Function at 0x404966
Capabilities:
Persist via run registry key

Disassembly:
mov eax, 0x4315b8
call fcn.004203b8
sub esp, 0x110
test byte [0x4438c4], 1
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x18], ebx
mov esi, 0x4438c0
jne 0x4049a5
or byte [0x4438c4], 1
mov ecx, esi
call fcn.0040af50
push 0x404df9
call fcn.004207b6
pop ecx
test byte [0x4438c4], 2
mov edi, 0x4438bc
jne 0x4049cc
or byte [0x4438c4], 2
mov ecx, edi
call fcn.0040af50
push 0x404def
call fcn.004207b6
pop ecx
test byte [0x4438c4], 4
jne 0x4049f1
or byte [0x4438c4], 4
mov ecx, 0x4438b8
call fcn.0040af50
push 0x404de5
call fcn.004207b6
pop ecx
mov ecx, esi
call fcn.0040b200
test eax, eax
jne 0x404a3e
xor ebx, ebx
mov ecx, esi
push ebx
call fcn.0040b220
push eax
call fcn.0040ae25
pop ecx
test eax, eax
pop ecx
je 0x404a30
push dword [0x4438c0]
push str.DeletedSpud___s_
call fcn.0041df5d
pop ecx
pop ecx
mov ecx, esi
call fcn.0040b440
jmp 0x404bc8
mov ecx, dword [ebp - 0x18]
push ebx
push 0x337
jmp 0x404acf
push edi
call fcn.00406994
test eax, eax
pop ecx
jne 0x404a5a
mov ecx, edi
call fcn.0040b220
push eax
push 0x32c
mov ecx, ebx
jmp 0x404acf
push 0x4438b8
call fcn.004069f1
test eax, eax
pop ecx
jne 0x404a71
push eax
push 0x32e
jmp 0x404a56
push 1
mov ecx, ebx
call fcn.00406e44
test eax, eax
je 0x404c9d
call fcn.0040a698
test eax, eax
je 0x404a94
push 0
push 0x339
jmp 0x404a56
xor ebx, ebx
push ebx
push str.Deleting
push str.softwareGator.comTrickler
push reloc.WSOCK32.dll_bind
call fcn.0040a22b
add esp, 0x10
test eax, eax
je 0x404ad9
mov esi, dword [ebp - 0x18]
push str.App_was_already_in_Deleting_mode
mov dword [esi + 0x4c], 1
call fcn.0041df5d
pop ecx
push ebx
push 0x32b
mov ecx, esi
call fcn.004065c4
jmp 0x404c9d
call fcn.0040a631
push eax
call fcn.0040a990
push ebx
push 1
call fcn.0040a855
push ebx
push str.GetGator
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea eax, [ebp - 0x1c]
push reloc.WSOCK32.dll_bind
push eax
call fcn.0040a263
add esp, 0x20
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.0040b200
test eax, eax
jne 0x404bbc
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.0040d740
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
push eax
mov ecx, esi
call fcn.0040b680
push esi
lea ecx, [ebp - 0x10]
call fcn.0040b2f0
push 0x439d5c
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0040b840
push str._remove
lea ecx, [ebp - 0x10]
call fcn.0040b840
push dword [0x4438c0]
push str.CSpudDelete___s_
call fcn.0041df5d
pop ecx
lea eax, [ebp - 0x14]
pop ecx
mov dword [ebp - 0x14], ebx
push ebx
push eax
lea ecx, [ebp - 0x10]
call fcn.0040b220
push eax
call fcn.004116f0
add esp, 0xc
cmp eax, ebx
je 0x404b9b
mov ecx, dword [ebp - 0x18]
push 1
push 0x1e
call fcn.0040643a
mov eax, 0x439564
jmp 0x404ba0
mov eax, str.Failed
push dword [ebp - 0x14]
push eax
push str.CSpudDeleteExecRslt:__s__err_d_
call fcn.0041df5d
add esp, 0xc
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.0040af80
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0040af80
mov ecx, esi
call fcn.0040b200
test eax, eax
je 0x404c9d
mov ecx, 0x4438b8
call fcn.0040b220
push eax
mov ecx, edi
call fcn.0040b220
push eax
call fcn.004038ba
pop ecx
pop ecx
call fcn.004038ec
lea ecx, [ebp - 0x10]
call fcn.0041f228
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 2
call fcn.00404d7d
push eax
lea ecx, [ebp - 0x10]
call fcn.00404d35
push eax
lea ecx, [ebp - 0x10]
call fcn.00404cdc
push eax
lea ecx, [ebp - 0x10]
call fcn.00404cac
push eax
lea eax, [ebp - 0x11c]
push str.za_d_sz_d_nor_d_mc_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push ebx
call fcn.004113a0
push eax
call fcn.004113d0
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.0040af60
mov eax, 0x44386c
lea ecx, [ebp - 0x14]
push eax
push eax
mov byte [ebp - 4], 3
call fcn.0040b220
push eax
lea eax, [ebp - 0x11c]
push eax
push str.PST1
call fcn.00403943
mov ecx, dword [ebp - 0x18]
add esp, 0x14
call fcn.00406690
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0040af80
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0041f24d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret