Function at 0x40e3bb
Capabilities:
Persist via run registry key

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x43b028]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xdc
mov eax, 0x4255fb
call fcn.004239ba
push str.Systweak
lea ecx, [ebp - 0x44]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
xor ebx, ebx
push 0x42a130
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
lea eax, [ebp - 0x10]
push 0x42a230
push eax
lea esi, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.00404b39
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00404693
add esp, 0x10
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
xor eax, eax
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
call sub.mfc90u.dll_AfxGetModuleState
mov eax, dword [eax + 8]
push 0x104
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x38]
call dword [0x4299ec]
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 5
call dword [sym.imp.ASOHelper.dll_int___cdecl_STGetExecutablePath_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____]
pop ecx
call dword [sym.imp.ASOHelper.dll_unsigned_long_int___cdecl__winmajor_void_]
cmp eax, 6
jb 0x40e59c
lea esi, [ebp - 0xe8]
call fcn.00401c1d
mov byte [ebp - 4], 6
fldz
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
push ecx
push ecx
fstp qword [esp]
call dword [sym.imp.OLEAUT32.dll_UnRegisterTypeLib]
push 0x30
pop eax
mov word [ebp - 0x74], ax
mov ax, word [ebp - 0x28]
mov word [ebp - 0x70], ax
mov ax, word [ebp - 0x26]
mov word [ebp - 0x6e], ax
mov ax, word [ebp - 0x22]
mov word [ebp - 0x6c], ax
mov eax, 0x833
push 0xc
mov word [ebp - 0x6a], ax
pop eax
mov word [ebp - 0x68], ax
push 0x1f
pop eax
mov word [ebp - 0x66], ax
xor eax, eax
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov word [ebp - 0x46], ax
mov dword [ebp - 0x54], 7
cmp dword [ebp + 0x214], ebx
je 0x40e583
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x94]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x8c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator]
push dword [ebp - 0x38]
lea ecx, [ebp - 0x88]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator]
lea eax, [ebp - 0x10]
push eax
call fcn.0040e32f
mov byte [ebp - 4], 7
push dword [eax]
lea ecx, [ebp - 0x84]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
push 0xc
pop ecx
push dword [ebp - 0x14]
lea esi, [ebp - 0x74]
lea edi, [ebp - 0xc4]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0xe8]
call fcn.00401d31
jmp 0x40e58c
push dword [ebp - 0x14]
call fcn.00401fdf
pop ecx
lea ecx, [ebp - 0xe8]
call fcn.00401ce8
jmp 0x40e717
lea eax, [ebp - 0x3c]
mov esi, SysReAllocString
lea ecx, [ebp - 0x34]
push eax
mov dword [ebp - 0x3c], esi
call dword [sym.imp.ASOHelper.dll_public:_void___thiscall_CRegistry::constructor_struct_HKEY____const_const__]
cmp dword [ebp + 0x214], ebx
je 0x40e694
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
mov byte [ebp - 4], 9
mov edi, dword [sym.imp.ASOHelper.dll_public:_int___thiscall_CRegistry::Open_struct_HKEY_____wchar_t_const___bool_]
push 1
push dword [ebp - 0x18]
lea ebx, [esi + 1]
push ebx
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x30], 0x2001f
call edi
test eax, eax
je 0x40e607
push dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
call dword [sym.imp.ASOHelper.dll_public:_int___thiscall_CRegistry::DeleteValue_wchar_t_const__]
lea ecx, [ebp - 0x34]
call dword [sym.imp.ASOHelper.dll_public:_void___thiscall_CRegistry::Close_void_]
push 1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x34]
push esi
call edi
test eax, eax
je 0x40e62b
push dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
call dword [sym.imp.ASOHelper.dll_public:_int___thiscall_CRegistry::DeleteValue_wchar_t_const__]
lea ecx, [ebp - 0x34]
call dword [sym.imp.ASOHelper.dll_public:_void___thiscall_CRegistry::Close_void_]
lea ecx, [ebp - 0x10]
call dword [0x4299ec]
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push str.__s_
push eax
mov byte [ebp - 4], 0xa
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
add esp, 0xc
push 1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x34]
push ebx
call edi
lea ecx, [ebp - 0x34]
test eax, eax
jne 0x40e66f
push 1
push dword [ebp - 0x18]
push esi
call edi
test eax, eax
je 0x40e686
lea ecx, [ebp - 0x34]
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ASOHelper.dll_public:_int___thiscall_CRegistry::WriteString_wchar_t_const___wchar_t_const___bool_]
lea ecx, [ebp - 0x34]
call dword [sym.imp.ASOHelper.dll_public:_void___thiscall_CRegistry::Close_void_]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x18]
jmp 0x40e704
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xb
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
mov byte [ebp - 4], 0xc
mov edi, dword [sym.imp.ASOHelper.dll_public:_int___thiscall_CRegistry::Open_struct_HKEY_____wchar_t_const___bool_]
push 1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x34]
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x30], 0x2001f
call edi
mov ebx, dword [sym.imp.ASOHelper.dll_public:_int___thiscall_CRegistry::DeleteValue_wchar_t_const__]
test eax, eax
je 0x40e6e1
push dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
call ebx
lea ecx, [ebp - 0x34]
call dword [sym.imp.ASOHelper.dll_public:_void___thiscall_CRegistry::Close_void_]
push 1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x34]
push esi
call edi
test eax, eax
je 0x40e701
push dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
call ebx
lea ecx, [ebp - 0x34]
call dword [sym.imp.ASOHelper.dll_public:_void___thiscall_CRegistry::Close_void_]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 5
call dword [sym.imp.ASOHelper.dll_public_virtual:_void___thiscall_CRegistry::destructor_void_]
lea ecx, [ebp - 0x38]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x40]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [ebp - 0x44]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00423038
add ebp, 0x20c
leave
ret 4