Function at 0x40d355
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
sub esp, 0x24c
lea ebp, [esp - 4]
mov eax, dword [0x4879c0]
xor eax, ebp
mov dword [ebp + 0x24c], eax
push 0x70
mov eax, 0x46ea9a
call fcn.00431d47
cmp dword [0x489fac], 8
mov eax, dword [ebp + 0x258]
mov dword [ebp - 0x20], eax
mov eax, dword [0x489f98]
jae 0x40d395
mov eax, 0x489f98
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0040abac
push str.runatstartup
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x7c]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.0040b0e9
mov byte [ebp - 4], 1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x40]
call fcn.004036a3
mov esi, eax
mov ebx, 0x479dc8
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.004036a3
push esi
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.0040f911
mov esi, eax
neg esi
push edi
sbb esi, esi
push 1
lea ecx, [ebp]
inc esi
call fcn.00403f22
push edi
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00403f22
push 0x479dcc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0040b0e9
mov byte [ebp - 4], 4
push dword [ebp - 0x1c]
lea ecx, [ebp]
call fcn.004036a3
mov edi, eax
push ebx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 5
call fcn.004036a3
push edi
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.0040f911
mov edi, eax
neg edi
push 0
sbb edi, edi
push 1
lea ecx, [ebp - 0x40]
inc edi
call fcn.00403f22
push 0
push 1
lea ecx, [ebp]
mov byte [ebp - 4], 4
call fcn.00403f22
push str.createshorcut
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0040b0e9
mov byte [ebp - 4], 7
push dword [ebp - 0x14]
lea ecx, [ebp]
call fcn.004036a3
mov dword [ebp - 0x18], eax
push ebx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 8
call fcn.004036a3
mov byte [ebp - 4], 9
push dword [ebp - 0x18]
mov ecx, eax
call fcn.0040f911
mov ebx, eax
neg ebx
push 0
sbb ebx, ebx
push 1
lea ecx, [ebp - 0x40]
inc ebx
call fcn.00403f22
push 0
push 1
lea ecx, [ebp]
mov byte [ebp - 4], 7
call fcn.00403f22
call fcn.0040b598
test eax, eax
jne 0x40d5ae
push edi
push ebx
call fcn.0040cc48
pop ecx
pop ecx
test esi, esi
je 0x40d5b9
call fcn.0040662a
xor ebx, ebx
inc ebx
push str._XLInstallProgramXLGamebox.exe
lea ecx, [ebp]
mov dword [eax], ebx
call fcn.004036a3
lea eax, [ebp]
push eax
mov byte [ebp - 4], 0xa
call fcn.0040662a
push eax
call fcn.00406828
call fcn.0040662a
lea ecx, [ebp]
call fcn.00406725
xor eax, eax
push 0x22e
push eax
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push eax
call fcn.00431530
mov ecx, dword [ebp + 4]
add esp, 0xc
cmp dword [ebp + 0x18], 8
jae 0x40d540
lea ecx, [ebp + 4]
lea edx, [ebp + 0x1c]
movzx eax, word [ecx]
inc ecx
mov word [edx], ax
inc ecx
inc edx
inc edx
test ax, ax
jne 0x40d543
lea edi, [ebp + 0x1c]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x40d557
push 0x10
pop ecx
mov esi, str.__b_comefrom_201605304711659338
lea eax, [ebp + 0x1c]
rep movsd dword es:[edi], dword [esi]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x40d572
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp + 0x1c]
push eax
push ebx
push str.XLGamebox
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push connect
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0
push ebx
lea ecx, [ebp]
mov byte [ebp - 4], 7
call fcn.00403f22
jmp 0x40d5b9
push 0
push 1
call fcn.0040cc48
pop ecx
pop ecx
push 0x62
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x477e98
call fcn.004036a3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x24], esp
push 0x479e9c
mov byte [ebp - 4], 0xb
call fcn.004036a3
mov edi, dword [ebp - 0x20]
mov byte [ebp - 4], 7
call fcn.0040bd61
push dword [ebp - 0x14]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
push dword [ebp - 0x1c]
call esi
push dword [ebp - 0x10]
call esi
lea eax, [ebp - 0x7c]
mov dword [ebp - 4], 0xd
call fcn.0040ac87
lea esi, [ebp - 0x5c]
call fcn.0040e16f
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x7c]
push eax
call fcn.0040e0b8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x24c]
xor ecx, ebp
call fcn.0042ea9f
add ebp, 0x250
leave
ret 4