Function at 0x405328
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x838
mov eax, dword [0x40f014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x834], 0x80004005
mov ebx, ecx
mov dword [ebp - 0x828], edi
mov dword [ebp - 0x830], edi
call fcn.00403d45
test eax, eax
jne 0x40536d
mov esi, 0x8007000e
jmp 0x4054bc
cmp dword [ebx + 0x1c], 6
jge 0x40537d
mov esi, 0x8007139f
jmp 0x4054bc
mov eax, dword [ebp + 8]
test eax, eax
je 0x405694
cmp dword [ebp + 0xc], edi
je 0x405694
mov ecx, dword [ebx + 0x24]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4053ba
test dx, dx
je 0x4053b6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4053ba
add eax, 4
add ecx, 4
test dx, dx
jne 0x405394
mov eax, edi
jmp 0x4053bf
sbb eax, eax
or eax, 1
test eax, eax
je 0x4053cd
mov esi, 0x80070005
jmp 0x4054bc
push dword [ebp + 0xc]
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.00403c5c
test eax, eax
js 0x405694
lea ecx, [ebp - 0x20c]
call fcn.00408ecf
lea ecx, [ebp - 0x20c]
call fcn.00408e67
test eax, eax
js 0x405694
lea ecx, [ebp - 0x20c]
call fcn.00408f9a
test eax, eax
js 0x405694
push ecx
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.00403ede
mov esi, eax
test esi, esi
js 0x4054bc
cmp dword [ebx + 0x54], edi
jne 0x40544a
lea ecx, [ebp - 0x20c]
call fcn.0040950a
test eax, eax
je 0x4053c3
cmp dword [ebp + 0x14], edi
je 0x40560c
push 0x208
lea eax, [ebp - 0x414]
push edi
push eax
call sub.msvcrt.dll_memset
and dword [ebp - 0x82c], edi
lea ecx, [ebp - 0x82c]
add esp, 0xc
call fcn.0040a924
mov esi, eax
test esi, esi
jne 0x4054ba
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x828]
push eax
xor eax, eax
push eax
push 0x20006
push eax
push eax
push eax
push 0x4025f8
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
je 0x405528
jle 0x4054ba
movzx esi, si
or esi, 0x80070000
xor edi, edi
cmp dword [ebp - 0x828], 0
je 0x4054d1
push dword [ebp - 0x828]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x830]
test eax, eax
je 0x4054e2
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp + 0x10], 0
je 0x40550e
cmp dword [ebp - 0x834], 0
jne 0x40550e
push edi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
call fcn.0040aa6f
mov ecx, ebx
call fcn.00403d59
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040de60
leave
ret 0x10
push edi
push 0x402588
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.00403c91
add esp, 0x10
mov esi, eax
inc edi
test esi, esi
js 0x4054ba
lea eax, [ebp - 0x838]
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x828]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405576
test edi, edi
jne 0x405528
jmp 0x40557a
test edi, edi
jne 0x405584
mov esi, 0x800703f5
jmp 0x4054ba
lea eax, [ebp - 0x20c]
push eax
push 0x4025a0
lea eax, [ebp - 0x824]
push 0x207
push eax
call fcn.00403c91
mov esi, eax
add esp, 0x10
xor edi, edi
test esi, esi
js 0x4054bc
lea ecx, [ebp - 0x824]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x4055b9
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x824]
push eax
push 1
push edi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x828]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x405688
jg 0x4055fe
mov esi, eax
jmp 0x4054bc
movzx esi, ax
or esi, 0x80070000
jmp 0x4054bc
push 8
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x830], edi
test edi, edi
jne 0x405637
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jmp 0x4054af
push 0x40265c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x405628
cmp dword [ebp + 0x10], 0
je 0x405665
call fcn.0040a960
mov dword [ebp - 0x834], eax
test eax, eax
je 0x405665
mov esi, eax
jmp 0x4054ba
mov ecx, edi
call dword [0x41036c]
mov esi, esp
call edi
cmp esi, esp
je 0x40567c
mov ecx, 4
int 0x29
mov esi, eax
xor edi, edi
test esi, esi
js 0x4054bc
mov dword [ebx + 0x1c], 8
jmp 0x4054bc
mov esi, 0x80070057
jmp 0x4054bc