Function at 0x4104f0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff6ec
push ebx
push esi
push edi
mov ebx, str.Scripting.FileSystemObject
cmp byte [0x46a886], 0
jne 0x410694
lea eax, [ebp - 0x914]
push eax
lea edx, [ebp - 0x814]
push edx
lea ecx, [ebp - 0x814]
push ecx
lea eax, [ebp - 0x814]
push eax
mov edx, dword [0x46a89c]
push edx
call fcn.0042de18
add esp, 0x14
push 0x44a67f
lea ecx, [ebp - 0x914]
push ecx
call fcn.0042bf74
add esp, 8
test eax, eax
je 0x410694
push 0x44a684
lea eax, [ebp - 0x914]
push eax
call fcn.0042bf74
add esp, 8
test eax, eax
je 0x410694
push 0x44a688
lea edx, [ebp - 0x914]
push edx
call fcn.0042bf74
add esp, 8
test eax, eax
je 0x410694
push 0x44a68d
lea ecx, [ebp - 0x914]
push ecx
call fcn.0042bf74
add esp, 8
test eax, eax
je 0x410694
push 0x44a693
lea eax, [ebp - 0x914]
push eax
call fcn.0042bf74
add esp, 8
test eax, eax
je 0x410694
push 0x44a698
lea edx, [ebp - 0x914]
push edx
call fcn.0042bf74
add esp, 8
test eax, eax
je 0x410694
push 0x44a69d
lea ecx, [ebp - 0x914]
push ecx
call fcn.0042bf74
add esp, 8
test eax, eax
je 0x410694
push 0x44a6a2
lea eax, [ebp - 0x914]
push eax
call fcn.0042bf74
add esp, 8
test eax, eax
je 0x410694
push str..reg
lea edx, [ebp - 0x914]
push edx
call fcn.0042bf74
add esp, 8
test eax, eax
je 0x410694
push str..pif
lea ecx, [ebp - 0x914]
push ecx
call fcn.0042bf74
add esp, 8
test eax, eax
je 0x410694
push str..asp
lea eax, [ebp - 0x914]
push eax
call fcn.0042bf74
add esp, 8
test eax, eax
je 0x410694
push str..vbe
lea edx, [ebp - 0x914]
push edx
call fcn.0042bf74
add esp, 8
test eax, eax
je 0x410694
push str..jse
lea ecx, [ebp - 0x914]
push ecx
call fcn.0042bf74
add esp, 8
test eax, eax
je 0x410694
xor eax, eax
jmp 0x411402
push 2
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.0042e350
add esp, 0xc
test eax, eax
jge 0x4106af
xor eax, eax
jmp 0x411402
mov edx, dword [ebp + 8]
push edx
call fcn.0042e3c4
pop ecx
mov dword [ebp - 8], eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042e350
add esp, 0xc
cmp dword [ebp - 8], 0x2710
jg 0x4106ff
push 0x2710
call fcn.0042b7bc
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 8]
push edx
push 1
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042e2b0
mov byte [ebp - 0xe], 1
add esp, 0x10
jmp 0x41075f
mov dword [ebp - 8], 0x2000
push 0x2000
call fcn.0042b7bc
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0x1000
push 1
mov edx, dword [ebp - 4]
push edx
call fcn.0042e2b0
add esp, 0x10
push 2
push 0xfffff000
mov ecx, dword [ebp + 8]
push ecx
call fcn.0042e350
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 0x1000
push 1
mov edx, dword [ebp - 4]
add edx, 0x1000
push edx
call fcn.0042e2b0
add esp, 0x10
mov byte [ebp - 0xe], 0
push ebx
call fcn.0042bda0
pop ecx
mov edi, eax
mov byte [ebp - 0xd], 0
xor esi, esi
jmp 0x41078b
push edi
mov eax, dword [ebp - 4]
add eax, esi
push eax
push ebx
call fcn.0042bf2c
add esp, 0xc
test eax, eax
jne 0x41078a
mov byte [ebp - 0xd], 1
jmp 0x410794
inc esi
mov edx, dword [ebp - 8]
sub edx, edi
cmp esi, edx
jl 0x410770
cmp byte [ebp - 0xd], 0
je 0x4113dc
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], 0x447730
jmp 0x411333
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
push edx
call fcn.0042bda0
pop ecx
mov edi, eax
xor esi, esi
mov eax, dword [ebp - 0x14]
mov ebx, eax
jmp 0x41131f
push edi
mov eax, dword [ebp - 4]
add eax, esi
push eax
mov edx, dword [ebx]
push edx
call fcn.0042bf2c
add esp, 0xc
test eax, eax
jne 0x41131e
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042b7cc
pop ecx
push 0
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebx - 4]
push edx
call fcn.00401410
add esp, 0xc
dec eax
je 0x410809
xor eax, eax
jmp 0x411402
mov edx, dword [ebx - 4]
cmp edx, 0x92f
jg 0x410920
je 0x410edf
cmp edx, 0x91c
jg 0x4108c2
je 0x410c6f
cmp edx, 0x914
jg 0x410890
je 0x410bcb
cmp edx, 0x6a
jg 0x410872
je 0x410b7f
sub edx, 0x2f
je 0x410ad6
sub edx, 8
je 0x410b14
sub edx, 0x10
je 0x410b47
sub edx, 0x22
je 0x410b63
jmp case.0x41092f.2357
sub edx, 0x6b
je 0x410b8f
sub edx, 3
je 0x410b9f
dec edx
je 0x410bbb
jmp case.0x41092f.2357
