Function at 0x406f20
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x45600c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20c], 0x1fe
cmp ecx, 1
jne 0x407036
lea eax, [ebp - 0x208]
push eax
push 0x20119
push 0
push str.SOFTWARE
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40727f
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push 0
push 0
push str.crypted
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40727f
mov ecx, str.0__:
lea eax, [ebp - 0x204]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x406fc8
test dx, dx
je 0x406fc4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x406fc8
add eax, 4
add ecx, 4
test dx, dx
jne 0x406fa2
xor eax, eax
jmp 0x406fcd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x406fe1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004261dc
mov esp, ebp
pop ebp
ret
mov ecx, 0x44db20
lea eax, [ebp - 0x204]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407016
test dx, dx
je 0x407012
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407016
add eax, 4
add ecx, 4
test dx, dx
jne 0x406ff0
xor eax, eax
jmp 0x40701b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x407273
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004261dc
mov esp, ebp
pop ebp
ret
cmp ecx, 2
jne 0x4070ba
lea eax, [ebp - 0x208]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40727f
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push 0
push 0
push str.allkeeper
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40727f
lea ecx, [ebp - 0x204]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407095
sub ecx, edx
xor eax, eax
sar ecx, 1
cmp eax, ecx
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004261dc
mov esp, ebp
pop ebp
ret
cmp ecx, 3
jne 0x407195
lea eax, [ebp - 0x208]
push eax
push 0x20119
push 0
push str.SOFTWARE
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40727f
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push 0
push 0
push str.testdecrypt
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40727f
mov ecx, str.0__:
lea eax, [ebp - 0x204]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407146
test dx, dx
je 0x407142
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407146
add eax, 4
add ecx, 4
test dx, dx
jne 0x407120
xor eax, eax
jmp 0x40714b
sbb eax, eax
or eax, 1
test eax, eax
je 0x406fd1
mov ecx, 0x44db20
lea eax, [ebp - 0x204]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407016
test dx, dx
je 0x407012
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407016
add eax, 4
add ecx, 4
test dx, dx
jne 0x407160
xor eax, eax
jmp 0x40701b
cmp ecx, 4
jne 0x40727f
lea eax, [ebp - 0x208]
push eax
push 0x20119
push 0
push str.SOFTWARE
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40727f
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push 0
push 0
push str.Decrypt50
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40727f
mov ecx, str.0__:
lea eax, [ebp - 0x204]
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407226
test dx, dx
je 0x407222
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407226
add eax, 4
add ecx, 4
test dx, dx
jne 0x407200
xor eax, eax
jmp 0x40722b
sbb eax, eax
or eax, 1
test eax, eax
je 0x406fd1
mov ecx, 0x44db20
lea eax, [ebp - 0x204]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407266
test dx, dx
je 0x407262
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407266
add eax, 4
add ecx, 4
test dx, dx
jne 0x407240
xor eax, eax
jmp 0x40726b
sbb eax, eax
or eax, 1
test eax, eax
je 0x407023
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.004261dc
mov esp, ebp
pop ebp
ret