Function at 0x40af50
Capabilities:
Check if file exists
Persist via run registry key
Read .ini file

Disassembly:
sub esp, 0x71c
mov eax, dword [0x42e070]
xor eax, esp
mov dword [esp + 0x714], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x51a]
push ecx
mov word [esp + 0x51c], ax
call fcn.00410d60
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x10a]
push eax
mov word [esp + 0x10c], dx
call fcn.00410d60
add esp, 0xc
xor ecx, ecx
push 0x62
push ecx
lea edx, [esp + 0x3a]
push edx
mov word [esp + 0x3c], cx
call fcn.00410d60
add esp, 0xc
push 0x430728
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40b035
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea edi, [esp + 0x30c]
mov esi, str.Common_AppData
mov ecx, reloc.WS2_32.dll_bind
call fcn.00404f40
mov eax, edi
add esp, 4
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40aff0
sub eax, edx
sar eax, 1
je 0x40b035
push str.Net_Protector
lea eax, [esp + 0x30c]
push pe_nt_image_headers32
push eax
call fcn.0040ec9c
add esp, 0xc
lea ecx, [esp + 0x308]
push ecx
push pe_nt_image_headers32
push 0x430728
call fcn.0040ee2f
add esp, 0xc
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push 0x430728
lea edx, [esp + 0x514]
push str._sServerIP.ini
push edx
call edi
add esp, 0xc
push 0x430728
lea eax, [esp + 0x104]
push str._sCCLM.ini
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0xc
lea ecx, [esp + 0x100]
push ecx
push 0x32
lea edx, [esp + 0x38]
push edx
push 0x424e08
push str.client_in_logon
push str.client_logon
call esi
lea eax, [esp + 0x30]
push 0x42a668
push eax
call fcn.0040f49b
add esp, 8
test eax, eax
je 0x40b0be
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x714]
xor ecx, esp
call fcn.0040e6d9
add esp, 0x71c
ret
push 0x32
lea ecx, [esp + 0x34]
push 0
push ecx
call fcn.00410d60
add esp, 0xc
lea edx, [esp + 0x510]
push edx
push 0x32
lea eax, [esp + 0x38]
push eax
push 0x424e08
push 0x42925c
push str.Server
call esi
lea eax, [esp + 0x30]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b0f6
sub eax, edx
sar eax, 1
jne 0x40b0a5
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x32
lea edx, [esp + 0x9c]
push 0
push edx
call fcn.00410d60
movzx eax, word [esp + 0x18]
movzx ecx, word [esp + 0x1a]
movzx edx, word [esp + 0x1e]
add esp, 0xc
push eax
push ecx
push edx
lea eax, [esp + 0xa4]
push str._02d__02d__04d
push eax
call edi
add esp, 0x14
push 0x32
lea ecx, [esp + 0x34]
push 0
push ecx
call fcn.00410d60
add esp, 0xc
lea edx, [esp + 0x100]
push edx
push 0x32
lea eax, [esp + 0x38]
push eax
push 0x424e08
push 0x42a66c
push str.client_logon
call esi
lea eax, [esp + 0x30]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b182
sub eax, edx
sar eax, 1
je 0x40b0a5
push 0x424e08
lea ecx, [esp + 0x20]
push 0xa
push ecx
call fcn.0040ee2f
add esp, 0xc
lea edx, [esp + 0x100]
push edx
push 0xa
lea eax, [esp + 0x24]
push eax
push 0x424e08
push str.client_in_days
push str.client_logon
call esi
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b1d2
sub eax, edx
sar eax, 1
je 0x40b0a5
lea ecx, [esp + 0x1c]
push ecx
call fcn.004101df
lea edx, [esp + 0x34]
add esp, 4
push edx
lea ecx, [esp + 0x9c]
mov esi, eax
call fcn.0040ab20
xor ecx, ecx
add esp, 4
cmp esi, eax
setge cl
pop edi
pop esi
mov eax, ecx
mov ecx, dword [esp + 0x714]
xor ecx, esp
call fcn.0040e6d9
add esp, 0x71c
ret