Function at 0x1004609
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x548
mov eax, dword [0x100c004]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x544], eax
mov dword [ebp - 0x538], ecx
je 0x100464a
push dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x430]
push ecx
push eax
call fcn.01004496
test eax, eax
jne 0x1004651
xor eax, eax
jmp 0x1004a0b
push esi
push edi
lea eax, [ebp - 0x53c]
push eax
mov edi, 0xf003f
push edi
push ebx
push 0x1001c6c
mov esi, 0x80000002
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
mov dword [ebp - 0x548], eax
je 0x10046d0
cmp dword [ebp - 0x538], ebx
je 0x10049ec
push ebx
push 0x100
lea ecx, [ebp - 0x114]
push ecx
push ebx
push eax
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea eax, [ebp - 0x114]
push eax
push 0x1001c6c
push dword [ebp - 0x548]
push 0x1001c40
push dword [ebp + 0x10]
push dword [ebp - 0x538]
call fcn.01005a80
add esp, 0x18
jmp 0x10049ec
push ebx
lea eax, [ebp - 0x540]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
mov edi, 0x1001c08
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
cmp esi, ebx
je 0x1004743
cmp dword [ebp - 0x538], ebx
je 0x1004732
push ebx
push 0x100
lea eax, [ebp - 0x114]
push eax
push ebx
push esi
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea eax, [ebp - 0x114]
push eax
push edi
push esi
push 0x1001bd8
push dword [ebp + 0x10]
push dword [ebp - 0x538]
call fcn.01005a80
add esp, 0x18
push dword [ebp - 0x53c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10049ec
push 0xc
mov eax, 0x1001bcc
push eax
push 1
push ebx
push eax
push dword [ebp - 0x53c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
cmp esi, ebx
je 0x100479a
cmp dword [ebp - 0x538], ebx
je 0x10049d6
push ebx
push 0x100
lea eax, [ebp - 0x114]
push eax
push ebx
push esi
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea eax, [ebp - 0x114]
push eax
push esi
push 0x1001ba4
jmp 0x10049c5
push 0x104
lea eax, [ebp - 0x534]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10047f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x538], ebx
mov esi, eax
je 0x10049d6
push ebx
push 0x100
lea eax, [ebp - 0x114]
push eax
push ebx
push esi
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea eax, [ebp - 0x114]
push eax
push esi
push 0x1001b78
jmp 0x10049c5
xor eax, eax
mov cl, byte [ebp + eax - 0x534]
mov byte [ebp + eax - 0x32c], cl
inc eax
cmp cl, bl
jne 0x10047f4
mov eax, dword [ebp - 0x544]
cmp dword [eax + 0x10], ebx
je 0x1004827
lea edi, [ebp - 0x32c]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1004819
mov esi, 0x1001b74
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x544]
cmp dword [eax + 0x14], ebx
je 0x1004847
lea edi, [ebp - 0x32c]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1004839
mov esi, 0x1001b70
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x544]
mov eax, dword [eax + 0x18]
cmp eax, ebx
je 0x1004904
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.01003387
lea edi, [ebp - 0x32c]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1004869
mov esi, 0x1001b6c
lea eax, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100487c
lea edi, [ebp - 0x32c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x100488c
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x32c]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10048ab
mov eax, dword [ebp - 0x544]
mov eax, dword [eax + 0x1c]
mov esi, 0x1001b68
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10048c6
lea edi, [ebp - 0x32c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x10048d6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x32c]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10048f5
mov esi, 0x1001b64
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x32c]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100490b
mov esi, 0x1001b58
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x430]
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1004923
lea edi, [ebp - 0x32c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x1004933
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x32c]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1004952
mov esi, 0x1001b64
lea eax, [ebp - 0x32c]
movsw word es:[edi], word [esi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100496a
sub eax, esi
push eax
lea eax, [ebp - 0x32c]
push eax
push 1
push ebx
push 0x1001b34
push dword [ebp - 0x540]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
cmp esi, ebx
je 0x10049f0
cmp dword [ebp - 0x538], ebx
je 0x10049d6
push ebx
push 0x100
lea eax, [ebp - 0x114]
push eax
push ebx
push esi
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea eax, [ebp - 0x114]
push eax
push esi
push 0x1001b08
push dword [ebp + 0x10]
push dword [ebp - 0x538]
call fcn.01005a80
add esp, 0x14
push dword [ebp - 0x540]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x53c]
call esi
xor eax, eax
jmp 0x1004a09
push dword [ebp - 0x53c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x540]
call esi
xor eax, eax
inc eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.01005002
leave
ret 0xc