Function at 0x4a383c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b0d00
mov eax, dword fs:[0]
push eax
sub esp, 0x548
mov eax, dword [0x4df06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004431cf
push 2
pop ecx
imul ecx, ecx, 0
movzx eax, word [eax + ecx + 0x1a8]
test eax, eax
je 0x4a39a4
push 0x4c179c
call fcn.004431bd
add eax, 4
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.004066b2
add esp, 0xc
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x534], eax
and dword [ebp - 4], 0
call fcn.004431bd
add eax, 0x54
push eax
push dword [ebp - 0x534]
lea eax, [ebp - 0xd0]
push eax
call fcn.00406790
add esp, 0xc
mov dword [ebp - 0x538], eax
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x53c], eax
mov byte [ebp - 4], 1
push 0x4c1798
push dword [ebp - 0x53c]
lea eax, [ebp - 0xb8]
push eax
call fcn.0040675d
add esp, 0xc
mov dword [ebp - 0x540], eax
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0x544], eax
mov byte [ebp - 4], 2
call fcn.004431cf
add eax, 0x1a8
push eax
push dword [ebp - 0x544]
lea eax, [ebp - 0x40]
push eax
call fcn.0040675d
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xb8]
call fcn.0040a301
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xd0]
call fcn.0040a301
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xe8]
call fcn.0040a301
push 0x4c17a0
lea ecx, [ebp - 0x28]
call fcn.004097aa
mov byte [ebp - 4], 7
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.004468fc
add esp, 0x14
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
call fcn.0040a301
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040a301
call fcn.004431cf
cmp dword [eax + 0x1a0], 0
je 0x4a3ab7
lea ecx, [ebp - 0x524]
call fcn.00408fc1
mov dword [ebp - 4], 8
push 0x4c17e8
call fcn.004431bd
add eax, 4
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.004066b2
add esp, 0xc
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x54c], eax
mov byte [ebp - 4], 9
push 0x4c17c4
push dword [ebp - 0x54c]
lea eax, [ebp - 0x100]
push eax
call fcn.0040675d
add esp, 0xc
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x554], eax
mov byte [ebp - 4], 0xa
push str.__RebootRunOnce
push dword [ebp - 0x554]
lea eax, [ebp - 0x524]
push eax
call fcn.00404457
pop ecx
pop ecx
push eax
call fcn.00408f55
pop ecx
pop ecx
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x100]
call fcn.0040a301
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x118]
call fcn.0040a301
lea ecx, [ebp - 0x524]
call fcn.0040a274
push eax
lea ecx, [ebp - 0x58]
call fcn.004097aa
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x58]
push eax
push 0x4c17ec
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov ecx, SysReAllocString
call fcn.00417c82
pop ecx
pop ecx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x58]
call fcn.0040a301
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x524]
call fcn.00408f9c
call fcn.004431c9
movzx eax, byte [eax + 1]
test eax, eax
je 0x4a3b7c
call fcn.0041a1af
cmp eax, 0xa
jl 0x4a3b7c
push 0x4c1864
lea ecx, [ebp - 0x70]
call fcn.004097aa
mov dword [ebp - 4], 0xc
lea eax, [ebp - 0x70]
push eax
call fcn.004431bd
add eax, 4
mov edx, eax
mov cl, 1
call fcn.0044b84a
pop ecx
movzx eax, al
test eax, eax
jne 0x4a3b13
mov dword [ebp - 0x52c], 1
jmp 0x4a3b1a
and dword [ebp - 0x52c], 0
mov al, byte [ebp - 0x52c]
mov byte [ebp - 0x525], al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.0040a301
movzx eax, byte [ebp - 0x525]
test eax, eax
je 0x4a3b7c
push 0x4c1888
lea ecx, [ebp - 0x88]
call fcn.004097aa
mov dword [ebp - 4], 0xd
lea eax, [ebp - 0x88]
push eax
call fcn.004431bd
add eax, 4
mov edx, eax
mov cl, 1
call fcn.0044be01
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.0040a301
call fcn.004431c9
movzx eax, byte [eax + 1]
test eax, eax
je 0x4a3bd2
call fcn.0041a1af
cmp eax, 0xd
jl 0x4a3bd2
push str.SogouExplorer.exe
lea ecx, [ebp - 0xa0]
call fcn.004097aa
mov dword [ebp - 4], 0xe
lea eax, [ebp - 0xa0]
push eax
call fcn.004431bd
add eax, 4
mov edx, eax
mov cl, 1
call fcn.0044be17
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.0040a301
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045e3e7
mov esp, ebp
pop ebp
ret