Function at 0x40a7e0
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x21c
mov eax, dword [str._q_]
xor eax, esp
push ebx
push esi
mov dword [esp + 0x220], eax
lea eax, [esp + 0x10]
push eax
push str.DisplayName
xor ebx, ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallRealVNC_is1
push 0x80000002
mov esi, ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebx
call fcn.00401cc0
lea ecx, [esp + 0x24]
push ecx
push str.Version40k1
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallRealVNC_is1
push 0x80000002
call fcn.00401cc0
lea edx, [esp + 0x28]
push edx
push str.Inno_Setup:_App_Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallRealVNC_is1
push 0x80000002
call fcn.00401cc0
mov eax, dword [esp + 0x38]
add esp, 0x30
cmp eax, ebx
je 0x40aa07
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40a863
sub eax, edx
mov dword [esp + 0xc], eax
je 0x40aa07
mov eax, dword [esi]
push str.Found_WinVNC._Remove_from_the_system.
push eax
call fcn.00404120
mov ecx, dword [esi]
mov eax, dword [ecx + 0x54]
add esp, 8
cmp eax, ebx
push str.WinVNC4
je 0x40a89b
call fcn.00401460
jmp 0x40a8a0
call fcn.00402d60
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 8]
push edx
lea eax, [esp + 0x120]
push str._sWinVNC4.exe
push eax
mov dword [esp + 0x18], ebx
call fcn.0040f6f9
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x12c]
push edx
call fcn.004038a0
add esp, 0x14
test eax, eax
jne 0x40a8f8
cmp dword [esp + 0xc], ebx
je 0x40a8f8
lea eax, [esp + 0x11c]
push eax
call fcn.00403960
add esp, 4
push str.SystemCurrentControlSetServicesWinVNC4
push 0x80000002
call fcn.00401bc0
push str.WinVNC4
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
call fcn.00401b50
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallRealVNC_is1
push 0x80000002
call fcn.00401bc0
push str.SOFTWARERealVNC
push 0x80000002
call fcn.00401bc0
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00402a20
mov edx, dword [esp + 0x30]
push edx
lea eax, [esp + 0x44]
push str._slogmessages.dll
push eax
call fcn.0040f6f9
lea ecx, [esp + 0x4c]
push ecx
call fcn.0040dd50
add esp, 0x38
test eax, eax
je 0x40a974
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.0040a790
mov eax, dword [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push str._swm_hooks.dll
push ecx
call fcn.0040f6f9
lea edx, [esp + 0x24]
push edx
call fcn.0040dd50
add esp, 0x10
test eax, eax
je 0x40a9a5
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.0040a790
mov ecx, dword [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push str._s_vncconfig.exe
push edx
call fcn.0040f6f9
lea eax, [esp + 0x24]
push eax
call fcn.0040dd50
add esp, 0x10
test eax, eax
je 0x40a9d6
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.0040a790
mov edx, dword [esp + 8]
push edx
lea eax, [esp + 0x1c]
push str._sWinVNC4.exe
push eax
call fcn.0040f6f9
lea ecx, [esp + 0x24]
push ecx
call fcn.0040dd50
add esp, 0x10
test eax, eax
je 0x40aa07
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.0040a790
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40aa18
push eax
call fcn.0040f5cf
add esp, 4
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x40aa29
push eax
call fcn.0040f5cf
add esp, 4
mov eax, dword [esp + 8]
pop esi
cmp eax, ebx
pop ebx
je 0x40aa3c
push eax
call fcn.0040f5cf
add esp, 4
mov ecx, dword [esp + 0x218]
xor ecx, esp
xor eax, eax
call fcn.0040f175
add esp, 0x21c
ret