Function at 0x438b08
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x43905f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41e818]
call fcn.0041e918
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43902d
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004367ac
test al, al
je 0x438b8c
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.0041e9b8
jmp 0x438b99
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.0041e9b8
push 0x104
lea eax, [ebp - 0x116]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
xor eax, eax
push ebp
push 0x438c7f
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x439078
mov eax, dword [ebp - 4]
call fcn.0041ea1c
call fcn.004028c8
mov edx, dword [0x4436ec]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.0041eecc
test al, al
je 0x438c0f
lea ecx, [ebp - 0x11c]
mov edx, dword [0x4436ec]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.0041ed14
mov ecx, dword [ebp - 0x11c]
mov eax, dword [0x44359c]
mov eax, dword [eax]
mov edx, 0x4390b0
call fcn.004159e4
jmp 0x438c6d
mov eax, 0x5f5e100
call fcn.00402ad4
add eax, 0xf4240
lea edx, [ebp - 0x120]
call fcn.00409504
mov ecx, dword [ebp - 0x120]
mov eax, dword [0x44359c]
mov eax, dword [eax]
mov edx, 0x4390b0
call fcn.004159e4
lea ecx, [ebp - 0x124]
mov eax, dword [0x44359c]
mov eax, dword [eax]
mov edx, 0x4390b0
call fcn.004152fc
mov ecx, dword [ebp - 0x124]
mov edx, dword [0x4436ec]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.0041ece8
mov eax, dword [ebp - 4]
call fcn.0041e988
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x438c89
lea eax, [ebp - 0x128]
lea edx, [ebp - 0x116]
mov ecx, 0x106
call fcn.004040ec
lea eax, [ebp - 0x128]
mov edx, 0x4390c0
call fcn.00404144
mov edx, dword [ebp - 0x128]
mov eax, dword [0x444c04]
call fcn.00404288
je 0x438d36
xor eax, eax
push ebp
push 0x438d2c
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x4390e0
mov eax, dword [ebp - 4]
call fcn.0041ea1c
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x116]
mov ecx, 0x106
call fcn.004040ec
lea eax, [ebp - 0x12c]
mov edx, 0x4390c0
call fcn.00404144
mov ecx, dword [ebp - 0x12c]
mov edx, dword [0x4432a8]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.0041ece8
mov eax, dword [ebp - 4]
call fcn.0041e988
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x438d36
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.0041e9b8
lea eax, [ebp - 8]
call fcn.00403e7c
xor ecx, ecx
mov edx, 0x439118
mov eax, dword [ebp - 4]
call fcn.0041ea1c
test al, al
je 0x438d76
lea ecx, [ebp - 8]
mov edx, 0x43914c
mov eax, dword [ebp - 4]
call fcn.0041ed14
mov eax, dword [ebp - 4]
call fcn.0041e988
lea ecx, [ebp - 0x130]
mov edx, dword [0x443438]
mov eax, dword [0x443690]
call fcn.0043722c
xor ecx, ecx
mov edx, 0x43916c
mov eax, dword [ebp - 4]
call fcn.0041ea1c
test al, al
je 0x438df9
lea ecx, [ebp - 0xc]
mov edx, 0x4391b4
mov eax, dword [ebp - 4]
call fcn.0041ed14
lea ecx, [ebp - 0x10]
mov edx, 0x4391c8
mov eax, dword [ebp - 4]
call fcn.0041ed14
cmp dword [ebp - 0x10], 0
je 0x438df1
cmp dword [ebp - 0xc], 0
je 0x438df1
