Function at 0x40ac40
Capabilities:
Create thread
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449608
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4611f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040af00
test eax, eax
je 0x40aeb7
call fcn.0040b080
test eax, eax
je 0x40aeb7
mov eax, dword [esi + 4]
lea edi, [esi + 4]
mov ecx, 0x451c88
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40acb6
test dx, dx
je 0x40acb2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40acb6
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ac90
xor eax, eax
jmp 0x40acbb
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
je 0x40acd5
lea ecx, [esi + 0xc]
push edi
call fcn.00414fd0
test eax, eax
je 0x40aeb7
mov ecx, dword [edi]
mov edx, dword [ecx - 0xc]
lea eax, [edx - 1]
test eax, eax
js 0x40aead
cmp eax, edx
jg 0x40aead
cmp word [ecx + eax*2], 0x5c
je 0x40ad39
push 0x455154
mov edx, edi
lea ecx, [ebp - 0x10]
call fcn.0040bce0
add esp, 4
push eax
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.00401a10
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ad39
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [esi + 0x34], 0
je 0x40ad47
lea ecx, [esi + 0xc]
call fcn.00414b60
call fcn.0040bbc0
mov ecx, esi
call fcn.0040b7b0
mov ecx, esi
call fcn.0040b4d0
push edi
lea ecx, [esi + 0x30]
call fcn.00401a10
add esi, 0xc
push ecx
mov ecx, esi
call fcn.004197d0
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
je 0x40ada9
cmp word [0x4649ac], 1
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push str.welcomeBfAppstore
push str.SoftwareBaofengBFVKanDianYingUserConfig
push SysReAllocStringLen
mov dword [ebp - 0x10], 1
je 0x40ada7
mov dword [ebp - 0x10], 2
call edi
mov ecx, esi
call fcn.00419020
mov ecx, esi
call fcn.00416f30
mov ecx, esi
call fcn.00415860
mov ecx, esi
call fcn.00414290
mov ecx, esi
call fcn.0040ff60
mov ecx, esi
call fcn.00410bd0
mov ecx, esi
call fcn.00410750
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push esi
push 0x419100
push 0
push 0
mov dword [esi + 0x29c], eax
call fcn.0043295d
add esp, 0x18
mov ecx, esi
mov dword [esi + 0x2a0], eax
call fcn.00410fc0
mov ecx, esi
call fcn.004115e0
mov ecx, esi
call fcn.004110b0
mov ecx, esi
call fcn.00416d40
mov ecx, esi
call fcn.004174b0
mov ecx, esi
call fcn.00411670
mov ecx, esi
call fcn.004175c0
cmp word [0x4649ac], 1
jne 0x40ae65
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push str.welcome360
push str.SoftwareBaofengBFVKanDianYingUserConfig
push SysReAllocStringLen
mov dword [ebp - 0x10], 1
call edi
call fcn.0041d030
test eax, eax
je 0x40ae75
mov ecx, esi
call fcn.004117a0
call fcn.00416a70
mov ecx, esi
call fcn.00417930
push 0x454db8
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, eax
test esi, esi
je 0x40aee8
mov ecx, 0x69a
call fcn.0041c7a0
push 0
push 0
push 0x69a
jmp 0x40aee1
push 0x80070057
call fcn.004022e0
push 0x454db8
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, eax
test esi, esi
je 0x40aee8
mov ecx, 0x69b
call fcn.0041c7a0
push 0
push 0
push 0x69b
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc