Function at 0x4aeb7c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bc51f
mov eax, dword fs:[0]
push eax
sub esp, 0x548
mov eax, dword [0x4ec06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0044dd35
push 2
pop ecx
imul ecx, ecx, 0
movzx eax, word [eax + ecx + 0x1a0]
test eax, eax
je 0x4aece4
push 0x4cd85c
call fcn.0044dd23
add eax, 4
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0040e762
add esp, 0xc
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x534], eax
and dword [ebp - 4], 0
call fcn.0044dd23
add eax, 0x54
push eax
push dword [ebp - 0x534]
lea eax, [ebp - 0xd0]
push eax
call fcn.0040e840
add esp, 0xc
mov dword [ebp - 0x538], eax
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x53c], eax
mov byte [ebp - 4], 1
push 0x4cd858
push dword [ebp - 0x53c]
lea eax, [ebp - 0xb8]
push eax
call fcn.0040e80d
add esp, 0xc
mov dword [ebp - 0x540], eax
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0x544], eax
mov byte [ebp - 4], 2
call fcn.0044dd35
add eax, 0x1a0
push eax
push dword [ebp - 0x544]
lea eax, [ebp - 0x40]
push eax
call fcn.0040e80d
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xb8]
call fcn.004123b1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xd0]
call fcn.004123b1
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xe8]
call fcn.004123b1
push 0x4cd860
lea ecx, [ebp - 0x28]
call fcn.0041185a
mov byte [ebp - 4], 7
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.0045149c
add esp, 0x14
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
call fcn.004123b1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004123b1
call fcn.0044dd35
cmp dword [eax + 0x198], 0
je 0x4aedf7
lea ecx, [ebp - 0x524]
call fcn.00411071
mov dword [ebp - 4], 8
push 0x4cd8a8
call fcn.0044dd23
add eax, 4
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0040e762
add esp, 0xc
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x54c], eax
mov byte [ebp - 4], 9
push 0x4cd884
push dword [ebp - 0x54c]
lea eax, [ebp - 0x100]
push eax
call fcn.0040e80d
add esp, 0xc
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x554], eax
mov byte [ebp - 4], 0xa
push str.__RebootRunOnce
push dword [ebp - 0x554]
lea eax, [ebp - 0x524]
push eax
call fcn.0040c507
pop ecx
pop ecx
push eax
call fcn.00411005
pop ecx
pop ecx
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x100]
call fcn.004123b1
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x118]
call fcn.004123b1
lea ecx, [ebp - 0x524]
call fcn.00412324
push eax
lea ecx, [ebp - 0x58]
call fcn.0041185a
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x58]
push eax
push 0x4cd8ac
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov ecx, SysReAllocString
call fcn.004229ce
pop ecx
pop ecx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x58]
call fcn.004123b1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x524]
call fcn.0041104c
call fcn.0044dd2f
movzx eax, byte [eax + 1]
test eax, eax
je 0x4aeebc
call fcn.00424e2f
cmp eax, 0xa
jl 0x4aeebc
push 0x4cd924
lea ecx, [ebp - 0x70]
call fcn.0041185a
mov dword [ebp - 4], 0xc
lea eax, [ebp - 0x70]
push eax
call fcn.0044dd23
add eax, 4
mov edx, eax
mov cl, 1
call fcn.0045643f
pop ecx
movzx eax, al
test eax, eax
jne 0x4aee53
mov dword [ebp - 0x52c], 1
jmp 0x4aee5a
and dword [ebp - 0x52c], 0
mov al, byte [ebp - 0x52c]
mov byte [ebp - 0x525], al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.004123b1
movzx eax, byte [ebp - 0x525]
test eax, eax
je 0x4aeebc
push 0x4cd948
lea ecx, [ebp - 0x88]
call fcn.0041185a
mov dword [ebp - 4], 0xd
lea eax, [ebp - 0x88]
push eax
call fcn.0044dd23
add eax, 4
mov edx, eax
mov cl, 1
call fcn.004569f6
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.004123b1
call fcn.0044dd2f
movzx eax, byte [eax + 1]
test eax, eax
je 0x4aef12
call fcn.00424e2f
cmp eax, 0xd
jl 0x4aef12
push str.SogouExplorer.exe
lea ecx, [ebp - 0xa0]
call fcn.0041185a
mov dword [ebp - 4], 0xe
lea eax, [ebp - 0xa0]
push eax
call fcn.0044dd23
add eax, 4
mov edx, eax
mov cl, 1
call fcn.00456a0c
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.004123b1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004690ca
mov esp, ebp
pop ebp
ret