Function at 0x409670
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541fb8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x594ca8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x5704e4
lea ecx, [ebp - 0x18]
call fcn.004040f0
push 0x33
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
call fcn.004046e0
push 1
push 0x57058c
lea ecx, [ebp - 0x18]
call fcn.00404340
push 0xe
push str.1905Client.exe
lea ecx, [ebp - 0x18]
call fcn.00404340
mov eax, dword [ebp + 8]
push 0x57058c
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.00404260
add esp, 0xc
push str.1905Client.exe
push eax
lea edx, [ebp - 0x28]
push edx
mov byte [ebp - 4], 1
call fcn.00404260
add esp, 0xc
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40972a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
lea edx, [ebp - 0x28]
mov dword [ebp - 0x20], esp
mov ecx, esp
push edx
call fcn.00404900
lea eax, [ebp - 0x2c]
push eax
call fcn.00402e00
add esp, 8
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x40978f
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x40978f
lea edi, [eax + eax]
mov eax, edi
call fcn.0051b880
mov esi, esp
test esi, esi
je 0x40978f
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 3
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x409791
xor eax, eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push 4
push 0
push 0
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x409b4f
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x28]
test ebx, ebx
jne 0x4097cc
xor edi, edi
jmp 0x4097f7
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x4097df
xor edi, edi
jmp 0x4097f7
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x409829
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409813
xor eax, eax
jmp 0x409829
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x28]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40986d
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.ClientPath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40986d
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
jne 0x409878
xor edi, edi
jmp 0x4098a3
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x40988b
xor edi, edi
jmp 0x4098a3
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x4098d5
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x4098bf
xor eax, eax
jmp 0x4098d5
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x2c]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409919
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.ClientVersion
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x409919
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
push 0x57058c
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.00404260
add esp, 0xc
push str.1905Tray.exe
push eax
lea edx, [ebp - 0x24]
push edx
mov byte [ebp - 4], 5
call fcn.00404260
add esp, 0xc
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409967
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp - 0x24]
test ebx, ebx
jne 0x409972
xor edi, edi
jmp 0x40999d
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409985
xor edi, edi
jmp 0x40999d
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x4099cf
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x4099b9
xor eax, eax
jmp 0x4099cf
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x24]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409a13
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.TrayPath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x409a13
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
push 0x57058c
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00404260
add esp, 0xc
push str.1905Daemon.exe
push eax
lea edx, [ebp - 0x1c]
push edx
mov byte [ebp - 4], 8
call fcn.00404260
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409a61
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
jne 0x409a6c
xor edi, edi
jmp 0x409a97
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409a7f
xor edi, edi
jmp 0x409a97
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x409ac9
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409ab3
xor eax, eax
jmp 0x409ac9
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409b0d
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.DaemonPath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x409b0d
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409b2c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409b4f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x33
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0x18]
call fcn.004046e0
push 1
push 0x57058c
lea ecx, [ebp - 0x18]
call fcn.00404340
push 6
push 0x570c84
lea ecx, [ebp - 0x18]
call fcn.00404340
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x409bc2
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x409bc2
lea edi, [eax + eax]
mov eax, edi
call fcn.0051b880
mov esi, esp
test esi, esi
je 0x409bc2
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 3
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x409bc4
xor eax, eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0
push 4
push 0
push 0
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40a119
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x28]
test ebx, ebx
jne 0x409bff
xor edi, edi
jmp 0x409c2a
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409c12
xor edi, edi
jmp 0x409c2a
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x409c5c
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409c46
xor eax, eax
jmp 0x409c5c
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x28]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409ca0
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.DisplayIcon
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x409ca0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x1c]
push str._1234
push ecx
call fcn.0040f560
add esp, 0xc
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x20]
push 0x570c84
push eax
mov byte [ebp - 4], 9
call fcn.0040f560
add esp, 0xc
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xa
call fcn.00404790
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409cfe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
jne 0x409d09
xor edi, edi
jmp 0x409d34
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409d1c
xor edi, edi
jmp 0x409d34
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x409d66
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409d50
xor eax, eax
jmp 0x409d66
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409daa
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.DisplayName
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x409daa
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
jne 0x409db5
xor edi, edi
jmp 0x409de0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409dc8
xor edi, edi
jmp 0x409de0
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x409e12
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409dfc
xor eax, eax
jmp 0x409e12
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x2c]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409e56
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.DisplayVersion
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x409e56
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 7
push 0x570fd4
lea ecx, [ebp - 0x1c]
call fcn.004046e0
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
jne 0x409e70
xor edi, edi
jmp 0x409e9b
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409e83
xor edi, edi
jmp 0x409e9b
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x409ecd
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409eb7
xor eax, eax
jmp 0x409ecd
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409f11
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.Publisher
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x409f11
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
push 0x57058c
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00404260
add esp, 0xc
push 0x570eb8
push eax
lea edx, [ebp - 0x20]
mov bl, 0xb
push edx
mov byte [ebp - 4], bl
call fcn.00404260
add esp, 0xc
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xc
call fcn.00404790
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409f6c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409f8f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
jne 0x409f9a
xor edi, edi
jmp 0x409fc5
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409fad
xor edi, edi
jmp 0x409fc5
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x409ff7
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x409fe1
xor eax, eax
jmp 0x409ff7
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a03b
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.UninstallString
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40a03b
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xc
push str.www.1905.com
lea ecx, [ebp - 0x1c]
call fcn.004046e0
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
jne 0x40a055
xor edi, edi
jmp 0x40a080
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x40a068
xor edi, edi
jmp 0x40a080
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x40a0b2
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x40a09c
xor eax, eax
jmp 0x40a0b2
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a0f6
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.URLInfoAbout
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40a0f6
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a119
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebp + 0xc], 0
je 0x40a24f
mov ecx, dword [ebp + 8]
push 0x57058c
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.00404260
add esp, 0xc
push str.1905Tray.exe
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 0xd
call fcn.00404260
add esp, 0xc
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a171
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x2d
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x18]
call fcn.004046e0
mov ebx, dword [ebp - 0x24]
test ebx, ebx
jne 0x40a18b
xor edi, edi
jmp 0x40a1b6
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x40a19e
xor edi, edi
jmp 0x40a1b6
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov edi, eax
mov eax, dword [ebp - 0x18]
mov ebx, eax
test eax, eax
je 0x40a1e8
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x40a1d2
xor eax, eax
jmp 0x40a1e8
lea esi, [eax + eax]
mov eax, esi
call fcn.0051b880
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00403b60
mov ecx, dword [ebp - 0x24]
mov esi, dword [ecx - 0xc]
lea edx, [ebp - 0x14]
push edx
push 2
push 0
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a22c
mov ecx, dword [ebp - 0x14]
lea eax, [esi + esi]
push eax
push edi
push 1
push 0
push str.1905Client
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40a22c
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a24f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a272
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a295
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a2bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esp, [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051553d
mov esp, ebp
pop ebp
ret