Function at 0x403920
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55d4d4
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x5c0db0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
mov esi, ecx
call fcn.0040d8ce
lea eax, [ebp - 0x114]
push eax
mov ecx, esi
call fcn.00402f90
lea eax, [ebp - 0x114]
dec eax
xor ebx, ebx
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x403970
mov ecx, dword [str.info.ini]
mov edx, dword [0x56caa0]
mov dword [eax], ecx
mov cl, byte [0x56caa4]
mov dword [eax + 4], edx
mov byte [eax + 8], cl
lea edx, [ebp - 0x114]
push ecx
mov ecx, esp
mov dword [ebp - 0x21c], esp
push edx
call fcn.00403860
lea ecx, [ebp - 0x238]
call fcn.00403730
push ecx
mov dword [ebp - 4], ebx
mov ecx, esp
cmp dword [esi + 0x9c], ebx
je 0x4039fb
mov dword [ebp - 0x21c], esp
push str.xeim_user_info
call fcn.00403860
push ecx
mov ecx, esp
mov dword [ebp - 0x224], esp
push str.autorun
mov byte [ebp - 4], 1
call fcn.00403860
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
mov byte [ebp - 4], 2
push 0x56ca80
jmp 0x403a34
mov dword [ebp - 0x220], esp
push str.xeim_user_info
call fcn.00403860
push ecx
mov ecx, esp
mov dword [ebp - 0x224], esp
push str.autorun
mov byte [ebp - 4], 3
call fcn.00403860
push ecx
mov ecx, esp
mov dword [ebp - 0x21c], esp
mov byte [ebp - 4], 4
push 0x56ca7c
call fcn.00403860
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], bl
call fcn.00403ef0
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push str.xeim_user_info
cmp dword [esi + 0x98], ebx
je 0x403a8d
call fcn.00403860
push ecx
mov ecx, esp
mov dword [ebp - 0x224], esp
push str.remember_me
mov byte [ebp - 4], 5
call fcn.00403860
push ecx
mov ecx, esp
mov dword [ebp - 0x21c], esp
mov byte [ebp - 4], 6
push 0x56ca80
jmp 0x403b0a
call fcn.00403860
push ecx
mov ecx, esp
mov dword [ebp - 0x224], esp
push str.remember_me
mov byte [ebp - 4], 7
call fcn.00403860
push ecx
mov ecx, esp
mov dword [ebp - 0x21c], esp
push 0x56ca7c
mov byte [ebp - 4], 8
call fcn.00403860
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], bl
call fcn.00403ef0
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push str.xeim_user_info
call fcn.00403860
push ecx
mov ecx, esp
mov dword [ebp - 0x224], esp
push str.password
mov byte [ebp - 4], 9
call fcn.00403860
push ecx
mov ecx, esp
mov dword [ebp - 0x21c], esp
mov byte [ebp - 4], 0xa
push 0x56c4e8
call fcn.00403860
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], bl
call fcn.00403ef0
push ebx
lea ecx, [ebp - 0x25c]
call fcn.00404bc0
push ebx
push 3
push reloc.WS2_32.dll_accept
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x25c]
mov byte [ebp - 4], 0xb
call fcn.00405860
test al, al
je 0x403bd4
push str.xeim
lea ecx, [ebp - 0x25c]
call fcn.004050d0
cmp byte [eax + 0x11], bl
je 0x403b8e
cmp dword [esi + 0x94], ebx
jne 0x403bc7
push str.xeim
lea ecx, [ebp - 0x25c]
call fcn.004050d0
mov ecx, eax
call fcn.00405a00
lea ecx, [ebp - 0x25c]
call fcn.00404820
jmp 0x403be7
cmp dword [esi + 0x94], ebx
je 0x403bc7
push 0x104
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x218]
push ecx
push str.xeim
lea ecx, [ebp - 0x25c]
call fcn.004050d0
mov ecx, eax
call fcn.00404980
lea ecx, [ebp - 0x25c]
call fcn.00404820
jmp 0x403be7
push 0x10
push str.Error
push str.Unable_to_open_key_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [esi]
mov eax, dword [edx + 0x60]
mov ecx, esi
call eax
lea ecx, [ebp - 0x25c]
mov byte [ebp - 4], bl
call fcn.00403650
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], 0xffffffff
call fcn.004033c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005087f8
mov esp, ebp
pop ebp
ret