Function at 0x41c1b0
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x3e8
push ebx
push edi
mov ebx, ecx
jne 0x41c1e3
mov ecx, dword [ebx + 8]
xor edi, edi
push edi
push edi
push 6
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x41c489
cmp dword [ebp + 8], 0x3e9
jne 0x41c463
push esi
push 0x433
push dword [ebx - 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
xor edi, edi
mov esi, 0xf0
push edi
push edi
push esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
dec eax
neg eax
sbb eax, eax
inc eax
cmp dword [ebx + 0x10], edi
jne 0x41c445
test eax, eax
je 0x41c445
call fcn.0041c0d8
cmp dword [eax + 0x10], edi
je 0x41c445
call fcn.0041c0d8
mov ecx, eax
call fcn.004c5179
test eax, eax
je 0x41c445
call fcn.004c416f
push esi
push edi
mov dword [eax + 0x848], 9
lea eax, [ebp - 0x504]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x50c], 0x3c
mov dword [ebp - 0x510], edi
mov dword [ebp - 0x514], edi
call fcn.0041c0d8
mov ecx, eax
call fcn.00472540
lea ecx, [ebp - 0x514]
push ecx
lea ecx, [ebp - 0x510]
mov edx, dword [eax]
push ecx
lea ecx, [ebp - 0x50c]
push ecx
lea ecx, [ebp - 0x504]
push ecx
mov ecx, eax
call dword [edx + 0x1c]
cmp dword [ebp - 0x50c], edi
jle 0x41c43c
cmp dword [ebp - 0x510], 1
jne 0x41c43c
mov esi, 0x410
lea eax, [ebp - 0x414]
push esi
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x518], esi
mov esi, 0x527fb4
mov dword [ebp - 0x51c], 1
lea ecx, [ebp - 0x508]
push esi
call fcn.00402af5
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x51c]
push eax
push 0x52aef0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x414]
push eax
call sub.msvcrt.dll_wcslen
pop ecx
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x508]
call fcn.00404550
push 0x22
pop eax
cmp word [ebp - 0x414], ax
jne 0x41c38e
push eax
lea eax, [ebp - 0x412]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x41c36b
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x412]
push eax
call fcn.00402f1d
test eax, eax
je 0x41c3dd
lea eax, [ebp - 0x412]
push eax
call fcn.004c10aa
pop ecx
test eax, eax
jne 0x41c3f1
jmp 0x41c3dd
push str..exe
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov esi, eax
test esi, esi
je 0x41c3b7
push str..exe
call sub.msvcrt.dll_wcslen
pop ecx
xor ecx, ecx
mov word [esi + eax*2], cx
lea eax, [ebp - 0x414]
push eax
call fcn.00402f1d
test eax, eax
je 0x41c3d8
lea eax, [ebp - 0x414]
push eax
call fcn.004c10aa
pop ecx
test eax, eax
jne 0x41c3f1
mov esi, 0x527fb4
push esi
call sub.msvcrt.dll_wcslen
pop ecx
push eax
push esi
lea ecx, [ebp - 0x508]
call fcn.00404550
call fcn.0041c0d8
mov ecx, eax
call fcn.00472540
push 1
push dword [ebp - 0x514]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, dword [ebp - 0x508]
mov eax, dword [esi - 0xc]
test eax, eax
je 0x41c434
add eax, eax
push eax
push esi
push 1
push 0x52aef0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [esi - 0x10]
call fcn.004042e9
mov dword [ebx + 0x10], 1
jmp 0x41c454
call fcn.004c416f
mov dword [eax + 0x848], 0xa
mov ecx, dword [ebx + 8]
push edi
push edi
push 7
mov eax, dword [ecx]
call dword [eax + 0xc]
pop esi
jmp 0x41c489
cmp dword [ebp + 8], 0x3ea
jne 0x41c489
call fcn.004c416f
xor edi, edi
push edi
push edi
mov dword [eax + 0x848], 0xa
mov ecx, dword [ebx + 8]
push 7
mov edx, dword [ecx]
call dword [edx + 0xc]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
inc eax
pop ebx
call fcn.00522d04
leave
ret 4