Function at 0x45be90
Capabilities:
Contain obfuscated stackstrings
Delete registry key
Delete registry value
Get installed programs
Persist via run registry key
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4c8cd7
push eax
mov dword fs:[0], esp
sub esp, 0xf4
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x45c442
mov eax, dword [0x4f5b3c]
mov dword [esp + 0x44], eax
xor esi, esi
mov dword [esp + 0x48], eax
mov dword [esp + 0x10c], esi
mov dword [esp + 0x4c], eax
push 0xa
lea ecx, [esp + 0x54]
mov byte [esp + 0x110], 2
call fcn.004a7f83
mov dword [esp + 0x40], 0x4ca7ac
mov eax, dword [0x4f5b3c]
mov dword [esp + 0x10c], 3
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xe8]
xor edi, edi
cmp eax, esi
mov byte [esp + 0x10c], 4
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], esi
mov dword [esp + 0x3c], esi
jle 0x45c3d5
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
push ecx
lea ecx, [ebp + 0xe0]
call fcn.00407570
lea ecx, [esp + 0x44]
call fcn.0040cf60
lea edx, [esp + 0x20]
lea ecx, [esp + 0x40]
push edx
call fcn.00438810
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x110], 5
call fcn.004a9d0c
lea ecx, [esp + 0x20]
mov byte [esp + 0x10c], 4
call fcn.004a9c1f
mov eax, dword [0x4fef7c]
test eax, eax
je 0x45c064
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x4f15ec
call fcn.004a9c8d
lea eax, [esp + 0x20]
mov ecx, ebp
push eax
call fcn.0044e980
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x114], 6
call fcn.00474eb8
add esp, 8
test eax, eax
jne 0x45bfdc
mov edx, dword [0x4fef38]
lea ecx, [esp + 0x44]
push edx
call fcn.00438770
test eax, eax
setg al
test al, al
jne 0x45c049
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x4f168c
call fcn.004a9c8d
lea eax, [esp + 0x38]
mov ecx, ebp
push eax
call fcn.0044e980
mov eax, dword [eax]
mov ecx, dword [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x114], 7
call fcn.00474eb8
add esp, 8
test eax, eax
jne 0x45c032
mov edx, dword [0x4fef38]
lea ecx, [esp + 0x44]
push edx
call fcn.00438770
test eax, eax
setg al
test al, al
je 0x45c032
mov bl, 1
jmp 0x45c034
xor bl, bl
lea ecx, [esp + 0x34]
mov byte [esp + 0x10c], 6
call fcn.004a9c1f
test bl, bl
je 0x45c04b
mov bl, 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x10c], 4
call fcn.004a9c1f
test bl, bl
jne 0x45c23e
lea eax, [esp + 0x40]
lea ecx, [esp + 0x44]
neg eax
sbb eax, eax
and eax, ecx
mov eax, dword [eax]
push eax
call fcn.00418bd0
add esp, 4
test eax, eax
je 0x45c0a5
mov eax, dword [esp + 0x70]
test eax, eax
jne 0x45c0a5
push 0x80000001
mov ecx, ebp
call fcn.0045be30
test eax, eax
je 0x45c3d5
mov dword [esp + 0x70], 1
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x4f0c78
call fcn.004a9c8d
lea edx, [esp + 0x1c]
mov ecx, ebp
push edx
call fcn.0044e980
mov eax, dword [eax]
mov byte [esp + 0x10c], 0x11
push eax
mov eax, dword [esp + 0x18]
push eax
call fcn.00474eb8
add esp, 8
test eax, eax
jne 0x45c12d
push str.KEY:_query
lea ecx, [esp + 0x48]
call fcn.00438770
test eax, eax
jl 0x45c107
push str.zch_VALUE
lea ecx, [esp + 0x48]
call fcn.00438770
test eax, eax
setg al
test al, al
je 0x45c12d
lea eax, [esp + 0x40]
lea ecx, [esp + 0x44]
neg eax
sbb eax, eax
and eax, ecx
mov eax, dword [eax]
push eax
call fcn.00418bd0
add esp, 4
test eax, eax
sete al
test al, al
je 0x45c12d
mov bl, 1
jmp 0x45c12f
xor bl, bl
lea ecx, [esp + 0x18]
mov byte [esp + 0x10c], 4
call fcn.004a9c1f
test bl, bl
