Function at 0x405c3c
Capabilities:
Access peb ldr_data
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2a
push 0
push 0
dec ecx
jne 0x405c44
push ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x405f5d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov dword [eax + 0x68], edx
cmp byte [0x40a018], 0
jne 0x405ca8
lea eax, [ebp - 0x118]
call fcn.00405b8c
mov edx, dword [ebp - 0x118]
mov eax, dword [ebp - 4]
add eax, 0x70
call sub.rtl60.bpl__System__LStrAsg_qqrpvpxv
mov eax, dword [ebp - 4]
lea edx, [eax + 0x78]
mov eax, 3
call sub.rtl60.bpl__System_ParamStr_qqri
mov eax, dword [ebp - 4]
lea edx, [eax + 0x74]
mov eax, 4
call sub.rtl60.bpl__System_ParamStr_qqri
mov eax, dword [ebp - 4]
add eax, 0xc
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x124]
mov eax, dword [sym.imp.vcl60.bpl__Forms_Application]
mov eax, dword [eax]
call sub.vcl60.bpl__Forms_TApplication_GetExeName_qqrv
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
call sub.rtl60.bpl__Sysutils_ExtractFilePath_qqrx17System_AnsiString
mov eax, dword [ebp - 0x120]
lea edx, [ebp - 0x11c]
call sub.rtl60.bpl__Sysutils_IncludeTrailingBackslash_qqrx17System_AnsiString
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0xc]
add eax, 0x2c
call sub.rtl60.bpl__System__LStrAsg_qqrpvpxv
mov eax, dword [ebp - 0xc]
add eax, 0x30
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x2c]
call sub.rtl60.bpl__System__LStrAsg_qqrpvpxv
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x2c]
lea eax, [ebp - 0x12c]
mov ecx, 0x405f74
call sub.rtl60.bpl__System__LStrCat3_qqrv
mov eax, dword [ebp - 0x12c]
lea edx, [ebp - 0x128]
call sub.rtl60.bpl__Sysutils_IncludeTrailingBackslash_qqrx17System_AnsiString
mov edx, dword [ebp - 0x128]
mov eax, dword [ebp - 0xc]
add eax, 0x34
call sub.rtl60.bpl__System__LStrAsg_qqrpvpxv
push 0x104
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x130]
lea eax, [ebp - 0x111]
call sub.rtl60.bpl__Sysutils_StrPas_qqrpxc
mov edx, dword [ebp - 0x130]
mov eax, dword [ebp - 0xc]
add eax, 0x38
call sub.rtl60.bpl__System__LStrAsg_qqrpvpxv
push 0x104
lea eax, [ebp - 0x111]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x111]
call sub.rtl60.bpl__Sysutils_StrPas_qqrpxc
mov edx, dword [ebp - 0x134]
mov eax, dword [ebp - 0xc]
add eax, 0x3c
call sub.rtl60.bpl__System__LStrAsg_qqrpvpxv
mov dl, 1
mov eax, dword [sym.imp.rtl60.bpl__Registry_TRegistry_]
call sub.rtl60.bpl__Registry_TRegistry__bctr_qqrv
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x405f14
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__Registry_TRegistry_SetRootKey_qqrui
mov edx, 0x405f84
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__Registry_TRegistry_OpenKeyReadOnly_qqrx17System_AnsiString
test al, al
je 0x405e28
lea ecx, [ebp - 0x138]
mov edx, 0x405fb8
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__Registry_TRegistry_ReadString_qqrx17System_AnsiString
mov edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0xc]
add eax, 0x40
call sub.rtl60.bpl__System__LStrAsg_qqrpvpxv
lea ecx, [ebp - 0x13c]
mov edx, 0x405fd0
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__Registry_TRegistry_ReadString_qqrx17System_AnsiString
mov edx, dword [ebp - 0x13c]
mov eax, dword [ebp - 0xc]
add eax, 0x44
call sub.rtl60.bpl__System__LStrAsg_qqrpvpxv
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__Registry_TRegistry_SetRootKey_qqrui
mov edx, 0x405fe8
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__Registry_TRegistry_OpenKeyReadOnly_qqrx17System_AnsiString
test al, al
je 0x405efe
lea ecx, [ebp - 0x140]
mov edx, 0x406034
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__Registry_TRegistry_ReadString_qqrx17System_AnsiString
mov edx, dword [ebp - 0x140]
mov eax, dword [ebp - 0xc]
add eax, 0x48
call sub.rtl60.bpl__System__LStrAsg_qqrpvpxv
lea ecx, [ebp - 0x144]
mov edx, 0x406044
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__Registry_TRegistry_ReadString_qqrx17System_AnsiString
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 0xc]
add eax, 0x4c
call sub.rtl60.bpl__System__LStrAsg_qqrpvpxv
lea ecx, [ebp - 0x148]
mov edx, 0x406054
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__Registry_TRegistry_ReadString_qqrx17System_AnsiString
mov edx, dword [ebp - 0x148]
mov eax, dword [ebp - 0xc]
add eax, 0x50
call sub.rtl60.bpl__System__LStrAsg_qqrpvpxv
lea ecx, [ebp - 0x14c]
mov edx, 0x406068
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__Registry_TRegistry_ReadString_qqrx17System_AnsiString
mov edx, dword [ebp - 0x14c]
mov eax, dword [ebp - 0xc]
add eax, 0x54
call sub.rtl60.bpl__System__LStrAsg_qqrpvpxv
lea ecx, [ebp - 0x150]
mov edx, 0x40607c
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__Registry_TRegistry_ReadString_qqrx17System_AnsiString
mov edx, dword [ebp - 0x150]
mov eax, dword [ebp - 0xc]
add eax, 0x58
call sub.rtl60.bpl__System__LStrAsg_qqrpvpxv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405f1b
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__System_TObject_Free_qqrv
ret