Function at 0x40dc50
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
push ebx
push esi
push edi
push 0x4683b4
push 0
call fcn.004474ab
add esp, 8
push 0
call dword [0x4580c4]
mov dword [0x46a6d0], eax
call fcn.0040a360
mov ebx, dword [ebp + 8]
mov word [0x46a6e0], ax
lea eax, [ebp + 0x18]
push eax
push ebx
call fcn.0040e460
mov eax, dword [0x46bb48]
add esp, 8
test eax, eax
jne 0x40dd55
mov eax, dword [0x46bb4c]
test eax, eax
jne 0x40dd61
mov edx, dword [0x46a6d0]
lea ecx, [ebp - 0x104]
push 0x104
push ecx
push 0xfe
push edx
call fcn.0040b8a0
mov al, byte [ebp - 0x104]
add esp, 0x10
test al, al
lea eax, [ebp - 0x104]
jne 0x40dce2
mov eax, str.EBUSetupMutex
push eax
push 0
push 1
push 0
call dword [0x4580c0]
mov dword [0x46bb4c], eax
call dword [0x4582b0]
cmp eax, 0xb7
jne 0x40dd4c
mov eax, dword [0x46bb4c]
push eax
call dword [0x4582b4]
push 0
push str.EBUSetupWnd
call dword [0x458454]
mov esi, eax
test esi, esi
je 0x40dd40
push esi
call dword [0x458458]
neg eax
sbb eax, eax
and eax, 4
add eax, 5
push eax
push esi
call dword [0x458480]
push esi
call dword [0x45845c]
mov eax, 0x2711
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x46bb48]
test eax, eax
je 0x40dd61
mov eax, 0x2711
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp word [0x46a6e0], 0
je 0x40dd7b
push 0
push 0x62
call fcn.0040d5d0
add esp, 8
test eax, eax
je 0x40dd82
mov dword [ebp + 0x18], 1
lea ecx, [ebp - 0x208]
push 0x104
push ecx
push 0
call fcn.004132f0
mov al, byte [0x46ab94]
add esp, 0xc
test al, al
mov eax, 0x46ab94
jne 0x40ddac
lea eax, [ebp - 0x208]
push eax
call fcn.0040a630
mov edi, dword [0x458468]
add esp, 4
push eax
call edi
lea edx, [ebp - 0x104]
mov esi, eax
mov eax, dword [0x46a6d0]
push 0x104
push edx
push 0x16e
push eax
call fcn.0040b8a0
mov al, byte [ebp - 0x104]
add esp, 0x10
test al, al
je 0x40de04
lea ecx, [ebp - 0x104]
push ecx
push esi
call dword [0x4582f8]
test eax, eax
je 0x40de04
mov dword [ebp + 0x18], 1
jmp 0x40de10
mov eax, dword [ebp + 0x18]
mov esi, 1
cmp eax, esi
jne 0x40de26
push 0x104
push 0x46ab94
push 0
call fcn.004132f0
add esp, 0xc
jmp 0x40de7a
mov al, byte [0x46ab94]
test al, al
jne 0x40de7a
push ebx
call fcn.00410af0
add esp, 4
cmp eax, esi
jne 0x40de63
mov edx, dword [0x46bb4c]
push 0xffffffffffffffff
push edx
call dword [0x4582f0]
mov eax, dword [0x46bb4c]
push eax
call dword [0x4582b4]
mov eax, 0x2711
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x104
push 0x46ab94
push 0
call fcn.004132f0
add esp, 0xc
mov dword [ebp + 0x18], esi
mov edx, dword [ebp + 0x18]
xor ecx, ecx
test edx, edx
mov edx, dword [ebp + 0x14]
push 0x46ab94
sete cl
mov dword [0x46a69c], ecx
mov dword [0x46a6dc], edx
call fcn.0040a630
add esp, 4
push eax
call edi
mov edi, dword [0x4582e4]
mov esi, eax
push esi
push 0x46ac9c
call edi
push 0x46ab94
mov byte [esi], 0
call fcn.00413380
push str.EBUSetup.sem
call fcn.0040a2a0
add esp, 8
test eax, eax
je 0x40dee1
push 0
push 0x62
call fcn.0040d5d0
add esp, 8
test eax, eax
je 0x40def6
