Function at 0x40d700
Capabilities:
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x4c5c
call fcn.0040e020
mov al, byte [0x415e14]
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x368], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x369]
mov edx, dword [0x412eec]
rep stosd dword es:[edi], eax
mov ecx, dword [str.W32_Palevo.Worm]
mov dword [esp + 0x470], edx
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x412ef0]
mov dword [esp + 0x46c], ecx
mov ecx, dword [0x412ef4]
mov dword [esp + 0x474], eax
mov dword [esp + 0x478], ecx
mov ecx, 0xfc
xor eax, eax
lea edi, [esp + 0x47c]
lea edx, [esp + 0x20]
xor esi, esi
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x4c70]
mov byte [esp + 0x13], al
mov eax, dword [esp + 0x4c74]
push edx
push 0x20019
push esi
push eax
push ecx
mov dword [esp + 0x40], 0x3fff
mov dword [esp + 0x48], 0x104
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40dcad
lea edx, [esp + 0x50]
lea eax, [esp + 0x3c]
push edx
lea ecx, [esp + 0x50]
push eax
lea edx, [esp + 0x4c]
push ecx
lea eax, [esp + 0x3c]
push edx
lea ecx, [esp + 0x58]
push eax
lea edx, [esp + 0x54]
push ecx
lea eax, [esp + 0x3c]
push edx
push eax
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x54]
push esi
lea edx, [esp + 0x38c]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [esp + 0x24]
cmp eax, esi
je 0x40da76
mov cl, byte [0x4182f1]
test cl, cl
je 0x40da76
xor ecx, ecx
cmp eax, esi
mov dword [esp + 0x1c], ecx
jbe 0x40da76
lea edx, [esp + 0x50]
lea eax, [esp + 0x38]
push edx
push 0
push 0
push 0
lea edx, [esp + 0x278]
push eax
mov eax, dword [esp + 0x34]
push edx
push ecx
push eax
mov dword [esp + 0x58], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x40da61
mov ebp, dword [sym.imp.MSVCRT.dll_strrchr]
push 0x5c
push 0x4181ec
call ebp
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40dcad
mov edi, dword [esp + 0x4c74]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x86c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x86c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x413c04
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x86c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x268]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x4c70]
and ecx, 3
lea eax, [esp + 0x58]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [esp + 0x870]
push str.ImagePath
push ecx
push edx
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40da61
mov esi, dword [sym.imp.MSVCRT.dll__strlwr]
lea eax, [esp + 0x58]
push eax
call esi
push 0x4181ec
call esi
add esp, 8
lea ecx, [esp + 0x160]
lea edx, [esp + 0x58]
push 0x105
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x40da61
lea eax, [esp + 0x160]
push eax
call esi
lea ecx, [esp + 0x5c]
push 0x5c
push ecx
call ebp
add esp, 0xc
test eax, eax
jne 0x40d985
mov byte [esp + 0x13], 1
mov edi, 0x4181ec
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
je 0x40dcad
cmp byte [esp + 0x58], 0x22
jne 0x40d9c7
lea edi, [esp + 0x58]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x58]
lea edx, [esp + ecx + 0x58]
cmp eax, edx
jae 0x40d9cf
lea ecx, [esp + 0x59]
mov dword [esp + 0x14], ecx
jmp 0x40d9cf
lea edx, [esp + 0x58]
mov dword [esp + 0x14], edx
cmp byte [esp + 0x160], 0x22
jne 0x40da09
lea edi, [esp + 0x160]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ecx + 0x160]
lea ecx, [esp + 0x160]
cmp ecx, eax
jae 0x40da14
lea edx, [esp + 0x161]
mov dword [esp + 0x18], edx