add edx, 0xfffff6eb
cmp edx, 6
ja case.0x41092f.2357
jmp dword [edx*4 + 0x4108a6]
add edx, 0xfffff6e3
cmp edx, 0x11
ja case.0x41092f.2357
jmp dword [edx*4 + 0x4108d8]
add edx, 0xfffff6cf
cmp edx, 0x67
ja case.0x41092f.2357
jmp dword [edx*4 + 0x410936]
push 0x44a6ef
push 0x44a6c0
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.cAg0u
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.kak.hta
call fcn.00418540
pop ecx
jmp case.0x41092f.2357
push str.MSKernel32
push 0x44a733
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x44a7a4
push 0x44a76d
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.cDays
push 0x44a7ad
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push 0x44a811
push 0x44a7e2
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push 0x44a81b
call fcn.00418540
pop ecx
jmp case.0x41092f.2357
push 0x44a827
call fcn.00418540
pop ecx
jmp case.0x41092f.2357
push str.WinStart
push 0x44a833
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push 0x44a86b
call fcn.00418540
pop ecx
jmp case.0x41092f.2357
push str.BulbaSaur
push 0x44a877
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.System.vbs
call fcn.00418540
pop ecx
jmp case.0x41092f.2357
push 0x44a8bb
call fcn.00418540
pop ecx
jmp case.0x41092f.2357
push 0x44a8c7
call fcn.00418540
pop ecx
jmp case.0x41092f.2357
push str.c:windowswinstart.bat
call fcn.0042f6c8
pop ecx
jmp case.0x41092f.2357
push str.TEMP.HTA
call fcn.00418540
pop ecx
jmp case.0x41092f.2357
push str.Win98Run
push 0x44a8f4
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.Dumbass
push 0x44a92c
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push 0x44a992
push 0x44a963
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x44a9cc
push 0x44a99d
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x44aa03
push 0x44a9d4
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.Cmos
push 0x44aa0c
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.Lamerz
push 0x44aa40
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push 0x44aaa5
push 0x44aa76
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.SysBoot
push 0x44aaad
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push 0x44ab13
push 0x44aae4
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.SysBoot.dll
push 0x44ab18
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.Blue_Star
push 0x44ab53
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.Yellow.vbs
push 0x44ab8c
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.Prinz_Charles_Are_Die
push 0x44abc6
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push 0x44ac3a
push 0x44ac0b
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.Wordz1
push 0x44ac3e
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Wordz3
push 0x44ac74
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Wordz2
push 0x44acaa
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.UPDATE.HTA
call fcn.00418540
pop ecx
jmp case.0x41092f.2357
push str.WinStartup
push 0x44acf3
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.ResourceMonitor
push 0x44ad2d
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.Startup.vbs
call fcn.00418540
pop ecx
jmp case.0x41092f.2357
push str.EVIL.hta
call fcn.00418540
pop ecx
push str.SysFile
push 0x44ad81
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.OsDll16
push 0x44adb8
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x44ae26
push 0x44adef
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.FUKME
push str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.SearchMSN
push 0x44ae6b
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x44aed3
push 0x44aea4
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.COOL_NOTEPAD_DEMO
push 0x44aedc
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.Delire
push 0x44af1d
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.Dome
push 0x44af53
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push 0x44af87
call fcn.00418540
pop ecx
jmp case.0x41092f.2357
push str.DBZ.vbs
call fcn.00418540
pop ecx
jmp case.0x41092f.2357
push str.GhostDog
push 0x44af9c