call fcn.004180b0
test eax, eax
jne 0x40def6
mov eax, 0x2711
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x10]
push esi
push 0x400
call fcn.0040a6a0
add esp, 8
test eax, eax
jne 0x40df40
mov al, byte [0x46a884]
test al, al
je 0x40e3d1
push 0x46a884
call fcn.00413380
push esi
push 0x400
call fcn.0040a6a0
add esp, 0xc
test eax, eax
jne 0x40df40
mov eax, 0x2711
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
mov ecx, 0x46a5a8
call fcn.00419950
mov byte [ebp + 0xb], al
pop ebx
push 1
push 0x7e4
call fcn.0040d5d0
push 1
push 0x7e8
mov dword [0x46a6a0], eax
call fcn.0040d5d0
mov dword [0x46b9e0], eax
mov al, byte [0x46a884]
add esp, 0x10
test al, al
je 0x40e03f
push 0x46a884
push 0x46ab94
call edi
push 0x46a884
call fcn.0040a630
mov esi, eax
add esp, 4
test esi, esi
je 0x40dfc4
mov ebx, dword [0x458468]
push esi
call ebx
cmp byte [eax], 0
jne 0x40dfca
push esi
push 0x46a884
call dword [0x458420]
cmp byte [eax], 0x3a
je 0x40dfca
mov byte [esi], 0
jmp 0x40dfca
mov ebx, dword [0x458468]
mov ecx, dword [0x46a6d4]
lea eax, [ebp - 0x104]
push 0x104
push eax
push ecx
call fcn.004132f0
lea edx, [ebp - 0x30c]
push 0x104
push edx
call fcn.0040a320
lea eax, [ebp - 0x104]
push eax
call fcn.0040a630
add esp, 0x18
push eax
call ebx
lea ecx, [ebp - 0x30c]
push eax
push ecx
call dword [0x458270]
lea edx, [ebp - 0x30c]
push edx
push 0x46aa8c
call edi
push 0x104
push 0x46aa8c
call fcn.0040ad90
add esp, 8
mov dword [0x46ab90], 1
jmp 0x40e045
mov ebx, dword [0x458468]
push str.DISK1
push 0x46ab94
call fcn.0040d0d0
add esp, 8
test eax, eax
je 0x40e06b
push 0x45dc44
push eax
call fcn.0040d0d0
add esp, 8
jmp 0x40e06d
xor eax, eax
mov dword [0x46ac98], eax
call fcn.0040bcd0
mov dword [0x46a668], eax
mov eax, dword [ebp + 0xc]
push 0
push 0x62
mov dword [0x46a66c], edx
mov dword [0x46a6fc], eax
call fcn.0040d5d0
add esp, 8
test eax, eax
jne 0x40e111
call fcn.0040d9a0
test eax, eax
jne 0x40e111
mov eax, dword [0x46a6d4]
lea ecx, [ebp - 0x104]
push 0x104
push ecx
push 0x16c
push eax
call fcn.0040b8a0
add esp, 0x10
test eax, eax
je 0x40e0da
lea edx, [ebp - 0x104]
push edx
call fcn.00446a39
add esp, 4
mov dword [0x46a67c], eax
mov eax, dword [0x46a6d4]
lea ecx, [ebp - 0x104]
push 0x104
push ecx
push 0x16d
push eax
call fcn.0040b8a0
add esp, 0x10
test eax, eax
je 0x40e111
lea edx, [ebp - 0x104]
push edx
call fcn.00446a39
add esp, 4
mov dword [0x46a678], eax
mov eax, dword [0x46a6d4]
push 0x80
push 0x46b4bc
push 0x142
push eax
call fcn.0040b8a0
mov ecx, dword [0x46a6d4]
push 0x80
push 0x46a804
push 0x141
push ecx
call fcn.0040b8a0
mov al, byte [ebp + 0xb]
add esp, 0x20
test al, al
jne 0x40e166
mov edx, dword [0x46a6dc]
push 0x149
push 0x40
push edx
call fcn.0040a450
add esp, 0xc
mov eax, dword [ebp + 0x1c]
push eax
call fcn.00418d30
mov edx, dword [0x46a6d4]
lea ecx, [ebp - 0x104]
push 0x104
push ecx
push 0x16e
push edx
call fcn.0040b8a0
mov al, byte [ebp - 0x104]
add esp, 0x14
test al, al
je 0x40e33a
mov esi, dword [0x4582f8]
lea eax, [ebp - 0x104]
