Function at 0x404ae0
Capabilities:
Delete registry value
Persist via run registry key
Reference cloudflare dns server

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b63ee
mov eax, dword fs:[0]
push eax
sub esp, 0xfd8
mov eax, dword [0x4f4930]
xor eax, esp
mov dword [esp + 0xfd0], eax
push ebx
push esi
push edi
mov eax, dword [0x4f4930]
xor eax, esp
push eax
lea eax, [esp + 0xfe8]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x18], esi
mov dword [0x4fe13c], 1
mov byte [esp + 0x14], 0
mov dword [esp + 0x10], ebx
mov dword [esp + 0xff0], ebx
mov eax, dword [esi]
cmp eax, 1
jne 0x404b72
lea eax, [esi + 0x804]
push eax
lea ecx, [esi + 0x404]
push ecx
lea edx, [esi + 4]
push edx
push ecx
call fcn.00401760
add esp, 4
lea ebx, [esp + 0x1c]
call fcn.00459b30
jmp 0x405305
cmp eax, 2
je 0x405327
cmp eax, 3
je 0x405339
cmp eax, 4
jne 0x404ba9
lea eax, [esi + 0x404]
push eax
lea ecx, [esi + 4]
push ecx
call fcn.00401760
lea edi, [esp + 0x18]
mov ebx, eax
call fcn.00459aa0
jmp 0x405305
cmp eax, 5
jne 0x404dd6
lea edx, [esp + 0x20]
push edx
push 0x4cbae8
push SysReAllocString
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, ebx
jne 0x404bee
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x404bee
push str.ImeGuardCom
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x15c]
call fcn.0041ead0
lea ecx, [esp + 0x5d4]
call fcn.0041ead0
lea ecx, [esp + 0x3ac]
call fcn.0041ead0
lea ecx, [esp + 0x3ac]
push ecx
push ecx
mov byte [esp + 0xff8], 3
call fcn.00401760
add esp, 4
lea ebx, [esp + 0x5d8]
lea edi, [esp + 0x160]
mov esi, eax
call fcn.0045a460
test al, al
jne 0x404c4d
lea ecx, [esp + 0x10]
call fcn.0041a4d0
lea ecx, [esp + 0x34]
call fcn.0041ead0
lea edx, [esp + 0x34]
push edx
mov byte [esp + 0xff4], 4
call fcn.0040c8c0
lea esi, [esp + 0x34]
call fcn.0040ce30
lea ecx, [esp + 0x284]
call fcn.0041ead0
mov ecx, esi
mov byte [esp + 0xff0], 5
call fcn.0041c370
push eax
lea ecx, [esp + 0x3b0]
call fcn.0041c370
push eax
lea ecx, [esp + 0x5dc]
call fcn.0041c370
push eax
lea ecx, [esp + 0x168]
call fcn.0041c370
push eax
push str.http:__ping.pinyin.sogou.com_component.gif_h_sv_sr_sttcmu_s
lea edi, [esp + 0x298]
call fcn.0041f0a0
add esp, 0x14
mov ecx, edi
call fcn.0041c370
push eax
call fcn.00401c90
call fcn.0040cba0
call fcn.0040c530
mov ecx, edi
call fcn.0041ec80
mov ecx, esi
call fcn.0041ec80
lea ecx, [esp + 0x3ac]
call fcn.0041ec80
lea ecx, [esp + 0x5d4]
call fcn.0041ec80
lea ecx, [esp + 0x15c]
mov byte [esp + 0xff0], 0
call fcn.0041ec80
lea ecx, [esp + 0x10]
call fcn.0040d350
mov bl, al
mov byte [esp + 0x30], 0
mov dword [esp + 0x2c], 0
lea eax, [esp + 0x2c]
push eax
push ecx
mov byte [esp + 0xff8], 6
call fcn.00401760
add esp, 4
call fcn.00459e80
test bl, bl
jne 0x404d65
mov ecx, dword [esp + 0x18]
cmp byte [ecx + 0x1010], bl
jne 0x404d65
lea edi, [esp + 0x10]
call fcn.0041a680
lea edx, [esp + 0x10]
push edx
push ecx
call fcn.00401760
add esp, 4
mov ecx, eax
call fcn.0045d000
test al, al
jne 0x404d87
lea ecx, [esp + 0x10]
call fcn.0041a4d0
lea ecx, [esp + 0x2c]
call fcn.0041a420
mov esi, dword [esp + 0x18]
push esi
call fcn.0046fda3
add esp, 4
lea ecx, [esp + 0x10]
mov dword [0x4fe13c], 0
call fcn.0041a420
mov al, 1