je 0x45c226
mov eax, dword [esp + 0x6c]
test eax, eax
jne 0x45c16c
push 0x80000002
mov ecx, ebp
call fcn.0045be30
test eax, eax
je 0x45c3d5
mov dword [esp + 0x6c], 1
test edi, edi
jne 0x45c226
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
lea ecx, [esp + 0x48]
call fcn.00438770
test eax, eax
jle 0x45c226
lea edx, [esp + 0x38]
lea eax, [esp + 0x10]
push edx
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x45c3d5
mov edi, str.bbbbbbbb
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x88]
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 8
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x8c]
push ecx
push 1
push 0
push str.AAAAAAAA
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x45c3c6
mov eax, dword [esp + 0x10]
push str.AAAAAAAA
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x3c]
mov edi, 1
mov eax, dword [ebp + 0xe8]
inc esi
cmp esi, eax
mov dword [esp + 0x3c], esi
jl 0x45bf2f
jmp 0x45c3d5
mov edx, dword [0x4f5b3c]
mov dword [esp + 0x10], edx
lea eax, [esp + 0x10]
push 1
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x4fef38
mov byte [esp + 0x11c], 8
call fcn.004a9994
lea ecx, [esp + 0x50]
call fcn.00436ed0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push edx
call fcn.004a9edc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x110], 9
call fcn.004a9d0c
lea ecx, [esp + 0x18]
mov byte [esp + 0x10c], 8
call fcn.004a9c1f
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push str._________
push ecx
call fcn.004a9edc
push eax
mov byte [esp + 0x110], 0xa
call fcn.0045db50
add esp, 4
lea ecx, [esp + 0x18]
mov byte [esp + 0x10c], 8
call fcn.004a9c1f
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push 1
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x45c34f
lea ecx, [esp + 0x10]
mov byte [esp + 0x10c], 4
call fcn.004a9c1f
lea ecx, [esp + 0x14]
mov byte [esp + 0x10c], 3
call fcn.004a9c1f
lea ecx, [esp + 0x50]
mov dword [esp + 0x10c], 0xd
call fcn.004a7ff7
lea ecx, [esp + 0x4c]
mov byte [esp + 0x10c], 0xc
call fcn.004a9c1f
mov byte [esp + 0x10c], 0xb
jmp 0x45c41b
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
mov byte [esp + 0x10c], 4
lea ecx, [esp + 0x10]
jne 0x45c3bf
call fcn.004a9c1f
lea ecx, [esp + 0x14]
mov byte [esp + 0x10c], 3
call fcn.004a9c1f
lea ecx, [esp + 0x50]
mov dword [esp + 0x10c], 0x10
call fcn.004a7ff7
lea ecx, [esp + 0x4c]
mov byte [esp + 0x10c], 0xf
call fcn.004a9c1f
mov byte [esp + 0x10c], 0xe
jmp 0x45c41b
call fcn.004a9c1f
jmp 0x45c3d5
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x3c]
cmp esi, dword [ebp + 0xe8]
jl 0x45c44c
lea ecx, [esp + 0x14]
mov byte [esp + 0x10c], 3
call fcn.004a9c1f
lea ecx, [esp + 0x50]
mov dword [esp + 0x10c], 0x14
call fcn.004a7ff7
lea ecx, [esp + 0x4c]
mov byte [esp + 0x10c], 0x13
call fcn.004a9c1f
mov byte [esp + 0x10c], 0x12
lea ecx, [esp + 0x48]
call fcn.004a9c1f
lea ecx, [esp + 0x40]
lea edx, [esp + 0x44]
neg ecx
sbb ecx, ecx
mov dword [esp + 0x10c], 0xffffffff
and ecx, edx
call fcn.004a9c1f
mov eax, 1
jmp 0x45c7ec
push 0
lea ecx, [esp + 0x98]
call fcn.00415cc0
push 3
push 0
push 0x8c7
lea ecx, [esp + 0xa0]
mov byte [esp + 0x118], 0x15
call fcn.004168e0
push 1
push 0
push 0x66
lea ecx, [esp + 0xa0]
call fcn.00416340
push str.pcinst.log
lea eax, [esp + 0x2c]
push 0x4ff328
push eax
call fcn.004a9e68
lea ecx, [esp + 0x74]
mov byte [esp + 0x10c], 0x16
call fcn.004af28a
mov ecx, dword [esp + 0x28]
push 0
push 0x1001
