Function at 0x4317db
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x560607
call fcn.0053c1d0
sub esp, 0x318
mov eax, dword [0x5af710]
xor eax, ebp
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x260], ecx
mov ecx, dword [0x5b096c]
push edi
mov dword [ebp - 0x26c], eax
call fcn.00429afc
push eax
lea ecx, [ebp - 0x250]
call fcn.00405500
lea eax, [ebp - 0x250]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.005043ee
pop ecx
lea eax, [ebp - 0x25c]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp eax, ebx
je 0x431a16
mov esi, 0x243
cmp dword [0x5b21c0], esi
jne 0x431bab
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 1
push 2
lea ecx, [ebp - 0x324]
call fcn.00404a20
mov eax, 0x572a6c
push eax
push str.RegOpenKey
push 0x572a4c
push eax
push 0x572a48
push esi
push 0x572a40
push dword [ebp - 0x21c]
mov eax, 0x572a3c
push eax
push dword [ebp - 0x21e]
mov edx, 0x572a38
push eax
push dword [ebp - 0x220]
mov ecx, 0x572a34
push edx
push dword [ebp - 0x222]
mov byte [ebp - 4], 1
push ecx
push dword [ebp - 0x226]
push ecx
push dword [ebp - 0x228]
push edx
push 0x10ff
push eax
push 0x5c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x260], esp
push str..FunctionEx.cpp
call fcn.00405500
lea eax, [ebp - 0x288]
push eax
call fcn.00407150
add esp, 0x24
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 2
jb 0x431910
mov eax, dword [eax + 4]
jmp 0x431913
add eax, 4
push eax
lea eax, [ebp - 0x324]
push 0x572a0c
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.00403f50
push eax
call fcn.00403980
pop ecx
pop ecx
mov ecx, eax
call fcn.004040c0
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
pop ecx
pop ecx
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0x288]
call fcn.00402c50
lea eax, [ebp - 0x324]
push eax
call fcn.00407930
pop ecx
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], bl
call fcn.004028d0
lea ecx, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x572840
call fcn.0054dfcb
jmp 0x431bab
mov dword [ebp - 0x258], ebx
mov edi, 0x104
push edi
lea eax, [ebp - 0x114]
push ebx
push eax
mov dword [ebp - 0x268], edi
call fcn.0053c340
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x258]
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, ebx
jne 0x431b9f
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x25c]
mov dword [ebp - 0x264], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x431b94
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call fcn.00405500
lea eax, [ebp - 0x234]
push ebx
push eax
mov byte [ebp - 4], 3
call fcn.00504688
pop ecx
pop ecx
xor esi, esi
inc esi
push esi
push esi
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x234]
mov byte [ebp - 0x254], 0x22
call fcn.0040b695
cmp eax, ebx
lea ecx, [ebp - 0x234]
jle 0x431b0c
dec eax
push eax
push esi
lea eax, [ebp - 0x288]
push eax
call fcn.00405540
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 4
call fcn.00404360
lea ecx, [ebp - 0x288]
jmp 0x431b52
push esi
push ebx
lea eax, [ebp - 0x254]
push eax
mov byte [ebp - 0x254], 0x20
call fcn.0040b695
cmp eax, ebx
jle 0x431b5d
push eax
push ebx
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0x234]
call fcn.00405540
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 5
call fcn.00404360
lea ecx, [ebp - 0x2a4]
push ebx
push esi
mov byte [ebp - 4], 3
call fcn.00402c50
cmp dword [ebp - 0x21c], 0x10
mov eax, dword [ebp - 0x230]
jae 0x431b72
lea eax, [ebp - 0x230]
push dword [ebp - 0x26c]
mov ecx, dword [ebp - 0x260]
push eax
call fcn.00430a78
push ebx
push esi
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], bl
call fcn.00402c50
inc dword [ebp - 0x258]
jmp 0x431a21
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea ecx, [ebp - 0x250]
push 1
call fcn.00402c50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053aaae
leave
ret 4