mov ecx, dword [esp + 0xfe8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xfd0]
xor ecx, esp
call fcn.0046fdae
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x404de2
call fcn.00405370
jmp 0x404d94
cmp eax, 7
jne 0x404e33
lea eax, [esp + 0x10]
push eax
push ecx
call fcn.00401760
add esp, 4
call fcn.00459bd0
test al, al
jne 0x404e0f
cmp byte [esi + 0x1010], al
jne 0x404e0f
lea edi, [esp + 0x10]
call fcn.0041a680
call fcn.004057d0
mov eax, dword [0x4fb764]
cmp eax, ebx
je 0x404d94
mov ecx, dword [eax + 0x124]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x404d94
cmp eax, 8
je 0x4052ea
cmp eax, 9
je 0x4052e7
cmp eax, 0xa
je 0x404d94
cmp eax, 0xb
jne 0x404e98
lea edx, [esi + 4]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.00401760
mov ecx, eax
call fcn.00458b40
test al, al
jne 0x404d94
cmp byte [esi + 0x1010], al
jne 0x404d94
push 0x4cbad8
lea ecx, [esp + 0x14]
call fcn.00403120
lea edi, [esp + 0x10]
call fcn.0041a680
jmp 0x404d94
cmp eax, 0xc
jne 0x404f36
lea ebx, [esi + 0x404]
add esi, 4
push esi
push ecx
mov dword [esp + 0x28], esi
call fcn.00401760
add esp, 4
mov ecx, ebx
lea edi, [esp + 0x14]
mov esi, eax
call fcn.00458e00
test al, al
jne 0x404eef
mov ecx, dword [esp + 0x18]
cmp byte [ecx + 0x1010], al
jne 0x404d90
push 0x4cbbe8
mov ecx, edi
call fcn.00403120
call fcn.0041a680
jmp 0x404d90
mov edx, dword [esp + 0x18]
test byte [edx + 0x1004], 8
je 0x404d90
push 1
push ebx
call fcn.00401760
mov esi, dword [esp + 0x28]
push eax
mov ecx, esi
call fcn.0045ff70
call fcn.00401760
mov ecx, eax
call fcn.0045fce0
push esi
push ecx
call fcn.00401760
add esp, 4
mov edi, ebx
call fcn.0045e420
jmp 0x404d90
cmp eax, 0xd
jne 0x404d94
lea ecx, [esp + 0x28]
lea eax, [esi + 0x404]
push ecx
lea edi, [esi + 4]
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], edi
call fcn.00401760
push eax
mov eax, edi
call fcn.00459940
mov ecx, dword [esp + 0x28]
xor bl, bl
mov dword [esp + 0x2c], eax
test ecx, ecx
je 0x405028
test eax, eax
je 0x405028
push 0
push ecx
lea edx, [esp + 0x18]
push edx
push ecx
call fcn.00401760
mov esi, dword [esp + 0x3c]
add esp, 4
push eax
call fcn.00459050
test al, al
je 0x405024
mov eax, dword [esp + 0x28]
push eax
push ecx
call fcn.00401760
add esp, 4
push eax
mov bl, 1
mov eax, esi
lea ecx, [esp + 0x18]
call fcn.00458d30
test al, al
jne 0x404fc8
xor bl, bl
jmp 0x405024
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0x1004]
test al, 1
je 0x404fef
mov ecx, dword [esp + 0x24]
push str._restart
push ecx
call fcn.00401760
push eax
mov ecx, edi
call fcn.004602d0
jmp 0x405022
test al, 0x10
je 0x40500e
mov edx, dword [esp + 0x24]
add ecx, 0x804
push ecx
push edx
call fcn.00401760
push eax
mov ecx, edi
call fcn.004602d0
jmp 0x405022
mov eax, dword [esp + 0x24]
push 1
push eax
call fcn.00401760
push eax
mov ecx, edi
call fcn.0045ff70
mov bl, 1
mov esi, dword [esp + 0x18]
mov eax, dword [esi + 0x1004]
shr eax, 1
and al, 1
mov byte [esp + 0x1f], al
test bl, bl
jne 0x40527f
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0x7e6]
push edx
mov word [esp + 0x7e8], cx
call fcn.00476c30
add esp, 0xc
xor eax, eax
push 0x7e
push eax
lea ecx, [esp + 0x55e]
push ecx
mov word [esp + 0x560], ax
call fcn.00476c30
