Function at 0x4052e8
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x838
mov eax, dword [0x40f014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x834], 0x80004005
mov ebx, ecx
mov dword [ebp - 0x828], edi
mov dword [ebp - 0x830], edi
call fcn.00403cc2
test eax, eax
jne 0x40532d
mov esi, 0x8007000e
jmp 0x40547c
cmp dword [ebx + 0x1c], 6
jge 0x40533d
mov esi, 0x8007139f
jmp 0x40547c
mov eax, dword [ebp + 8]
test eax, eax
je 0x405656
cmp dword [ebp + 0xc], edi
je 0x405656
mov ecx, dword [ebx + 0x24]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40537a
test dx, dx
je 0x405376
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40537a
add eax, 4
add ecx, 4
test dx, dx
jne 0x405354
mov eax, edi
jmp 0x40537f
sbb eax, eax
or eax, 1
test eax, eax
je 0x40538d
mov esi, 0x80070005
jmp 0x40547c
push dword [ebp + 0xc]
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.00403be3
test eax, eax
js 0x405656
lea ecx, [ebp - 0x20c]
call fcn.00408dd2
lea ecx, [ebp - 0x20c]
call fcn.00408d6a
test eax, eax
js 0x405656
lea ecx, [ebp - 0x20c]
call fcn.00408e9f
test eax, eax
js 0x405656
push ecx
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.00403e6d
mov esi, eax
test esi, esi
js 0x40547c
cmp dword [ebx + 0x54], edi
jne 0x40540a
lea ecx, [ebp - 0x20c]
call fcn.0040942f
test eax, eax
je 0x405383
cmp dword [ebp + 0x14], edi
je 0x4055ce
push 0x208
lea eax, [ebp - 0x414]
push edi
push eax
call sub.msvcrt.dll_memset
and dword [ebp - 0x82c], edi
lea ecx, [ebp - 0x82c]
add esp, 0xc
call fcn.0040a7f6
mov esi, eax
test esi, esi
jne 0x40547a
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x828]
push eax
xor eax, eax
push eax
push 0x20006
push eax
push eax
push eax
push 0x4025e8
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
je 0x4054ea
jle 0x40547a
movzx esi, si
or esi, 0x80070000
xor edi, edi
cmp dword [ebp - 0x828], 0
je 0x405491
push dword [ebp - 0x828]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x830]
test eax, eax
je 0x4054a2
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp + 0x10], 0
je 0x4054ce
cmp dword [ebp - 0x834], 0
jne 0x4054ce
push edi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
call fcn.0040a945
mov ecx, ebx
call fcn.00403cde
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040dd40
mov esp, ebp
pop ebp
ret 0x10
push edi
push 0x402578
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.00403c18
add esp, 0x10
mov esi, eax
inc edi
test esi, esi
js 0x40547a
lea eax, [ebp - 0x838]
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x828]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405538
test edi, edi
jne 0x4054ea
jmp 0x40553c
test edi, edi
jne 0x405546
mov esi, 0x800703f5
jmp 0x40547a
lea eax, [ebp - 0x20c]
push eax
push 0x402590
lea eax, [ebp - 0x824]
push 0x207
push eax
call fcn.00403c18
mov esi, eax
add esp, 0x10
xor edi, edi
test esi, esi
js 0x40547c
lea ecx, [ebp - 0x824]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x40557b
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x824]
push eax
push 1
push edi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x828]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40564a
jg 0x4055c0
mov esi, eax
jmp 0x40547c
movzx esi, ax
or esi, 0x80070000
jmp 0x40547c
push 8
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x830], edi
test edi, edi
jne 0x4055f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jmp 0x40546f
push 0x40264c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4055ea
cmp dword [ebp + 0x10], 0
je 0x405627
call fcn.0040a834
mov dword [ebp - 0x834], eax
test eax, eax
je 0x405627
mov esi, eax
jmp 0x40547a
mov ecx, edi
call dword [0x410370]
mov esi, esp
call edi
cmp esi, esp
je 0x40563e
mov ecx, 4
int 0x29
mov esi, eax
xor edi, edi
test esi, esi
js 0x40547c
mov dword [ebx + 0x1c], 8
jmp 0x40547c
mov esi, 0x80070057
jmp 0x40547c