mov bl, 0x17
push ecx
lea ecx, [esp + 0x80]
mov byte [esp + 0x118], bl
call fcn.004af2ff
test eax, eax
jne 0x45c5a2
lea ecx, [esp + 0x74]
mov byte [esp + 0x10c], 0x16
call fcn.004af2bc
lea ecx, [esp + 0x28]
mov byte [esp + 0x10c], 0x15
call fcn.004a9c1f
lea ecx, [esp + 0x100]
mov byte [esp + 0x10c], 0x19
call fcn.004a9c1f
lea ecx, [esp + 0xfc]
mov byte [esp + 0x10c], 0x18
call fcn.004a9c1f
lea edx, [esp + 0xf0]
mov dword [esp + 0xf0], vtable.CGdiObject.0
mov dword [esp + 0x38], edx
lea ecx, [esp + 0xf0]
mov byte [esp + 0x10c], 0x1b
call fcn.004b1077
lea ecx, [esp + 0x94]
mov byte [esp + 0x10c], 4
call fcn.004ab31a
lea ecx, [esp + 0x14]
mov byte [esp + 0x10c], 3
call fcn.004a9c1f
lea ecx, [esp + 0x50]
mov dword [esp + 0x10c], 0x1e
call fcn.004a7ff7
lea ecx, [esp + 0x4c]
mov byte [esp + 0x10c], 0x1d
call fcn.004a9c1f
mov byte [esp + 0x10c], 0x1c
jmp 0x45c7c3
push 0x4ff348
lea ecx, [esp + 0x20]
push str.app
push ecx
call fcn.004a9edc
push 0x4eedbc
lea edx, [esp + 0x1c]
push eax
push edx
mov byte [esp + 0x118], 0x1f
call fcn.004a9e68
mov eax, dword [eax]
lea ecx, [esp + 0x74]
push eax
mov byte [esp + 0x110], 0x20
call fcn.004af472
lea ecx, [esp + 0x18]
mov byte [esp + 0x10c], 0x1f
call fcn.004a9c1f
lea ecx, [esp + 0x1c]
mov byte [esp + 0x10c], bl
call fcn.004a9c1f
mov eax, dword [0x4f5b3c]
mov dword [esp + 0x24], eax
push 0x66
lea ecx, [esp + 0x28]
push str._d_:
push ecx
mov byte [esp + 0x118], 0x21
call fcn.004a768f
mov edx, dword [0x4f5b3c]
add esp, 0xc
mov dword [esp + 0x30], edx
push 0x8c7
lea ecx, [esp + 0x34]
mov byte [esp + 0x110], 0x22
call fcn.004abac8
lea eax, [esp + 0x24]
lea ecx, [esp + 0x20]
push eax
push str.err
push ecx
call fcn.004a9edc
lea edx, [esp + 0x30]
mov byte [esp + 0x10c], 0x23
push edx
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.004a9e02
push 0x4eedbc
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x118], 0x24
call fcn.004a9e68
mov eax, dword [eax]
lea ecx, [esp + 0x74]
push eax
mov byte [esp + 0x110], 0x25
call fcn.004af472
lea ecx, [esp + 0x18]
mov byte [esp + 0x10c], 0x24
call fcn.004a9c1f
lea ecx, [esp + 0x34]
mov byte [esp + 0x10c], 0x23
call fcn.004a9c1f
lea ecx, [esp + 0x20]
mov byte [esp + 0x10c], 0x22
call fcn.004a9c1f
lea ecx, [esp + 0x74]
call fcn.004af62f
mov byte [esp + 0x10c], 0x21
lea ecx, [esp + 0x30]
call fcn.004a9c1f
lea ecx, [esp + 0x24]
mov byte [esp + 0x10c], bl
call fcn.004a9c1f
lea ecx, [esp + 0x74]
mov byte [esp + 0x10c], 0x16
call fcn.004af2bc
lea ecx, [esp + 0x28]
mov byte [esp + 0x10c], 0x15
call fcn.004a9c1f
lea ecx, [esp + 0x100]
mov byte [esp + 0x10c], 0x27
call fcn.004a9c1f
lea ecx, [esp + 0xfc]
mov byte [esp + 0x10c], 0x26
call fcn.004a9c1f
lea edx, [esp + 0xf0]
mov dword [esp + 0xf0], vtable.CGdiObject.0
mov dword [esp + 0x38], edx
lea ecx, [esp + 0xf0]
mov byte [esp + 0x10c], 0x29
call fcn.004b1077
lea ecx, [esp + 0x94]
mov byte [esp + 0x10c], 4
call fcn.004ab31a
lea ecx, [esp + 0x14]
mov byte [esp + 0x10c], 3
call fcn.004a9c1f
lea ecx, [esp + 0x50]
mov dword [esp + 0x10c], 0x2c
call fcn.004a7ff7
lea ecx, [esp + 0x4c]
mov byte [esp + 0x10c], 0x2b
call fcn.004a9c1f
mov byte [esp + 0x10c], 0x2a
lea ecx, [esp + 0x48]
call fcn.004a9c1f
lea ecx, [esp + 0x40]
lea eax, [esp + 0x44]
neg ecx
sbb ecx, ecx
mov dword [esp + 0x10c], 0xffffffff
and ecx, eax
call fcn.004a9c1f
xor eax, eax
mov ecx, dword [esp + 0x104]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x100
ret