add esp, 0xc
xor edx, edx
push 0x7e
push edx
lea eax, [esp + 0x4de]
push eax
mov word [esp + 0x4e0], dx
call fcn.00476c30
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x5de]
push edx
mov word [esp + 0x5e0], cx
call fcn.00476c30
add esp, 0xc
call fcn.00401760
call fcn.0045c010
push eax
push str._sSGTool.exe
lea eax, [esp + 0x5dc]
push 0x104
push eax
call fcn.0046fdbd
add esp, 0x10
lea ecx, [esp + 0x34]
call fcn.0041ead0
lea eax, [esp + 0x5d4]
lea edx, [esp + 0x34]
call fcn.0041ed00
mov byte [esp + 0xff0], 8
test edi, edi
je 0x4051a2
lea ecx, [esp + 0x7dc]
push ecx
push str.1.0.0.1
push edi
lea edx, [esp + 0x4e0]
lea ecx, [esp + 0x560]
call fcn.0040b2a0
test al, al
je 0x4051a2
lea ecx, [esp + 0x15c]
call fcn.0041ead0
mov edx, dword [esp + 0x24]
movzx eax, byte [esp + 0x1f]
push edx
push edi
push eax
lea ecx, [esp + 0x4e0]
push ecx
lea edx, [esp + 0x7ec]
push edx
lea eax, [esp + 0x568]
push eax
push str.__line_2__border_0__upc__p__s___p__s___p__s___p__d___p__s___p__s_
lea edi, [esp + 0x178]
mov byte [esp + 0x100c], 9
call fcn.0041f0a0
add esp, 0x1c
mov ecx, edi
call fcn.0041c370
push 5
push eax
lea ecx, [esp + 0x18]
push ecx
mov edx, 0x4cb53c
lea ecx, [esp + 0x40]
call fcn.0041d840
mov ecx, edi
mov bl, 1
call fcn.0041ec80
jmp 0x40526a
push str.sogouflashbundle
push edi
call fcn.0046ff94
add esp, 8
test eax, eax
jne 0x4051bd
push 5
push 0x4cb878
jmp 0x405235
push str.handinputbundle
push edi
call fcn.0046ff94
add esp, 8
test eax, eax
jne 0x4051ee
push 5
push 0x4cb8f8
lea eax, [esp + 0x18]
push eax
mov edx, 0x4cb53c
lea ecx, [esp + 0x40]
call fcn.0041d840
jmp 0x40526e
push str.mousegesturebundle
push edi
call fcn.0046ff94
add esp, 8
test eax, eax
jne 0x40521c
push 5
push 0x4cb978
lea ecx, [esp + 0x18]
push ecx
mov edx, 0x4cb53c
lea ecx, [esp + 0x40]
call fcn.0041d840
jmp 0x40526e
push str.skinboxbundle
push edi
call fcn.0046ff94
add esp, 8
test eax, eax
jne 0x40524a
push 5
push str.__line_2__border_0__upc__p_
lea edx, [esp + 0x18]
push edx
mov edx, 0x4cb53c
lea ecx, [esp + 0x40]
call fcn.0041d840
jmp 0x40526e
cmp byte [esi + 0x1010], 0
jne 0x40526e
push 0x4cbd40
lea ecx, [esp + 0x14]
call fcn.00403120
lea edi, [esp + 0x10]
call fcn.0041a680
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x34]
mov byte [esp + 0xff0], 0
call fcn.0041ec80
mov eax, dword [esp + 0x24]
lea edx, [esi + 0x804]
push eax
mov ecx, edi
call fcn.00406120
add esp, 4
test bl, bl
je 0x404d94
cmp byte [esp + 0x1f], 0
je 0x404d94
mov ecx, dword [esp + 0x24]
push str.screencaptureCom
push ecx
call fcn.0046ff94
add esp, 8
test eax, eax
jne 0x404d94
push 0x4cbd78
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x404d94
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x404d94
cmp eax, 8
sete dl
movzx eax, dl
push eax
push ecx
call fcn.00401760
mov ecx, eax
add esp, 4
lea eax, [esp + 0x14]
call fcn.00458e60
test al, al
jne 0x404d94
cmp byte [esi + 0x1010], al
jne 0x404d94
lea edi, [esp + 0x10]
call fcn.0041a680
jmp 0x404d94
test byte [esi + 0x1004], 4
mov eax, 0
setne al
inc eax
jmp 0x40533e
mov eax, 5
movzx ecx, byte [esi + 0x1010]
push ecx
mov cl, byte [esi + 0x1011]
lea edx, [esi + 0x804]
push edx
lea edx, [esp + 0x18]
call fcn.00405890
jmp 0x404d94