Function at 0x4031c0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x244
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x40]
mov esi, 0x460594
rep stosd dword es:[edi], eax
mov ecx, dword [0x460584]
lea edi, [esp + 0x144]
mov dword [esp + 0x24], ecx
mov cl, byte [0x460590]
mov byte [esp + 0x30], cl
mov ecx, dword [0x460574]
mov dword [esp + 0x14], ecx
mov ecx, dword [str.Information]
mov dword [esp + 0x34], ecx
mov ecx, 0x17
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x17
mov esi, 0x460500
lea edi, [esp + 0x1a4]
mov eax, dword [0x460580]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x11
mov esi, str.Install_will_continue_after_restarting_computer__r_n_r_nDo_you_reboot_now_
lea edi, [esp + 0x204]
mov edx, dword [0x460588]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x20], eax
mov eax, dword [0x46058c]
mov dword [esp + 0x28], edx
mov edx, dword [0x46056c]
mov dword [esp + 0x2c], eax
mov eax, dword [0x460570]
mov dword [esp + 0xc], edx
mov edx, dword [0x460578]
mov dword [esp + 0x10], eax
mov al, byte [0x46057c]
movsw word es:[edi], word [esi]
lea ecx, [esp + 0x40]
mov dword [esp + 0x18], edx
mov edx, dword [0x460564]
mov byte [esp + 0x1c], al
mov eax, dword [0x460568]
push 0x104
push ecx
push 0
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, dword [esp + 0x250]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x460478
mov esi, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x40]
add esi, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, 0x104
sub eax, ecx
cmp eax, esi
jbe 0x403383
mov edi, 0x460478
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
lea ebx, [esp + 0x48]
mov esi, edi
mov ebp, ecx
mov edi, ebx
or ecx, 0xffffffff
lea ebx, [esp + 0x48]
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x10]
mov ecx, edx
push eax
push 0xf003f
and ecx, 3
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edi, [esp + 0x48]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x4c]
push ecx
push 1
push eax
push str.setup
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop ebp
pop ebx
mov eax, dword [esp + 0x254]
pop edi
test eax, eax
pop esi
jne 0x4033e5
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp ax, 0x804
push 0x24
jne 0x4033ad
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x140]
push eax
push ecx
jmp 0x4033ba
lea edx, [esp + 8]
lea eax, [esp + 0x1a0]
push edx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x4033e5
call fcn.00401410
sub eax, 0
je 0x4033e0
dec eax
jne 0x4033e5
call fcn.00401460
add esp, 0x244
ret
call fcn.00401470
add esp, 0x244
ret