push eax
push 0x46ac9c
call esi
test eax, eax
je 0x40e33a
mov edx, dword [0x46a6d4]
lea ecx, [ebp - 0x30c]
push 0x104
push ecx
push 0x24
push edx
call fcn.0040b8a0
lea eax, [ebp - 0x410]
push 0x104
push eax
lea ecx, [ebp - 0x30c]
push 0x4683b4
push ecx
push 0x46b0ac
push 0x80000002
call fcn.004191e0
mov al, byte [ebp - 0x410]
add esp, 0x28
test al, al
je 0x40e2dd
lea edx, [ebp - 0x410]
push edx
call fcn.0040a630
mov esi, eax
add esp, 4
test esi, esi
je 0x40e22b
push esi
call ebx
cmp byte [eax], 0
jne 0x40e22b
mov byte [esi], 0
push str.EBUSetup.sem
call fcn.0040a2a0
add esp, 4
test eax, eax
je 0x40e29a
mov al, byte [0x46a884]
test al, al
jne 0x40e29a
lea eax, [ebp - 0x410]
lea ecx, [ebp - 0x30c]
push eax
push ecx
call edi
push 0x46aa8c
call fcn.0040a630
add esp, 4
lea edx, [ebp - 0x30c]
push eax
push edx
call dword [0x458270]
lea eax, [ebp - 0x30c]
push eax
push 0x46aa8c
call edi
push 0x104
push 0x46aa8c
call fcn.0040ad90
add esp, 8
mov dword [0x46ab90], 1
lea ecx, [ebp - 0x410]
push ecx
push 0x46ab94
call edi
lea edx, [ebp - 0x410]
push edx
call fcn.0040a630
mov esi, eax
add esp, 4
test esi, esi
je 0x40e325
push esi
call ebx
cmp byte [eax], 0
jne 0x40e325
lea eax, [ebp - 0x410]
push esi
push eax
call dword [0x458420]
cmp byte [eax], 0x3a
je 0x40e325
mov byte [esi], 0
jmp 0x40e325
mov edx, dword [0x46a6d4]
lea ecx, [ebp - 0x208]
push 0x104
push ecx
push 0x16f
push edx
call fcn.0040b8a0
add esp, 0x10
lea eax, [ebp - 0x30c]
lea ecx, [ebp - 0x208]
push eax
push ecx
call esi
test eax, eax
jne 0x40e325
mov dword [0x46a6ac], eax
mov eax, 1
mov dword [0x46a6a8], eax
mov dword [0x46a6a4], eax
mov eax, dword [0x46a6ac]
test eax, eax
je 0x40e33a
xor eax, eax
mov dword [0x46a6a4], eax
mov dword [0x46a6a8], eax
lea edx, [ebp - 0x208]
push 0x104
push edx
call dword [0x4582e0]
lea eax, [ebp - 0x208]
push eax
call fcn.00413380
mov eax, dword [0x46a6ac]
xor esi, esi
add esp, 4
cmp eax, esi
jne 0x40e3dd
cmp dword [0x46a6a8], esi
jne 0x40e3dd
lea ecx, [ebp - 0x104]
push 0x104
push ecx
push 0x4683b4
push str.EBUReboot
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call fcn.004191e0
mov ecx, dword [0x46a6c4]
add esp, 0x18
movsx eax, byte [ebp - 0x104]
cmp ecx, esi
je 0x40e3ae
mov dword [0x46a6c8], eax
jmp 0x40e3b3
mov dword [0x46a6c0], eax
cmp dword [0x46a6c0], esi
je 0x40e3dd
mov edx, dword [0x46a6dc]
push 0xd1
push 0x40
push edx
call fcn.0040a450
add esp, 0xc
mov eax, 0x2711
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x46a6d4]
push 4
push 0x46b7c4
push 0xc8
push eax
call fcn.0040b8a0
add esp, 0x10
push 0x46a700
push 0x46b6c0
call edi
call dword [0x4584cc]
xor ecx, ecx
push 0x104
cmp ecx, eax
mov ecx, dword [0x46a6d4]
lea eax, [ebp - 0x514]
mov dword [0x46a6e8], esi
sbb edx, edx
push eax
neg edx
push 0x173
push ecx
mov dword [0x46a694], edx
mov dword [0x46a654], esi
call fcn.0040b8a0
add esp, 0x10
lea edx, [ebp - 0x514]
push edx
push 0x46b8c8
call edi
pop edi
pop esi
mov eax, 0x2710
pop ebx
mov esp, ebp
pop ebp
ret