Function at 0x414a80
Capabilities:
Create process on windows
Hide graphical window
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x445c58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x938
mov eax, dword [esp + 0x948]
push esi
mov esi, ecx
test eax, eax
mov dword [esp + 0x28], esi
jne 0x414abb
mov ecx, dword [esi + 0xb4]
test ecx, ecx
je 0x415442
mov ecx, dword [0x456050]
push ebx
push ebp
push edi
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x95c]
mov dword [esp + 0x950], 0
test ecx, ecx
je 0x415276
mov ecx, dword [esi + 0xb4]
lea edx, [esp + 0x18]
push edx
call fcn.0041aae0
mov eax, dword [eax]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov byte [esp + 0x950], 1
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x414b6a
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0xb4]
call fcn.0041aab0
mov edx, dword [eax]
mov eax, dword [esp + 0x14]
mov edi, dword [edx - 8]
mov edx, dword [0x456054]
test edi, edi
lea ecx, [eax - 0xc]
sete bl
cmp ecx, edx
je 0x414b4e
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x414b4e
mov edx, dword [esp + 0x14]
lea eax, [edx - 0xc]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
test bl, bl
jne 0x414b6a
mov edi, dword [esp + 0x958]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
sete al
test al, al
je 0x414b6c
mov bl, 1
mov eax, dword [esp + 0x18]
mov edx, dword [0x456054]
mov byte [esp + 0x950], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x414b9f
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x414b9f
mov edx, dword [esp + 0x18]
lea eax, [edx - 0xc]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
test bl, bl
je 0x414bcb
mov eax, str.http:__cn.mail.yahoo.com
test eax, eax
je 0x414bb7
push str.http:__cn.mail.yahoo.com
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.http:__cn.mail.yahoo.com
push eax
lea ecx, [esp + 0x34]
call fcn.004066e0
jmp 0x415280
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x149]
mov byte [esp + 0x148], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x549]
mov byte [esp + 0x548], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esi + 0xb4]
stosb byte es:[edi], al
call fcn.0041aae0
mov edx, dword [eax]
mov ecx, dword [esi + 0xb4]
lea eax, [esp + 0x14]
mov byte [esp + 0x950], 2
mov edi, dword [edx - 8]
push eax
call fcn.0041aae0
mov eax, dword [eax]
lea ecx, [esp + 0x148]
push 0x400
push ecx
push edi
push eax
mov byte [esp + 0x960], 3
call fcn.00412950
mov eax, dword [esp + 0x24]
mov ecx, dword [0x456054]
add esp, 0x10
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x414c7a
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x414c7a
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x18]
mov edx, dword [0x456054]
mov byte [esp + 0x950], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x414cad
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x414cad
mov edx, dword [esp + 0x18]
lea eax, [edx - 0xc]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [esi + 0xb4]
lea eax, [esp + 0x18]
push eax
call fcn.0041aab0
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x954], 4
mov edi, dword [ecx - 8]
mov ecx, dword [esi + 0xb4]
call fcn.0041aab0
mov eax, dword [eax]
lea ecx, [esp + 0x548]
push 0x400
push ecx
push edi
push eax
mov byte [esp + 0x960], 5
call fcn.00412950
mov eax, dword [esp + 0x24]
mov ecx, dword [0x456054]
add esp, 0x10
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x414d26
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x414d26
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x18]
mov edx, dword [0x456054]
mov byte [esp + 0x950], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x414d59
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x414d59
mov edx, dword [esp + 0x18]
lea eax, [edx - 0xc]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [0x456050]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, str.http:__login.cn.yahoo.com_config_reset_cookies_.yY
mov dword [esp + 0x20], eax
test ecx, ecx
je 0x414dbd
mov edx, ecx
shr edx, 0x10
jne 0x414d89
xor eax, eax
mov ax, cx
lea ecx, [esp + 0x20]
push eax
call fcn.00404a40
jmp 0x414dbd
push str.http:__login.cn.yahoo.com_config_reset_cookies_.yY
call ebx
mov esi, eax
test esi, esi
je 0x414dbd
push esi
lea ecx, [esp + 0x24]
call fcn.004044c0
test eax, eax
je 0x414dbd
mov edi, dword [esp + 0x20]
mov ecx, esi
mov edx, ecx
mov esi, str.http:__login.cn.yahoo.com_config_reset_cookies_.yY
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x958]