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push 0x44b003
push 0x44afd4
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push 0x44b00b
call fcn.00418540
pop ecx
jmp case.0x41092f.2357
push str.SoundDriver32
push 0x44b019
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.R.A.F
push 0x44b05e
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.burtai
push 0x44b093
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push 0x44b0f8
push 0x44b0c9
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push 0x44b13a
push 0x44b103
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.WinLoad
push 0x44b143
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.SysHelp
push 0x44b182
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.SATANIKCHILD
push 0x44b1b9
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.MSKernel23
push 0x44b1fd
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Win32DLL
push 0x44b237
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push 0x44b277
call fcn.00418540
pop ecx
jmp case.0x41092f.2357
push str.system.vbs
call fcn.00418540
pop ecx
jmp case.0x41092f.2357
push str.Monica
push 0x44b28a
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.Envy
push 0x44b2c0
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Anger
push 0x44b2f4
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Lust
push 0x44b329
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push 0x44b365
call fcn.00418540
pop ecx
jmp case.0x41092f.2357
push str.Hwinfo
push 0x44b36b
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.StarMania
push 0x44b3a1
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Issetup
push 0x44b3da
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.Systray
push 0x44b419
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push 0x44b487
push 0x44b450
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.MSNetLog
push 0x44b48b
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.MSrundll32
push 0x44b4c3
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Shut_Up
push 0x44b4fd
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.Shut_Up2
push 0x44b534
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.Msconfig
push 0x44b56c
push 0x80000002
call fcn.00417e0c
add esp, 0xc
push str.MSIEUPD32
push 0x44b5a4
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push 0x44b60c
push 0x44b5dd
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.Startup
push 0x44b610
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.antivbs
push 0x44b647
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.Del_Armg0
push 0x44b67e
push 0x80000002
call fcn.00417e0c
add esp, 0xc
jmp case.0x41092f.2357
push str.reg.hta
call fcn.00418540
pop ecx
push 0
mov ecx, dword [0x46a898]
push ecx
call fcn.00417790
add esp, 8
test eax, eax
je 0x411316
mov eax, dword [ebx - 4]
jmp 0x411402
or eax, 0xffffffff
jmp 0x411402
inc esi
mov edx, dword [ebp - 8]
sub edx, edi
cmp esi, edx
jl 0x4107c9
inc dword [ebp - 0xc]
add dword [ebp - 0x14], 8
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [0x447728]
jl 0x4107af
mov eax, dword [ebp - 4]
push eax
call fcn.0042b7cc
pop ecx
mov eax, dword [0x46a890]
mov edx, dword [0x46a894]
and edx, 4
and eax, 8
test eax, eax
je 0x411365
test edx, edx
je 0x41136c
xor eax, eax
jmp 0x411402
xor esi, esi
mov ebx, 0x447558
jmp 0x411393
mov eax, dword [ebx]
push eax
mov edx, dword [0x46a898]
push edx
call fcn.0042bf74
add esp, 8
test eax, eax
jne 0x41138f
xor eax, eax
jmp 0x411402
inc esi
add ebx, 4
cmp esi, dword [0x447554]
jl 0x411375
mov byte [0x46a87e], 1
push 0
mov edx, dword [ebp + 8]
push edx
push 0x2e
call fcn.00401410
add esp, 0xc
dec eax
je 0x4113b9
xor eax, eax
jmp 0x411402
push 0
mov edx, dword [0x46a898]
push edx
call fcn.00417790
add esp, 8
test eax, eax
je 0x4113d5
mov eax, 0x2e
jmp 0x411402
or eax, 0xffffffff
jmp 0x411402
mov dl, byte [ebp - 0xe]
push edx
mov ecx, dword [ebp - 4]
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0041140c
add esp, 0x10
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call fcn.0042b7cc
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret