Function at 0x40fee0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56e4c3
mov eax, dword fs:[0]
push eax
sub esp, 0x38c
mov eax, dword [0x5d7f50]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x370]
mov dword [ebp - 0x378], ebx
mov dword [ebp - 0x374], ebx
call fcn.00402770
push 0x2f
lea eax, [ebp - 0x43]
push ebx
mov dword [ebp - 4], ebx
push eax
mov byte [ebp - 0x44], bl
call fcn.00543bb0
add esp, 0xc
push 0x207
lea ecx, [ebp - 0x24f]
push ebx
push ecx
mov byte [ebp - 0x250], bl
call fcn.00543bb0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x358]
push ebx
push edx
mov dword [ebp - 0x38c], 0x208
mov dword [ebp - 0x394], ebx
mov byte [ebp - 4], 1
call fcn.00543bb0
add esp, 0xc
lea ecx, [ebp - 0x358]
call fcn.0041f670
lea eax, [ebp - 0x358]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40ffa0
mov ecx, dword [0x5acd20]
mov edx, dword [0x5acd24]
mov dword [eax], ecx
mov ecx, dword [0x5acd28]
mov dword [eax + 4], edx
lea edx, [ebp - 0x358]
push edx
mov dword [eax + 8], ecx
call fcn.0041f770
mov edi, eax
mov dword [ebp - 0x35c], eax
cmp edi, 1
jle 0x40ffe6
mov edi, 1
mov dword [ebp - 0x35c], edi
push 0x5ad324
lea ecx, [ebp - 0x36c]
call fcn.00402770
mov byte [ebp - 4], 2
cmp edi, ebx
jne 0x410007
push 9
push str.gmMgr_cse
jmp 0x410013
cmp edi, 1
jne 0x41001e
push 0x11
push str.CRCB_DFKEY_Client
lea ecx, [ebp - 0x36c]
call fcn.00402a20
mov ecx, dword [ebp - 0x36c]
mov edx, dword [ecx - 8]
mov eax, 1
sub eax, dword [ecx - 4]
or edx, eax
jge 0x410045
push ebx
lea ecx, [ebp - 0x36c]
call fcn.00402950
mov ecx, dword [ebp - 0x36c]
lea edx, [ebp - 0x44]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x410048
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x364], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x410085
lea eax, [ebp - 0x364]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
lea ecx, [ebp - 0x370]
cmp dword [ebp - 0x364], ebx
je 0x41009c
push 0x39
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun
jmp 0x4100a3
push 0x2d
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.00402a20
lea ecx, [ebp - 0x364]
push ecx
lea ecx, [ebp - 0x37c]
mov dword [ebp - 0x37c], ebx
mov dword [ebp - 0x364], ebx
call fcn.004279b0
mov ebx, dword [ebp - 0x37c]
add esp, 4
xor esi, esi
cmp esi, dword [ebp - 0x364]
jae 0x41017a
test edi, edi
jne 0x41011c
mov eax, esi
imul eax, eax, 0x402
add eax, ebx
push 0x5af028
push eax
call fcn.0053d8d0
add esp, 8
test eax, eax
je 0x410174
xor eax, eax
push 0x5c9e00
lea edx, [ebp - 0x380]
push edx
mov dword [ebp - 0x374], eax
mov dword [ebp - 0x380], eax
call fcn.00543f24
cmp edi, 1
jne 0x410174
mov edi, esi
imul edi, edi, 0x402
add edi, ebx
push 0x5af038
push edi
call fcn.0053d8d0
add esp, 8
test eax, eax
jne 0x41014f
push 0x5af050
push edi
call fcn.0053d8d0
add esp, 8
test eax, eax
je 0x41016e
xor eax, eax
push 0x5c9e00
lea ecx, [ebp - 0x390]
push ecx
mov dword [ebp - 0x374], eax
mov dword [ebp - 0x390], eax
call fcn.00543f24
mov edi, dword [ebp - 0x35c]
inc esi
jmp 0x4100d1
mov edx, dword [ebp - 0x370]
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
or ecx, eax
jge 0x4101a2
push 0
lea ecx, [ebp - 0x370]
call fcn.00402950
mov edx, dword [ebp - 0x370]
lea eax, [ebp - 0x378]
push eax
push 0x20019
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x374], eax
test eax, eax
je 0x4101dd
push 0x5c9e00
lea ecx, [ebp - 0x384]
push ecx
mov dword [ebp - 0x384], eax
call fcn.00543f24
lea edx, [ebp - 0x38c]
push edx
lea eax, [ebp - 0x250]
push eax
mov eax, dword [ebp - 0x378]
lea ecx, [ebp - 0x394]
push ecx
push 0
lea edx, [ebp - 0x44]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x374], eax
test eax, eax
je 0x410226
push 0x5c9e00
lea ecx, [ebp - 0x388]
push ecx
mov dword [ebp - 0x388], eax
call fcn.00543f24
push ecx
mov edi, esp
mov dword [ebp - 0x368], esp
mov ebx, 0x708
mov dword [ebp - 0x368], edi
call fcn.0044b779
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x410254
push 0x80004005
call fcn.00402bc0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 3
test ecx, 0xffff0000
jne 0x41028e
mov edx, ecx
movzx esi, dx
push esi
call fcn.0044cb1e
test eax, eax
je 0x4102af
push esi
push eax
mov ecx, edi
call fcn.004025c0
jmp 0x4102af
lea eax, [ebp - 0x250]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410297
sub eax, edx
push eax
lea eax, [ebp - 0x250]
push eax
mov ecx, edi
call fcn.00402a20
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.00410740
add esp, 4
cmp dword [ebp - 0x35c], 1
jne 0x4106ac
lea ecx, [ebp - 0x250]
push ecx
lea ecx, [ebp - 0x35c]
call fcn.00402770
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x35c]
push 0x5c
push edx
call fcn.0053d7f2
add esp, 8
test eax, eax
jne 0x4102fa
or eax, 0xffffffff
jmp 0x410300
sub eax, dword [ebp - 0x35c]
push eax
lea eax, [ebp - 0x368]
push eax
lea ecx, [ebp - 0x35c]
