Function at 0x408d40
Capabilities:
Persist via run registry key

Disassembly:
push 0xffffffffffffffff
push 0x45f768
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x480aa4]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebp, ecx
call fcn.00408810
test al, al
je 0x409294
lea esi, [ebp + 0xc0]
mov ecx, esi
call fcn.00425100
test al, al
je 0x409294
push 0x4676c8
lea ecx, [esp + 0x18]
call fcn.00402730
push 0x4676c8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x44], 0
call fcn.00402730
push str._Logon
push str.Performance_Center
lea eax, [esp + 0x1c]
push str._s_s
push eax
mov byte [esp + 0x50], 1
call fcn.00402050
mov edx, dword [esp + 0x24]
add esp, 0x10
cmp byte [esp + 0x48], 1
push ecx
mov ecx, esp
mov dword [esp + 0x4c], esp
push edx
jne 0x409007
call fcn.00402730
mov ecx, esi
call fcn.00425190
mov bl, al
lea eax, [esp + 0x20]
push eax
call fcn.00407350
add esp, 4
test bl, bl
mov edi, dword [esp + 0x20]
mov byte [esp + 0x40], 2
jne 0x408e81
push 0x4676c8
lea ecx, [esp + 0x4c]
call fcn.00402730
push edi
lea ecx, [esp + 0x4c]
push str._sApcMain.exe
mov bl, 3
push ecx
mov byte [esp + 0x4c], bl
call fcn.00402050
add esp, 8
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x468024
call fcn.00402730
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
mov byte [esp + 0x4c], 4
call fcn.00401b50
push ecx
lea eax, [esp + 0x54]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
mov byte [esp + 0x50], 5
call fcn.00401b50
push ecx
mov byte [esp + 0x50], 6
mov dword [esp + 0x40], esp
jmp 0x408f27
mov eax, dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.00402730
mov ecx, esi
call fcn.00425790
cmp eax, 1
jne 0x408f4c
mov edx, dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x4c], esp
push edx
call fcn.00402730
mov ecx, esi
call fcn.004256a0
push 0x4676c8
lea ecx, [esp + 0x4c]
call fcn.00402730
push edi
lea eax, [esp + 0x4c]
push str._sApcMain.exe
mov bl, 7
push eax
mov byte [esp + 0x4c], bl
call fcn.00402050
add esp, 8
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x468024
call fcn.00402730
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov byte [esp + 0x4c], 8
call fcn.00401b50
push ecx
lea eax, [esp + 0x54]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
mov byte [esp + 0x50], 9
call fcn.00401b50
push ecx
mov byte [esp + 0x50], 0xa
mov dword [esp + 0x34], esp
mov edx, dword [esp + 0x24]
mov ecx, esp
push edx
call fcn.00402730
mov ecx, esi
mov byte [esp + 0x50], bl
call fcn.00425280
lea ecx, [esp + 0x48]
mov byte [esp + 0x40], 2
call fcn.004016c0
mov eax, dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.00402730
mov ecx, esi
call fcn.00425190
test al, al
jne 0x408fe4
mov ecx, 0x4822c8
call fcn.00406ac0
cmp eax, 6
jne 0x408fe4
lea ecx, [esp + 0x30]
call fcn.0041a690
push 0x4676c8
lea ecx, [esp + 0x4c]
mov byte [esp + 0x44], 0xb
call fcn.00402730
push 0x467f80
push edi
lea ecx, [esp + 0x50]
push str._sLauncher.exe__s
push ecx
mov byte [esp + 0x50], 0xc
call fcn.00402050
mov edx, dword [esp + 0x58]
add esp, 0x10
push edx
push str.Performance_Center
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x40]
call fcn.0041a730
lea ecx, [esp + 0x48]
call fcn.004016c0
lea ecx, [esp + 0x30]
mov byte [esp + 0x40], 2
call fcn.0041a6c0
lea eax, [edi - 0x10]
mov byte [esp + 0x40], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40902f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x40902f
call fcn.00402730
mov ecx, esi
call fcn.00425190
test al, al
je 0x40902f
mov eax, dword [esp + 0x14]
push ecx
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.00402730
mov ecx, esi
call fcn.004256a0
push 0x4676c8
lea ecx, [esp + 0x20]
call fcn.00402730
lea ecx, [esp + 0x48]
push ecx
mov bl, 0xd
mov ecx, ebp
mov byte [esp + 0x44], bl
call fcn.004083d0
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], 0xe
call fcn.004059e0
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
mov byte [esp + 0x40], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409082
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
cmp dword [ecx - 0xc], 0
je 0x409222
push 0x467f98
push 0x467f94
lea ecx, [esp + 0x24]
call fcn.004074d0
mov edx, dword [esp + 0x1c]
push edx
push str.Performance_Center
lea eax, [esp + 0x20]
push 0x467f88
push eax
call fcn.00402050
mov edx, dword [esp + 0x28]
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x4c], esp
push edx
call fcn.00402730
mov ecx, esi
call fcn.00425190
test al, al
jne 0x409153
lea eax, [esp + 0x20]
push eax
call fcn.00407350
add esp, 4
push 0x4676c8
lea ecx, [esp + 0x4c]
mov byte [esp + 0x44], 0xf
call fcn.00402730
mov ecx, dword [esp + 0x20]
push ecx
lea edx, [esp + 0x4c]
push str._sApcMain.exe
mov bl, 0x10
push edx
mov byte [esp + 0x4c], bl
call fcn.00402050
add esp, 8
lea eax, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.00401b50
push ecx
lea edx, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov byte [esp + 0x4c], 0x11
call fcn.00401b50
mov eax, dword [esp + 0x20]
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
mov byte [esp + 0x4c], 0x12
push eax
jmp 0x409200
mov edx, dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x4c], esp
push edx
call fcn.00402730
mov ecx, esi
call fcn.00425790
cmp eax, 1
jne 0x409222
mov eax, dword [esp + 0x18]
push ecx
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.00402730
mov ecx, esi
call fcn.004256a0
lea ecx, [esp + 0x20]
push ecx
call fcn.00407350
add esp, 4
push 0x4676c8
lea ecx, [esp + 0x4c]
mov byte [esp + 0x44], 0x13
call fcn.00402730
mov edx, dword [esp + 0x20]
push edx
lea eax, [esp + 0x4c]
push str._sApcMain.exe
mov bl, 0x14
push eax
mov byte [esp + 0x4c], bl
call fcn.00402050
add esp, 8
lea edx, [esp + 0x24]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.00401b50
push ecx
lea eax, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
mov byte [esp + 0x4c], 0x15
call fcn.00401b50
mov edx, dword [esp + 0x20]
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
mov byte [esp + 0x4c], 0x16
push edx
call fcn.00402730
mov ecx, esi
mov byte [esp + 0x4c], bl
call fcn.004254c0
lea ecx, [esp + 0x48]
call fcn.004016c0
lea ecx, [esp + 0x20]
call fcn.004016c0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x40], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409247
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x40], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40926c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x40], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409294
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 4