jmp 0x40da14
lea eax, [esp + 0x160]
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x58]
push ebx
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x40da2f
mov al, byte [esp + 0x13]
test al, al
jne 0x40da61
mov esi, dword [esp + 0x14]
mov ecx, ebp
mov edi, 0x4181ec
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40da51
mov esi, dword [esp + 0x18]
mov ecx, ebp
mov edi, 0x4181ec
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40da61
lea ecx, [esp + 0x268]
push ecx
call fcn.00407720
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
inc ecx
cmp ecx, eax
mov dword [esp + 0x1c], ecx
jb 0x40d828
mov eax, dword [esp + 0x30]
test eax, eax
je 0x40dcad
xor ecx, ecx
test eax, eax
mov dword [esp + 0x1c], ecx
jbe 0x40dcad
mov edi, dword [esp + 0x28]
push 0
push 0
push 0
lea edx, [esp + 0x38]
push 0
lea eax, [esp + 0xc7c]
push edx
sub ecx, edi
push eax
push ecx
mov ecx, dword [esp + 0x3c]
push ecx
mov dword [esp + 0x4c], 0x3fff
mov byte [esp + 0xc8c], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x40dc98
mov edi, dword [sym.imp.MSVCRT.dll_strrchr]
push 0x5c
push 0x4181ec
xor bl, bl
call edi
mov esi, eax
add esp, 8
test esi, esi
je 0x40dcad
mov ecx, dword [esp + 0x4c74]
lea edx, [esp + 0x58]
lea eax, [esp + 0xc6c]
push edx
mov edx, dword [esp + 0x4c74]
push eax
push ecx
push edx
call fcn.00405100
add esp, 0x10
test eax, eax
je 0x40dc98
mov ebp, dword [sym.imp.MSVCRT.dll__strlwr]
lea eax, [esp + 0x58]
push eax
call ebp
push 0x4181ec
call ebp
add esp, 8
lea ecx, [esp + 0x160]
lea edx, [esp + 0x58]
push 0x105
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x40dc98
lea eax, [esp + 0x160]
push eax
call ebp
lea ecx, [esp + 0x5c]
push 0x5c
push ecx
call edi
add esp, 0xc
test eax, eax
jne 0x40db6d
mov bl, 1
mov edi, 0x4181ec
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
je 0x40dcad
cmp byte [esp + 0x58], 0x22
jne 0x40dbaf
lea edi, [esp + 0x58]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x58]
lea edx, [esp + ecx + 0x58]
cmp eax, edx
jae 0x40dbb7
lea ecx, [esp + 0x59]
mov dword [esp + 0x14], ecx
jmp 0x40dbb7
lea edx, [esp + 0x58]
mov dword [esp + 0x14], edx
cmp byte [esp + 0x160], 0x22
jne 0x40dbf1
lea edi, [esp + 0x160]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ecx + 0x160]
lea ecx, [esp + 0x160]
cmp ecx, eax
jae 0x40dbfc
lea edx, [esp + 0x161]
mov dword [esp + 0x18], edx
jmp 0x40dbfc
lea eax, [esp + 0x160]
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x58]
push esi
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x40dc17
test bl, bl
jne 0x40dc98
mov esi, dword [esp + 0x14]
mov ecx, ebp
mov edi, 0x4181ec
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40dc39
mov esi, dword [esp + 0x18]
mov ecx, ebp
mov edi, 0x4181ec
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40dc98
mov edx, dword [esp + 0x4c74]
mov eax, dword [esp + 0x4c70]
lea ecx, [esp + 0xc6c]
push ecx
push edx
push eax
call fcn.004050a0
add esp, 0xc
test eax, eax
je 0x40dc98
mov eax, dword [0x415e54]
test eax, eax
je 0x40dc94
lea ecx, [esp + 0x46c]
push ecx
push str.System_Registry______s_removed
push 0x416190
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edx, dword [0x415e54]
add esp, 0xc
push 0
push 0
push 0xb
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
inc dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
inc ecx
cmp ecx, eax
mov dword [esp + 0x1c], ecx
jb 0x40da90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c5c
ret