call fcn.00407c50
mov byte [ebp - 4], 5
mov ecx, dword [eax]
mov esi, dword [ebp - 0x35c]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x410374
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x410364
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x410364
push eax
call fcn.00402b50
mov ebx, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x410359
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [ebp - 0x35c], ebx
jmp 0x410374
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x35c]
call fcn.00402a20
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x368]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41039a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x5af068
lea ecx, [ebp - 0x35c]
push ecx
lea edx, [ebp - 0x360]
push edx
call fcn.00415530
add esp, 0xc
mov byte [ebp - 4], 6
mov ebx, dword [ebp - 0x37c]
xor edi, edi
xor esi, esi
cmp esi, dword [ebp - 0x364]
jae 0x4103ee
mov eax, esi
imul eax, eax, 0x402
add eax, ebx
push 0x5af050
push eax
call fcn.0053d8d0
add esp, 8
test eax, eax
jne 0x4104b0
inc esi
jmp 0x4103c3
test edi, edi
jne 0x4104b0
mov edx, dword [ebp - 0x360]
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
mov ebx, 0x708
or ecx, eax
jge 0x410422
push edi
lea ecx, [ebp - 0x360]
call fcn.00402950
mov edx, dword [ebp - 0x360]
push ecx
mov edi, esp
mov dword [ebp - 0x368], esp
mov esi, edx
mov dword [ebp - 0x368], edi
call fcn.0044b779
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41044d
push 0x80004005
call fcn.00402bc0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 7
test esi, esi
je 0x410483
test esi, 0xffff0000
jne 0x410487
movzx esi, si
push esi
call fcn.0044cb1e
test eax, eax
je 0x4104a2
push esi
push eax
mov ecx, edi
call fcn.004025c0
jmp 0x4104a2
xor eax, eax
jmp 0x410499
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410490
sub eax, edx
push eax
push esi
mov ecx, edi
call fcn.00402a20
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.00410740
add esp, 4
push str.CRCB_DFKEY_SRV.exe
lea ecx, [ebp - 0x35c]
push ecx
lea edx, [ebp - 0x368]
push edx
call fcn.00415530
add esp, 0xc
mov byte [ebp - 4], 8
mov eax, dword [eax]
mov ebx, dword [ebp - 0x360]
lea esi, [eax - 0x10]
add ebx, 0xfffffff0
cmp esi, ebx
je 0x41057f
cmp dword [ebx + 0xc], 0
jl 0x41056f
mov ecx, dword [esi]
cmp ecx, dword [ebx]
jne 0x41056f
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x410516
cmp eax, dword [esi]
jne 0x410516
mov edi, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x41054b
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
jne 0x41052f
call fcn.00402b40
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
inc eax
push eax
add esi, 0x10
push esi
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.0053c9fc
add esp, 0x10
lea eax, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [eax], edx
dec edx
test edx, edx
jg 0x410564
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
add edi, 0x10
mov dword [ebp - 0x360], edi
jmp 0x41057f
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x360]
call fcn.00402a20
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x368]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4105a5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebp - 0x360]
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
mov ebx, 0x708
or ecx, eax
jge 0x4105d2
push 0
lea ecx, [ebp - 0x360]
call fcn.00402950
mov edx, dword [ebp - 0x360]
push ecx
mov edi, esp
mov dword [ebp - 0x364], esp
mov esi, edx
mov dword [ebp - 0x364], edi
call fcn.0044b779
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4105fd
push 0x80004005
call fcn.00402bc0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 9
test esi, esi
je 0x410633
test esi, 0xffff0000
jne 0x410637
movzx esi, si
push esi
call fcn.0044cb1e
test eax, eax
je 0x410652
push esi
push eax
mov ecx, edi
call fcn.004025c0
jmp 0x410652
xor eax, eax
jmp 0x410649
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410640
sub eax, edx
push eax
push esi
mov ecx, edi
call fcn.00402a20
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.00410740
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x360]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410686
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x35c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4106ac
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x36c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4106d2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x378]
test eax, eax
je 0x4106e3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x370]
add eax, 0xfffffff0
mov dword [ebp - 0x378], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410716
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x374]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0053c99c
mov esp, ebp
pop ebp
ret