Function at 0x40e130
Capabilities:
Create directory
Persist via run registry key

Disassembly:
sub esp, 0x224
lea eax, [esp]
push ebx
mov dword [esp + 8], ecx
push esi
lea ecx, [esp + 0x1c]
push edi
mov dword [esp + 0xc], 0x104
push ebp
push eax
push ecx
push str.Desktop
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.00409380
add esp, 0x14
test eax, eax
je 0x40e178
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x224
ret
mov edi, str.Connect_to_WebBullet.lnk
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x24]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x2c]
push str.WebBullet_Internet_Service_Internet_Access_Number
push 0x430160
push 0x430160
push eax
call fcn.00409b10
lea ecx, [esp + 0x28]
lea edx, [esp + 0x3c]
mov dword [esp + 0x28], 0x104
add esp, 0x18
push ecx
push edx
push str.Programs
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.00409380
add esp, 0x14
test eax, eax
je 0x40e204
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x224
ret
lea eax, [esp + 0x18]
xor ebx, ebx
mov edi, str.WebBullet
mov ecx, 0xffffffff
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
sub eax, eax
mov dword [esp + 0x18], 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x24]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x24]
push eax
mov edi, str.Connect_to_WebBullet.lnk
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x24]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
push str.WebBullet_Internet_Service_Internet_Access_Number
push 0x430160
lea eax, [esp + 0x34]
push 0x430160
push eax
call fcn.00409b10
lea ecx, [esp + 0x3c]
add esp, 0x18
mov edi, str.Display_Your_Personalized_WebBullet_Settings.lnk
push 0x5c
push ecx
call fcn.0040f530
add esp, 8
lea ebp, [eax + 1]
mov ecx, 0xffffffff
sub eax, eax
mov byte [ebp], bl
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x24]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push str.userinfo.txt
and ecx, 3
push 0x435f29
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x134]
push str._s_s
push eax
call fcn.0040f6c0
add esp, 0x10
lea ecx, [esp + 0x24]
push ebx
lea edx, [esp + 0x130]
push ebx
push ebx
push str.WebBullet_Account_Info
push 0x430160
push 0x430160
push ecx
mov edi, str.WebBullet_Internet_Service_Uninstaller.lnk
push edx
call fcn.00409970
add esp, 0x20
mov ecx, 0xffffffff
sub eax, eax
mov byte [ebp], bl
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x24]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push str.uninstall.wbi
and ecx, 3
push 0x435f29
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x134]
push str._s_s
push eax
call fcn.0040f6c0
add esp, 0x10
lea ecx, [esp + 0x24]
push ebx
lea edx, [esp + 0x130]
push ebx
push ebx
push str.WebBullet_Internet_Service_Uninstall_Program
push 0x430160
push 0x430160
push ecx
push edx
call fcn.00409970
lea ecx, [esp + 0x44]
add esp, 0x20
mov edi, str.Select_New_Local_Access_Number
mov byte [ebp], bl
push ecx
mov ecx, dword [esp + 0x18]
call fcn.0040e4f0
mov ecx, 0xffffffff
sub eax, eax
mov byte [ebp - 1], bl
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x24]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x24]
push eax
mov edi, str.Choose_From_the_Web.url
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x24]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x4366d8
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x28]
push eax
call fcn.0040a180
add esp, 8
mov ebp, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x435e24
push str.CONNECT
push str.TABLE
push str.WEB_BULLET
call ebp
lea ecx, [esp + 0x24]
push 0x5c
push ecx
mov edi, str.Choose_from_the_list_on_you_PC.lnk
call fcn.0040f530
add esp, 8
mov ecx, 0xffffffff
mov byte [eax + 1], bl
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x24]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x2c]
push ebx
push str.Choose_a_new_access_number_from_the_list_already_on_you_PC
push 0x430160
push 0x430160
push eax
push 0x435e24
call fcn.00409970
add esp, 0x20
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x224
ret