Function at 0x4044a0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x454d68
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x46d674]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
push edi
mov eax, dword [0x46d674]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
mov dword [esp + 0x18], eax
xor edi, edi
call ebx
call fcn.004377e0
lea esi, [esp + 0x40]
mov edx, eax
call fcn.00403790
mov dword [esp + 0x88], 0
cmp dword [eax + 0x14], 8
jb 0x404513
mov eax, dword [eax]
mov ecx, eax
call fcn.00437b00
mov dword [esp + 0x88], 0xffffffff
cmp dword [esp + 0x54], 8
mov esi, eax
jb 0x40453b
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0043e981
add esp, 4
xor eax, eax
cmp esi, eax
je 0x40455c
push 0x1f4
call ebx
inc edi
cmp edi, 0x168
jl 0x4044f0
push esi
call fcn.00437d20
add esp, 4
xor eax, eax
xor edx, edx
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], eax
mov word [esp + 0x24], dx
mov dword [esp + 0x88], 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push eax
push str.SOFTWAREFunshionFunshion
mov byte [esp + 0x98], 2
push SysStringLen
mov dword [esp + 0x24], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4045bd
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
push eax
lea edx, [esp + 0x28]
mov ecx, str.Version
call fcn.0040a7b0
push 4
push str.Beta
lea ecx, [esp + 0x2c]
push ecx
xor eax, eax
call fcn.00403400
cmp eax, 0xffffffff
je 0x40462d
push eax
xor ecx, ecx
lea esi, [esp + 0x44]
lea edx, [esp + 0x28]
call fcn.00404910
mov edi, eax
lea esi, [esp + 0x24]
mov byte [esp + 0x88], 3
call fcn.00403390
mov ebx, 8
mov byte [esp + 0x88], 2
cmp dword [esp + 0x54], ebx
jb 0x404632
mov edx, dword [esp + 0x40]
push edx
call fcn.0043e981
add esp, 4
jmp 0x404632
mov ebx, 8
call fcn.004377e0
lea esi, [esp + 0x40]
mov edx, eax
call fcn.00403760
mov esi, dword [eax + 0x10]
cmp dword [eax + 0x14], ebx
jb 0x40464c
mov eax, dword [eax]
mov edi, dword [esp + 0x34]
mov edx, edi
cmp edi, esi
jb 0x404658
mov edx, esi
mov ecx, dword [esp + 0x24]
cmp dword [esp + 0x38], ebx
jae 0x404666
lea ecx, [esp + 0x24]
test edx, edx
je 0x404691
lea ebx, [ebx]
mov bx, word [ecx]
cmp bx, word [eax]
jne 0x404683
add ecx, 2
add eax, 2
dec edx
jne 0x404670
jmp 0x404691
mov cx, word [ecx]
cmp cx, word [eax]
sbb eax, eax
and eax, 0xfffffffe
inc eax
jne 0x4046a1
cmp edi, esi
jae 0x40469a
or eax, 0xffffffff
jmp 0x4046a1
xor eax, eax
cmp edi, esi
setne al
test eax, eax
mov edi, 8
sete bl
mov byte [esp + 0x88], 2
cmp dword [esp + 0x54], edi
jb 0x4046c6
mov edx, dword [esp + 0x40]
push edx
call fcn.0043e981
add esp, 4
test bl, bl
je 0x4047a0
push 1
call fcn.004377e0
mov esi, eax
call fcn.00436a40
lea eax, [esp + 0x10]
push eax
push 0x20006
xor ebx, ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push Ordinal_4
xor esi, esi
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404707
mov esi, dword [esp + 0x10]
push 0x459494
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp esi, ebx
je 0x40471e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00438820
push ebx
lea ecx, [esp + 0x60]
mov esi, eax
push 0x459b2c
push ecx
mov dword [esi + 0x214], ebx
call fcn.0040ad00
add esp, 0xc
cmp dword [esi + 0x14], edi
jb 0x404745
mov esi, dword [esi]
mov eax, dword [esp + 0x5c]
cmp dword [esp + 0x70], edi
jae 0x404753
lea eax, [esp + 0x5c]
push esi
push eax
push str.PrepareUpgrade
push str.Update
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp dword [esp + 0x70], edi
jb 0x404778
mov edx, dword [esp + 0x5c]
push edx
call fcn.0043e981
add esp, 4
mov eax, dword [esp + 0x14]
cmp dword [eax + 4], ebx
je 0x4047e5
call fcn.0040f210
mov ecx, dword [eax]
mov edx, str._string_upgrade_tray_title
call fcn.0040c830
mov ebx, eax
call fcn.0040f210
mov edx, str._string_upgrade_tray_success_info
jmp 0x4047c7
mov edx, dword [esp + 0x14]
cmp dword [edx + 4], 0
je 0x4047e5
call fcn.0040f210
mov ecx, dword [eax]
mov edx, str._string_upgrade_tray_title
call fcn.0040c830
mov ebx, eax
call fcn.0040f210
mov edx, str._string_upgrade_tray_fail_info
mov ecx, dword [eax]
call fcn.0040c830
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx + 4]
call fcn.00436430
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4047f4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x404803
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x38], edi
jb 0x404816
mov edx, dword [esp + 0x24]
push edx
call fcn.0043e981
add esp, 4
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0043e417
mov esp, ebp
pop ebp
ret 4