Function at 0x438eb0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x440b0b
push eax
mov eax, 0x182c
mov dword fs:[0], esp
call fcn.00439c20
push edi
lea ecx, [esp + 4]
call sub.MFC42u.DLL_CString::CString_4
mov ax, word [0x44ffe8]
mov ecx, 0x103
mov word [esp + 0x420], ax
xor eax, eax
lea edi, [esp + 0x422]
lea edx, [esp + 0x420]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x104
xor eax, eax
lea edi, [esp + 0x420]
mov dword [esp + 8], 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
lea eax, [esp + 8]
push ecx
push edx
push eax
push str.360Safetray
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x43911f
mov cx, word [0x44ffe8]
lea edi, [esp + 0x12]
mov word [esp + 0x10], cx
mov ecx, 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x104
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, 0x22
cmp word [esp + 0x420], ax
jne 0x43902d
lea edx, [esp + 0x12]
mov word [esp + 0x10], ax
test edx, edx
je 0x4390d6
mov eax, str.safemon360Tray.exe___start
mov word [esp + 0x12], 0
test eax, eax
je 0x4390d6
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x830]
push str.safemon360Tray.exe___start
rep stosd dword es:[edi], eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x43901a
lea ecx, [esp + 0x830]
push 0x800
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x830]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x830]
push str.safemon360Tray.exe___start
lea ecx, [esp + 0x834]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 0x830]
push 0x206
lea eax, [esp + 0x16]
push edx
push eax
jmp 0x4390cd
push 0x206
push str.safemon360Tray.exe___start
lea ecx, [esp + 0x1a]
jmp 0x4390cc
lea edx, [esp + 0x10]
test edx, edx
je 0x4390d6
mov eax, str.safemon360Tray.exe__start
mov word [esp + 0x10], 0
test eax, eax
je 0x4390d6
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x830]
push str.safemon360Tray.exe__start
rep stosd dword es:[edi], eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x4390be
lea ecx, [esp + 0x830]
push 0x800
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x830]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x830]
push str.safemon360Tray.exe__start
lea ecx, [esp + 0x834]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 0x830]
push 0x206
lea eax, [esp + 0x14]
push edx
push eax
jmp 0x4390cd
push 0x206
push str.safemon360Tray.exe__start
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x420]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x43911f
lea ecx, [esp + 4]
mov dword [esp + 0x1838], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov eax, 1
pop edi
mov ecx, dword [esp + 0x182c]
mov dword fs:[0], ecx
add esp, 0x1838
ret
lea ecx, [esp + 4]
mov dword [esp + 0x1838], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x1830]
xor eax, eax
pop edi
mov dword fs:[0], ecx
add esp, 0x1838
ret