mov eax, dword [0x443690]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004159e4
mov eax, dword [0x443438]
mov eax, dword [eax]
mov ecx, 0x4391e4
mov edx, dword [ebp - 0xc]
call fcn.004159e4
mov eax, dword [ebp - 4]
call fcn.0041e988
xor ecx, ecx
mov edx, 0x4391f8
mov eax, dword [ebp - 4]
call fcn.0041ea1c
test al, al
je 0x438e66
lea ecx, [ebp - 0xc]
mov edx, 0x4391b4
mov eax, dword [ebp - 4]
call fcn.0041ed14
lea ecx, [ebp - 0x10]
mov edx, 0x4391c8
mov eax, dword [ebp - 4]
call fcn.0041ed14
cmp dword [ebp - 0x10], 0
je 0x438e5e
cmp dword [ebp - 0xc], 0
je 0x438e5e
mov eax, dword [0x443690]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004159e4
mov eax, dword [0x443438]
mov eax, dword [eax]
mov ecx, 0x4391e4
mov edx, dword [ebp - 0xc]
call fcn.004159e4
mov eax, dword [ebp - 4]
call fcn.0041e988
xor ecx, ecx
mov edx, 0x439240
mov eax, dword [ebp - 4]
call fcn.0041ea1c
test al, al
je 0x438ed3
lea ecx, [ebp - 0xc]
mov edx, 0x4391b4
mov eax, dword [ebp - 4]
call fcn.0041ed14
lea ecx, [ebp - 0x10]
mov edx, 0x4391c8
mov eax, dword [ebp - 4]
call fcn.0041ed14
cmp dword [ebp - 0x10], 0
je 0x438ecb
cmp dword [ebp - 0xc], 0
je 0x438ecb
mov eax, dword [0x443690]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004159e4
mov eax, dword [0x443438]
mov eax, dword [eax]
mov ecx, 0x4391e4
mov edx, dword [ebp - 0xc]
call fcn.004159e4
mov eax, dword [ebp - 4]
call fcn.0041e988
xor ecx, ecx
mov edx, 0x439288
mov eax, dword [ebp - 4]
call fcn.0041ea1c
test al, al
je 0x438f40
lea ecx, [ebp - 0xc]
mov edx, 0x4391b4
mov eax, dword [ebp - 4]
call fcn.0041ed14
lea ecx, [ebp - 0x10]
mov edx, 0x4391c8
mov eax, dword [ebp - 4]
call fcn.0041ed14
cmp dword [ebp - 0x10], 0
je 0x438f38
cmp dword [ebp - 0xc], 0
je 0x438f38
mov eax, dword [0x443690]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004159e4
mov eax, dword [0x443438]
mov eax, dword [eax]
mov ecx, 0x4391e4
mov edx, dword [ebp - 0xc]
call fcn.004159e4
mov eax, dword [ebp - 4]
call fcn.0041e988
cmp dword [ebp - 8], 0
je 0x439017
mov eax, dword [ebp - 8]
mov edx, 0x4392d0
call fcn.00404288
je 0x439017
mov eax, dword [ebp - 8]
mov edx, 0x4392e4
call fcn.00404288
je 0x439017
mov eax, dword [ebp - 8]
mov edx, 0x4392f8
call fcn.00404288
je 0x439017
mov eax, dword [ebp - 8]
mov edx, 0x43930c
call fcn.00404288
je 0x439017
lea eax, [ebp - 0x134]
mov ecx, dword [ebp - 8]
mov edx, 0x439320
call fcn.00404188
mov edx, dword [ebp - 0x134]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.0041ea1c
test al, al
je 0x439017
lea ecx, [ebp - 0xc]
mov edx, 0x4391b4
mov eax, dword [ebp - 4]
call fcn.0041ed14
lea ecx, [ebp - 0x10]
mov edx, 0x4391c8
mov eax, dword [ebp - 4]
call fcn.0041ed14
cmp dword [ebp - 0x10], 0
je 0x43900f
cmp dword [ebp - 0xc], 0
je 0x43900f
mov eax, dword [0x443690]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004159e4
mov eax, dword [0x443438]
mov eax, dword [eax]
mov ecx, 0x4391e4
mov edx, dword [ebp - 0xc]
call fcn.004159e4
mov eax, dword [ebp - 4]
call fcn.0041e988
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439034
mov eax, dword [ebp - 4]
call fcn.004030e4
ret