mov eax, dword [0x456050]
test edi, edi
mov byte [esp + 0x950], 6
mov dword [esp + 0x10], eax
je 0x414e21
mov ecx, edi
shr ecx, 0x10
jne 0x414df4
and edi, 0xffff
lea ecx, [esp + 0x10]
mov eax, edi
push eax
call fcn.00404a40
jmp 0x414e21
push edi
call ebx
mov esi, eax
test esi, esi
je 0x414e21
push esi
lea ecx, [esp + 0x14]
call fcn.004044c0
test eax, eax
je 0x414e21
mov ecx, esi
mov esi, edi
mov edi, dword [esp + 0x10]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebp, dword [sym.imp.MSVCRT.dll__mbsstr]
mov eax, 0x4578b8
test eax, eax
mov byte [esp + 0x950], 7
je 0x414fd6
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
call esi
mov ebx, eax
test ebx, ebx
je 0x414fd6
mov ecx, 0x4578b4
test ecx, ecx
jne 0x414e5e
mov dword [esp + 0x24], ecx
jmp 0x414e69
push 0x4578b4
call esi
mov dword [esp + 0x24], eax
mov esi, dword [esp + 0x10]
xor edi, edi
mov eax, dword [esi - 8]
add eax, esi
cmp esi, eax
mov dword [esp + 0x14], eax
jae 0x414fd6
push 0x4578b8
push esi
call ebp
add esp, 8
test eax, eax
je 0x414ea2
lea esi, [eax + ebx]
push 0x4578b8
push esi
inc edi
call ebp
add esp, 8
test eax, eax
jne 0x414e8f
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
mov eax, dword [esp + 0x14]
cmp esi, eax
jb 0x414e80
test edi, edi
jle 0x414fd6
lea ecx, [esp + 0x10]
call fcn.00404590
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x10]
sub ebp, ebx
imul ebp, edi
mov eax, dword [esi - 8]
mov dword [esp + 0x18], eax
add ebp, eax
mov eax, dword [esi - 4]
mov dword [esp + 0x1c], ebp
cmp eax, ebp
jl 0x414eed
cmp dword [esi - 0xc], 1
jle 0x414f29
lea edx, [esi - 0xc]
push ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], edx
call fcn.004044c0
test eax, eax
je 0x414fd6
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
push eax
mov ecx, dword [eax + 4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00404560
mov esi, dword [esp + 0x10]
mov eax, dword [esi - 8]
add eax, esi
cmp esi, eax
mov dword [esp + 0x14], eax
jae 0x414fd3
push 0x4578b8
push esi
call dword [sym.imp.MSVCRT.dll__mbsstr]
mov edi, eax
add esp, 8
test edi, edi
je 0x414fb8
mov ebp, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x24]
sub ebp, edi
sub ebp, ebx
lea ecx, [edi + ebx]
add ebp, edx
lea eax, [edi + esi]
push ebp
push ecx
push eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.MSVCRT.dll_memmove]
mov ecx, esi
mov esi, 0x4578b4
mov edx, ecx
push 0x4578b8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, edx
and ecx, 3
sub eax, ebx
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x40]
push esi
mov byte [esi + ebp], 0
mov ebp, dword [esp + 0x2c]
add ebp, eax
mov dword [esp + 0x2c], ebp
call dword [sym.imp.MSVCRT.dll__mbsstr]
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x414f4f
mov ebp, dword [esp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
mov eax, dword [esp + 0x14]
cmp esi, eax
jb 0x414f3a
mov esi, dword [esp + 0x10]
mov dword [esi - 8], ebp
mov ecx, 0x4578b0
test ecx, ecx
je 0x415183
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ecx
call esi
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x415183
mov edx, 0x4578ac
test edx, edx
jne 0x415007
mov dword [esp + 0x24], edi
jmp 0x415012
push 0x4578ac
call esi
mov dword [esp + 0x24], eax
mov esi, dword [esp + 0x10]
mov eax, dword [esi - 8]
add eax, esi
cmp esi, eax
mov dword [esp + 0x18], eax
jae 0x415183
mov ebp, dword [sym.imp.MSVCRT.dll__mbsstr]
push 0x4578b0
push esi
call ebp
add esp, 8
test eax, eax
je 0x41504f
lea esi, [eax + ebx]
push 0x4578b0
push esi
inc edi
call ebp
add esp, 8
test eax, eax
jne 0x41503c
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
mov eax, dword [esp + 0x18]
cmp esi, eax
jb 0x41502d
test edi, edi
jle 0x415183
lea ecx, [esp + 0x10]
call fcn.00404590
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x10]
sub ebp, ebx
imul ebp, edi
mov eax, dword [esi - 8]
mov dword [esp + 0x14], eax
add ebp, eax
mov eax, dword [esi - 4]
mov dword [esp + 0x30], ebp
cmp eax, ebp
jl 0x41509a
cmp dword [esi - 0xc], 1
jle 0x4150d6
lea eax, [esi - 0xc]
push ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], eax
call fcn.004044c0
test eax, eax
je 0x415183
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
push eax
mov ecx, dword [eax + 4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00404560
mov esi, dword [esp + 0x10]
mov eax, dword [esi - 8]
add eax, esi
cmp esi, eax
mov dword [esp + 0x18], eax
jae 0x415180
push 0x4578b0
push esi
call dword [sym.imp.MSVCRT.dll__mbsstr]
mov edi, eax
add esp, 8
