Function at 0x40a6a0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x492f5b
mov eax, dword fs:[0]
push eax
mov eax, 0x1030
call fcn.0047ce60
mov eax, dword [0x4d01d4]
xor eax, esp
mov dword [esp + 0x102c], eax
push ebx
push esi
push edi
mov eax, dword [0x4d01d4]
xor eax, esp
push eax
lea eax, [esp + 0x1040]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x27], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a8d2
push 0x7fe
lea edx, [esp + 0x842]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x848], cx
call fcn.00473d50
add esp, 0xc
push 0x400
lea eax, [esp + 0x840]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x7fe
lea edx, [esp + 0x42]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x48], cx
call fcn.00473d50
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x20]
push edx
push ebx
push str.DriveTheLife2013
push eax
mov dword [esp + 0x30], 1
call esi
test eax, eax
je 0x40a7ed
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push str.RegQueryValueEx_KEY_DTL2013__failed_code:_d_
push 0x1c6
push str..GlobalSetting.cpp
push 1
call fcn.0048ccc0
push eax
call fcn.0048c3e0
add esp, 0x18
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x20]
push eax
push ebx
push str.DriveTheLife2012
push ecx
call esi
test eax, eax
jne 0x40a7ed
call edi
push eax
push str.RegQueryValueEx_KEY_DTL2012__failed_code:_d_
push 0x1c9
push str..GlobalSetting.cpp
push 1
call fcn.0048ccc0
push eax
call fcn.0048c3e0
add esp, 0x18
lea edx, [esp + 0x83c]
push edx
push str.get_current_path__S_
push 0x1cc
push str..GlobalSetting.cpp
push 8
call fcn.0048ccc0
push eax
call fcn.0048c3e0
add esp, 0x18
lea eax, [esp + 0x3c]
push eax
push str.get_auto_run_path__S_
push 0x1cd
push str..GlobalSetting.cpp
push 8
call fcn.0048ccc0
push eax
call fcn.0048c3e0
add esp, 0x18
mov edi, 7
xor ecx, ecx
lea eax, [esp + 0x3c]
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40a853
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x40]
lea esi, [esp + 0x24]
call fcn.00403b50
mov dword [esp + 0x1048], ebx
lea edx, [esp + 0x83c]
push edx
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x40a893
mov byte [esp + 0x13], 1
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x1048], 0xffffffff
cmp dword [esp + 0x38], 8
jb 0x40a8bd
mov edx, dword [esp + 0x24]
push edx
call fcn.00471099
add esp, 4
xor eax, eax
mov word [esp + 0x24], ax
mov al, byte [esp + 0x13]
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
jmp 0x40a8fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RegOpenKeyEx_HKEY_LOCAL_MACHINE__failed_code:_d_
push 0x1d9
push str..GlobalSetting.cpp
push 1
call fcn.0048ccc0
push eax
call fcn.0048c3e0
add esp, 0x18
mov al, bl
mov ecx, dword [esp + 0x1040]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x102c]
xor ecx, esp
call fcn.00470f4c
add esp, 0x103c
ret