Function at 0x4043a0
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e3e3
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x44000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x460], ebx
push dword [ebp - 0x45c]
lea eax, [ebx + 0x20]
push eax
push 0x440a40
call fcn.00401ec0
add esp, 8
movzx eax, ax
mov ecx, ebx
push eax
push 0
push 0
push 0x56000000
push 0
push 0
push 0xfffffffffffffffd
call fcn.00401a80
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x404459
mov eax, dword [0x441dbc]
test eax, eax
jne 0x404439
push ecx
mov edx, str.Log_Debug
xor ecx, ecx
call fcn.0040c188
add esp, 4
neg eax
sbb eax, eax
neg eax
inc eax
mov dword [0x441dbc], eax
cmp eax, 2
jne 0x404786
push str._POP__CPopHelper::Run__Create_CPopHelper_Wnd_Failed
push str.Log_Debug
call fcn.0040b248
add esp, 8
jmp 0x404786
mov eax, dword [ebx + 4]
lea ecx, [ebp - 0x28]
mov dword [0x441df0], eax
xor eax, eax
push 0x2d
push str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00403140
mov dword [ebp - 4], 0
lea eax, [ebp - 0x444]
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 0x200
mov dword [ebp - 0x448], eax
mov byte [ebp - 4], 1
call fcn.0040b2d0
mov edx, 0x22
lea ecx, [ebp - 0x450]
call fcn.004050e0
cmp word [0x442a80], 0
mov edi, eax
je 0x404524
mov esi, 0x442a80
lea ecx, [esi + 2]
nop dword [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4044e0
sub esi, ecx
sar esi, 1
je 0x404524
mov ebx, dword [edi]
add ebx, esi
cmp ebx, dword [edi + 4]
jb 0x404502
push ebx
mov ecx, edi
call fcn.00405160
mov ecx, dword [edi]
lea eax, [esi + esi]
push eax
mov eax, dword [edi + 8]
push 0x442a80
lea eax, [eax + ecx*2]
push eax
call fcn.0042d5d0
mov dword [edi], ebx
add esp, 0xc
mov ebx, dword [ebp - 0x460]
mov edx, 0x22
mov ecx, edi
call fcn.004050e0
mov edi, eax
mov esi, dword [edi]
add esi, 0xb
cmp esi, dword [edi + 4]
jb 0x404544
push esi
mov ecx, edi
call fcn.00405160
mov ecx, dword [edi]
mov eax, dword [edi + 8]
movups xmm0, xmmword [str.__autostart]
mov dword [ebp - 0x454], 0
lea ecx, [eax + ecx*2]
movups xmmword [ecx], xmm0
mov eax, dword [0x437c04]
mov dword [ecx + 0x10], eax
mov ax, word [0x437c08]
mov word [ecx + 0x14], ax
lea ecx, [ebp - 0x454]
push ecx
mov dword [edi], esi
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push 1
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [ebp - 0x454]
test eax, eax
je 0x4045ed
lea ecx, [ebp - 0x460]
mov dword [ebp - 0x45c], 0
push ecx
push 0
lea ecx, [ebp - 0x45c]
mov dword [ebp - 0x460], 0
push ecx
push 0
push 0x437c0c
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x454]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
test al, al
jne 0x404708
mov ecx, dword [ebp - 0x448]
xor edx, edx
mov eax, dword [ebp - 0x450]
mov word [ecx + eax*2], dx
lea ecx, [ebp - 0x40]
push dword [ebp - 0x448]
call fcn.00403240
mov eax, dword [ebp - 0x30]
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea edi, [ebp - 0x40]
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x458]
cmovae esi, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push eax
cmovae edi, dword [ebp - 0x40]
push 2
push 0
push esi
push SysReAllocString
mov dword [ebp - 0x458], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x404685
lea eax, [ebp - 0x454]
mov dword [ebp - 0x454], 0
push eax
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov ecx, dword [ebp - 0x454]
test eax, eax
je 0x40467d
test ecx, ecx
je 0x404685
mov dword [ebp - 0x458], ecx
jmp 0x40468b
mov ecx, dword [ebp - 0x458]
test ecx, ecx
je 0x4046ba
mov eax, dword [ebp - 0x45c]
lea eax, [eax*2 + 2]
push eax
push edi
push 1
push 0
push 0x437c0c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x458]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4046cc
inc eax
push eax
push dword [ebp - 0x40]
call fcn.00402680
mov eax, dword [0x441dbc]
test eax, eax
jne 0x4046f1
push ecx
mov edx, str.Log_Debug
xor ecx, ecx
call fcn.0040c188
add esp, 4
neg eax
sbb eax, eax
neg eax
inc eax
mov dword [0x441dbc], eax
cmp eax, 2
jne 0x404708
push str.CPopHelper::Run____
push str.Log_Debug
call fcn.0040b248
add esp, 8
push ecx
lea ecx, [ebx + 0x24]
call fcn.004078a4
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x47c]
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x40475b
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x47c]
push eax
call edi
lea eax, [ebp - 0x47c]
push eax
call ebx
push 0
push 0
push 0
lea eax, [ebp - 0x47c]
push eax
call esi
test eax, eax
jne 0x404736
mov eax, dword [ebp - 0x448]
lea ecx, [ebp - 0x444]
cmp eax, ecx
je 0x404774
push eax
call fcn.0041aac0
add esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x404786
inc eax
push eax
push dword [ebp - 0x28]
call fcn.00402680
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004171a2
mov esp, ebp
pop ebp
ret