test edi, edi
je 0x415165
mov ebp, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x24]
sub ebp, edi
sub ebp, ebx
lea ecx, [edi + ebx]
add ebp, edx
lea eax, [edi + esi]
push ebp
push ecx
push eax
mov dword [esp + 0x28], eax
call dword [sym.imp.MSVCRT.dll_memmove]
mov ecx, esi
mov esi, 0x4578ac
mov edx, ecx
push 0x4578b0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, edx
and ecx, 3
sub eax, ebx
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x2c]
push esi
mov byte [esi + ebp], 0
mov ebp, dword [esp + 0x28]
add ebp, eax
mov dword [esp + 0x28], ebp
call dword [sym.imp.MSVCRT.dll__mbsstr]
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x4150fc
mov ebp, dword [esp + 0x30]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
mov eax, dword [esp + 0x18]
cmp esi, eax
jb 0x4150e7
mov esi, dword [esp + 0x10]
mov dword [esi - 8], ebp
push 0x4578a8
push 0x456c20
lea ecx, [esp + 0x18]
call fcn.00417900
lea ecx, [esp + 0x148]
test ecx, ecx
jne 0x4151ab
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
xor eax, eax
jmp 0x4151bb
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x148]
push edx
call esi
lea ecx, [esp + 0x148]
push ecx
push eax
lea ecx, [esp + 0x28]
call fcn.004047d0
mov edx, str..tT
test edx, edx
jne 0x4151da
xor eax, eax
jmp 0x4151e1
push str..tT
call esi
push str..tT
push eax
lea ecx, [esp + 0x28]
call fcn.004047d0
lea eax, [esp + 0x548]
test eax, eax
je 0x415205
lea ecx, [esp + 0x548]
push ecx
call esi
lea edx, [esp + 0x548]
lea ecx, [esp + 0x20]
push edx
push eax
call fcn.004047d0
mov eax, str..ver2.done
test eax, eax
je 0x415227
push str..ver2.done
call esi
push str..ver2.done
push eax
lea ecx, [esp + 0x28]
call fcn.004047d0
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x24]
call fcn.00417810
lea edx, [esp + 0x20]
lea ecx, [esp + 0x2c]
push edx
call fcn.004143c0
lea ecx, [esp + 0x10]
mov byte [esp + 0x950], 6
call fcn.004046d0
lea ecx, [esp + 0x20]
mov byte [esp + 0x950], 0
call fcn.004046d0
jmp 0x415280
push eax
lea ecx, [esp + 0x30]
call fcn.00404700
mov eax, dword [esp + 0x960]
mov esi, dword [sym.imp.USER32.dll_IsWindow]
push eax
mov dword [esp + 0x2c], eax
call esi
test eax, eax
je 0x4152ef
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], 1
mov dword [esp + 0x40], eax
push 0
mov eax, dword [eax - 8]
push str.IEBANDOBJNOTIFYWND
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x30]
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
push eax
mov dword [esp + 0x20], eax
call esi
test eax, eax
je 0x41542b
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x20]
mov eax, dword [edx + 4]
push eax
push 0x4a
call fcn.00417330
jmp 0x41542b
lea ecx, [esp + 0x1c]
push ecx
call fcn.004140f0
mov eax, dword [eax]
add esp, 4
mov dword [esp + 0x28], eax
push eax
call esi
test eax, eax
je 0x4153b7
mov edx, dword [esp + 0x28]
push 0xfffffffffffffff0
push edx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, 0x20000000
je 0x415330
mov eax, dword [esp + 0x28]
push 9
push eax
call edi
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea ecx, [esp + 0x40]
call fcn.00417350
push 0x43
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
lea ecx, [esp + 0x40]
call fcn.00417350
mov ecx, dword [esp + 0x28]
push 8
push ecx
call edi
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push 0
mov dword [esp + 0x3c], 1
mov dword [esp + 0x44], eax
mov eax, dword [eax - 8]
push str.IEBANDOBJNOTIFYWND
push 0
push edx
mov dword [esp + 0x4c], eax
call dword [sym.imp.USER32.dll_FindWindowExA]
push eax
mov dword [esp + 0x20], eax
call esi
test eax, eax
je 0x41542b
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x38]
push eax
mov edx, dword [ecx + 4]
lea ecx, [esp + 0x20]
push edx
push 0x4a
call fcn.00417330
jmp 0x41542b
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x45]
mov byte [esp + 0x44], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x44]
lea edx, [esp + 0x30]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x44]
push eax
push ecx
push edx
push 0x45db14
push str.CLSID0002DF01_0000_0000_C000_000000000046LocalServer32
push SysReAllocStringLen
mov dword [esp + 0x48], 1
mov dword [esp + 0x34], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x41542b
push 3
push eax
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x4c]
push eax
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x950], 0xffffffff
call fcn.004046d0
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x93c]
pop esi
mov dword fs:[0], ecx
add esp, 0x944
ret 0xc