eax, 1
add esp, 0x3e8
ret