Function at 0x4096e0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541fb8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x594ca8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x5704e4
lea ecx, [ebp - 0x18]
call fcn.004040f0
push 0x33
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
call fcn.004046e0
push 1
push 0x57058c
lea ecx, [ebp - 0x18]
call fcn.00404340
push 0xe
push str.1905Client.exe
lea ecx, [ebp - 0x18]
call fcn.00404340
mov eax, dword [ebp + 8]
push 0x57058c
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.00404260
add esp, 0xc
push str.1905Client.exe
push eax
lea edx, [ebp - 0x28]
push edx
mov byte [ebp - 4], 1
call fcn.00404260
add esp, 0xc
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40979a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
lea edx, [ebp - 0x28]
mov dword [ebp - 0x20], esp
mov ecx, esp
push edx
call fcn.00404900
lea eax, [ebp - 0x2c]
push eax
call fcn.00402e00
add esp, 8
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x4097ff
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x4097ff
lea edi, [eax + eax]
mov eax, edi
call fcn.0051b8f0
mov esi, esp
test esi, esi
je 0x4097ff
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 3
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x409801
xor eax, eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push 4
push 0
push 0
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x409bbf
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x28]
test ebx, ebx
jne 0x40983c
xor edi, edi
jmp 0x409867
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x40984f
xor edi, edi
jmp 0x409867
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x409899
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409883
xor eax, eax
jmp 0x409899
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x28]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4098dd
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.ClientPath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4098dd
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
jne 0x4098e8
xor edi, edi
jmp 0x409913
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x4098fb
xor edi, edi
jmp 0x409913
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x409945
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x40992f
xor eax, eax
jmp 0x409945
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x2c]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409989
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.ClientVersion
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x409989
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
push 0x57058c
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.00404260
add esp, 0xc
push str.1905Tray.exe
push eax
lea edx, [ebp - 0x24]
push edx
mov byte [ebp - 4], 5
call fcn.00404260
add esp, 0xc
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4099d7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp - 0x24]
test ebx, ebx
jne 0x4099e2
xor edi, edi
jmp 0x409a0d
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x4099f5
xor edi, edi
jmp 0x409a0d
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x409a3f
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409a29
xor eax, eax
jmp 0x409a3f
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x24]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409a83
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.TrayPath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x409a83
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
push 0x57058c
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00404260
add esp, 0xc
push str.1905Daemon.exe
push eax
lea edx, [ebp - 0x1c]
push edx
mov byte [ebp - 4], 8
call fcn.00404260
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409ad1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
jne 0x409adc
xor edi, edi
jmp 0x409b07
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409aef
xor edi, edi
jmp 0x409b07
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x409b39
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409b23
xor eax, eax
jmp 0x409b39
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409b7d
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.DaemonPath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x409b7d
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409b9c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409bbf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x33
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0x18]
call fcn.004046e0
push 1
push 0x57058c
lea ecx, [ebp - 0x18]
call fcn.00404340
push 6
push 0x570c9c
lea ecx, [ebp - 0x18]
call fcn.00404340
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x409c32
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x409c32
lea edi, [eax + eax]
mov eax, edi
call fcn.0051b8f0
mov esi, esp
test esi, esi
je 0x409c32
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 3
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x409c34
xor eax, eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0
push 4
push 0
push 0
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40a189
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x28]
test ebx, ebx
jne 0x409c6f
xor edi, edi
jmp 0x409c9a
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409c82
xor edi, edi
jmp 0x409c9a
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x409ccc
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409cb6
xor eax, eax
jmp 0x409ccc
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x28]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409d10
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.DisplayIcon
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x409d10
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x1c]
push str._1234
push ecx
call fcn.0040f5d0
add esp, 0xc
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x20]
push 0x570c9c
push eax
mov byte [ebp - 4], 9
call fcn.0040f5d0
add esp, 0xc
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xa
call fcn.00404790
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409d6e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
jne 0x409d79
xor edi, edi
jmp 0x409da4
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409d8c
xor edi, edi
jmp 0x409da4
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x409dd6
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409dc0
xor eax, eax
jmp 0x409dd6
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409e1a
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.DisplayName
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x409e1a
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
jne 0x409e25
xor edi, edi
jmp 0x409e50
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409e38
xor edi, edi
jmp 0x409e50
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x409e82
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409e6c
xor eax, eax
jmp 0x409e82
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x2c]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409ec6
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.DisplayVersion
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x409ec6
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 7
push 0x570fd0
lea ecx, [ebp - 0x1c]
call fcn.004046e0
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
jne 0x409ee0
xor edi, edi
jmp 0x409f0b
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409ef3
xor edi, edi
jmp 0x409f0b
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x409f3d
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409f27
xor eax, eax
jmp 0x409f3d
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409f81
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.Publisher
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x409f81
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
push 0x57058c
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00404260
add esp, 0xc
push 0x570ed0
push eax
lea edx, [ebp - 0x20]
mov bl, 0xb
push edx
mov byte [ebp - 4], bl
call fcn.00404260
add esp, 0xc
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xc
call fcn.00404790
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409fdc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409fff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
jne 0x40a00a
xor edi, edi
jmp 0x40a035
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x40a01d
xor edi, edi
jmp 0x40a035
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x40a067
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x40a051
xor eax, eax
jmp 0x40a067
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a0ab
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.UninstallString
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40a0ab
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xc
push str.www.1905.com
lea ecx, [ebp - 0x1c]
call fcn.004046e0
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
jne 0x40a0c5
xor edi, edi
jmp 0x40a0f0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x40a0d8
xor edi, edi
jmp 0x40a0f0
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x40a122
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x40a10c
xor eax, eax
jmp 0x40a122
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a166
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.URLInfoAbout
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40a166
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a189
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebp + 0xc], 0
je 0x40a2bf
mov ecx, dword [ebp + 8]
push 0x57058c
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.00404260
add esp, 0xc
push str.1905Tray.exe
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 0xd
call fcn.00404260
add esp, 0xc
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a1e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x2d
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x18]
call fcn.004046e0
mov ebx, dword [ebp - 0x24]
test ebx, ebx
jne 0x40a1fb
xor edi, edi
jmp 0x40a226
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x40a20e
xor edi, edi
jmp 0x40a226
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x40a258
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x40a242
xor eax, eax
jmp 0x40a258
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b8f0
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x24]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a29c
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.1905Client
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40a29c
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a2bf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a2e2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a305
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a32b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esp, [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005155a4
mov esp, ebp
pop ebp
ret