Function at 0x403b80
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1058]
mov eax, 0x1058
call fcn.0041d6e0
push 0xffffffffffffffff
push 0x421e64
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x435700]
xor eax, ebp
mov dword [ebp + 0x1054], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x1060]
xor edi, edi
push 0x428ef0
lea ecx, [ebp + 0x38]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea ecx, [ebp - 0x14]
push ecx
push str.SoftwareMicrosoftMSNMessenger
mov byte [ebp - 4], 1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, edi
jne 0x403d13
mov esi, dword [ebp - 0x14]
cmp esi, edi
je 0x403d13
push 0x1000
lea edx, [ebp + 0x54]
push edi
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0x54]
push ecx
lea edx, [ebp - 0x20]
push edx
push edi
push str.InstallationDirectory
push esi
mov dword [ebp - 0x1c], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x403cfd
lea eax, [ebp + 0x54]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x403c50
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 + 0x52], 0x5c
jne 0x403cb3
lea eax, [ebp + 0x54]
add eax, 0xfffffffe
lea ecx, [ecx]
mov cx, word [eax + 2]
add eax, 2
cmp cx, di
jne 0x403c70
mov ecx, dword [0x429324]
mov edx, dword [0x429328]
mov dword [eax], ecx
mov ecx, dword [0x42932c]
mov dword [eax + 4], edx
mov edx, dword [0x429330]
mov dword [eax + 8], ecx
mov ecx, dword [0x429334]
mov dword [eax + 0xc], edx
mov edx, dword [0x429338]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], edx
jmp 0x403cdc
lea edi, [ebp + 0x54]
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x403cc0
mov ecx, 6
mov esi, str.msnmsgr.exe
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
lea eax, [ebp + 0x54]
push eax
call sub.mgcommon.dll__IsFileExist_4
cmp eax, edi
je 0x403cfd
lea ecx, [ebp + 0x54]
push ecx
lea ecx, [ebp + 0x38]
call dword [0x4230d4]
mov dword [ebp - 0x18], 1
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x18], edi
jne 0x403fc6
lea eax, [ebp - 0x14]
push eax
push str.SoftwareMicrosoftWindows_LiveMessenger
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, edi
jne 0x403e43
mov esi, dword [ebp - 0x14]
cmp esi, edi
je 0x403e43
push 0x1000
lea ecx, [ebp + 0x54]
push edi
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp + 0x54]
push eax
lea ecx, [ebp - 0x20]
push ecx
push edi
push str.InstallationDirectory
push esi
mov dword [ebp - 0x1c], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x403e2d
lea eax, [ebp + 0x54]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x403d80
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 + 0x52], 0x5c
jne 0x403de3
lea eax, [ebp + 0x54]
add eax, 0xfffffffe
lea ecx, [ecx]
mov cx, word [eax + 2]
add eax, 2
cmp cx, di
jne 0x403da0
mov edx, dword [0x429324]
mov ecx, dword [0x429328]
mov dword [eax], edx
mov edx, dword [0x42932c]
mov dword [eax + 4], ecx
mov ecx, dword [0x429330]
mov dword [eax + 8], edx
mov edx, dword [0x429334]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x429338]
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], ecx
jmp 0x403e0c
lea edi, [ebp + 0x54]
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x403df0
mov ecx, 6
mov esi, str.msnmsgr.exe
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
lea edx, [ebp + 0x54]
push edx
call sub.mgcommon.dll__IsFileExist_4
cmp eax, edi
je 0x403e2d
lea eax, [ebp + 0x54]
push eax
lea ecx, [ebp + 0x38]
call dword [0x4230d4]
mov dword [ebp - 0x18], 1
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x18], edi
jne 0x403fc6
push str.CSIDL_PROGRAM_FILES
lea edx, [ebp]
push edx
call sub.mgcommon.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____stdcall_GetShellFolderPath_wchar_t_const__
push str.MSN_Messengermsnmsgr.exe
lea eax, [ebp]
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 2
mov esi, dword [sym.imp.MSVCP90.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::operator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___wchar_t_const__]
push ecx
call esi
add esp, 0xc
mov bl, 3
mov byte [ebp - 4], bl
mov eax, dword [ebp + 0x20]
mov edi, 8
cmp dword [ebp + 0x34], edi
jae 0x403e82
lea eax, [ebp + 0x20]
push eax
call sub.mgcommon.dll__IsFileExist_4
test eax, eax
jne 0x403ecd
push str.Windows_LiveMessengermsnmsgr.exe
lea edx, [ebp]
push edx
lea eax, [ebp - 0x40]
push eax
call esi
add esp, 0xc
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 4
call dword [0x4230c4]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [ebp + 0x20]
cmp dword [ebp + 0x34], edi
jae 0x403ec3
lea eax, [ebp + 0x20]
push eax
call sub.mgcommon.dll__IsFileExist_4
test eax, eax
je 0x403ee1
lea ecx, [ebp + 0x1c]
push ecx
lea ecx, [ebp + 0x38]
call dword [0x4230c4]
mov dword [ebp - 0x18], 1
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 2
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [ebp]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor ebx, ebx
cmp dword [ebp - 0x18], ebx
jne 0x403fcb
lea edx, [ebp - 0x14]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, ebx
jne 0x403fef
mov esi, dword [ebp - 0x14]
cmp esi, ebx
je 0x403fef
push 0x1000
lea eax, [ebp + 0x54]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp + 0x54]
push edx
lea eax, [ebp - 0x20]
push eax
push ebx
push str.msnmsgr
push esi
mov dword [ebp - 0x1c], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x403fb3
cmp word [ebp + 0x54], 0x7e
jne 0x403f73
lea ecx, [ebp + 0x56]
push ecx
jmp 0x403f77
lea edx, [ebp + 0x54]
push edx
lea ecx, [ebp + 0x38]
call dword [0x4230d4]
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x38]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1054]
xor ecx, ebp
call fcn.0041d649
add ebp, 0x1058
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 0
jmp 0x403f83
mov edi, 8
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp + 0x3c]
mov dword [ecx + 0x2b8], 1
cmp dword [ebp + 0x50], edi
jae 0x403fe3
lea eax, [ebp + 0x3c]
add ecx, 0x29c
push eax
call fcn.004051d0
mov byte [ebp - 4], 0
jmp 0x403f83