Function at 0x40bae8
Capabilities:
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x40baf1
mov eax, dword [ebp - 4]
add esp, 0xffffffd0
push ebx
push esi
push edi
lea ebx, [ebp - 0x2034]
mov eax, 0x4c6d98
call fcn.00490d08
cmp dword [ebp + 8], 0
je 0x40bb20
cmp dword [ebp + 0xc], 1
jae 0x40bb31
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
mov eax, edx
jmp 0x40beca
lea edi, [ebp - 0x834]
mov esi, 0x4c1c91
mov ecx, pe_nt_image_headers32
lea eax, [ebp - 0xc34]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0xc34]
mov ecx, 0x100
mov esi, 0x4c2492
rep movsd dword es:[edi], dword [esi]
push 0x400
push eax
push str._LOCALAPPDATA_GoogleChromeUser_DataDefaultPreferences
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov word [ebp - 0x20], 8
lea edx, [ebp - 0xc34]
lea eax, [ebp - 4]
call fcn.0049c954
inc dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004420d4
xor edx, edx
mov dl, al
lea eax, [ebp - 4]
cmp edx, 1
mov edx, 2
sbb ecx, ecx
neg ecx
push ecx
dec dword [ebp - 0x14]
call fcn.0049ca98
pop ecx
test cl, cl
je 0x40bc5c
push 0x400
lea eax, [ebp - 0xc34]
push eax
push str._APPDATA_GoogleChromeUser_DataDefaultPreferences
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov word [ebp - 0x20], 0x14
lea edx, [ebp - 0xc34]
lea eax, [ebp - 8]
call fcn.0049c954
inc dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004420d4
xor edx, edx
mov dl, al
lea eax, [ebp - 8]
cmp edx, 1
mov edx, 2
sbb ecx, ecx
neg ecx
push ecx
dec dword [ebp - 0x14]
call fcn.0049ca98
pop ecx
test cl, cl
je 0x40bc5c
push 0x400
lea eax, [ebp - 0xc34]
push eax
push 0x4c6962
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocStringLen
call fcn.004113dc
add esp, 0x14
cmp byte [ebp - 0xc34], 0
je 0x40bc5c
push 0x400
lea edx, [ebp - 0xc34]
push edx
call fcn.0041203c
add esp, 8
lea ecx, [ebp - 0xc34]
push 0x400
push 0x4c68bf
push ecx
call fcn.004119a0
add esp, 0xc
mov word [ebp - 0x20], 0x20
lea edx, [ebp - 0xc34]
lea eax, [ebp - 0xc]
call fcn.0049c954
inc dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004420d4
push eax
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0049ca98
pop ecx
test cl, cl
je 0x40bec0
push 0x4c6970
lea eax, [ebp - 0xc34]
push eax
call fcn.00492968
add esp, 8
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x40bec0
mov esi, 0x4c2893
lea edi, [ebp - 0x1c34]
mov ecx, 0x400
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4c3894
mov edi, ebx
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
jmp 0x40be96
push str.urls_to_restore_on_startup
lea eax, [ebp - 0x1c34]
push eax
call fcn.00490a01
add esp, 8
test eax, eax
je 0x40be96
lea edx, [ebp - 0x1c34]
sub eax, edx
inc eax
mov esi, eax
lea edi, [ebp + esi - 0x1c34]
jmp 0x40bd30
xor eax, eax
mov al, byte [edi]
cmp eax, 0x5b
jne 0x40bd2e
push 0x400
lea edx, [ebp - 0x1c34]
add edx, esi
push edx
push ebx
call fcn.004119e8
add esp, 0xc
test eax, eax
jne 0x40bd4f
inc esi
inc edi
lea ecx, [ebp - 0x1c34]
push ecx
call fcn.00490908
pop ecx
cmp esi, eax
jb 0x40bd0a
jmp 0x40bd4f
push ebx
call fcn.00490908
pop ecx
mov byte [ebx + eax - 1], 0
push ebx
call fcn.00490908
pop ecx
cmp eax, 1
jbe 0x40bd7a
push ebx
call fcn.00490908
pop ecx
movzx eax, byte [ebx + eax - 1]
cmp eax, 0x5d
jne 0x40bd43
jmp 0x40bd7a
push ebx
call fcn.00490908
pop ecx
mov byte [ebx + eax - 1], 0
push ebx
call fcn.00490908
pop ecx
cmp eax, 1
jbe 0x40bddf
push ebx
call fcn.00490908
pop ecx
xor edx, edx
mov dl, byte [ebx + eax - 1]
cmp edx, 0x5d
je 0x40bd6e
push ebx
call fcn.00490908
pop ecx
xor ecx, ecx
mov cl, byte [ebx + eax - 1]
cmp ecx, 0x20
je 0x40bd6e
push ebx
call fcn.00490908
pop ecx
movzx eax, byte [ebx + eax - 1]
cmp eax, 0x22
je 0x40bd6e
jmp 0x40bddf
xor eax, eax
lea edi, [ebx + 1]
or ecx, 0xffffffff
mov esi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
call fcn.00490908
pop ecx
cmp eax, 1
jbe 0x40bdfe
xor eax, eax
mov al, byte [ebx]
cmp eax, 0x5b
je 0x40bdbd
cmp eax, 0x22
je 0x40bdbd
cmp eax, 0x20
je 0x40bdbd
push 0x400
push str.MULTISEP
push 0x4c69d8
push ebx
call fcn.0041218c
add esp, 0xc
push eax
push ebx
call fcn.004119e8
add esp, 0xc
cmp byte [ebx], 0
je 0x40beb6
mov edx, dword [ebp + 0xc]
push edx
push 0x4c6b2f
mov ecx, dword [ebp + 8]
push ecx
call fcn.004119a0
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
push 0x4c6b66
mov edx, dword [ebp + 8]
push edx
call fcn.004119a0
add esp, 0xc
lea ecx, [ebp - 0x834]
push 0x800
push ecx
push ebx
call fcn.0040c680
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
lea edx, [ebp - 0x834]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.004119a0
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
push 0x4c6b31
mov edx, dword [ebp + 8]
push edx
call fcn.004119a0
add esp, 0xc
jmp 0x40beb6
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x1c34]
push ecx
push 0x1000
push eax
call fcn.004925f0
add esp, 0xc
test eax, eax
jne 0x40bcda
mov edx, dword [ebp - 0x34]
push edx
call fcn.004924c0
pop ecx
mov ecx, dword [ebp - 0x30]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret