Function at 0x401590
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x402d11
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1f0
push esi
push str.SOFTWAREMicrosoftWindowsCurrentverSionRun
lea ecx, [esp + 0x10]
mov dword [esp + 0x200], 1
call fcn.004026fe
lea eax, [esp + 8]
xor esi, esi
push eax
push 0xf003f
push esi
push esi
lea ecx, [esp + 0x1c]
mov byte [esp + 0x20c], 2
call sub.MFC42.DLL_CString::GetBuffer
push eax
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401648
lea ecx, [esp + 0xc]
mov byte [esp + 0x1fc], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x204]
mov byte [esp + 0x1fc], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x208]
mov dword [esp + 0x1fc], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1f0]
mov dword fs:[0], ecx
add esp, 0x1fc
ret
push ebx
push ebp
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xf8]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x32
xor eax, eax
lea edi, [esp + 0x30]
lea edx, [esp + 0x30]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x30]
push esi
lea edx, [esp + 0x108]
push ecx
push edx
push esi
push eax
mov dword [esp + 0x48], esi
mov dword [esp + 0x44], 0x105
mov dword [esp + 0x3c], 0xc8
call ebp
cmp eax, esi
jne 0x4017c2
mov bl, 3
call sub.MFC42.DLL_AfxGetEmptyString
mov ecx, dword [eax]
lea edx, [esp + 0x30]
mov dword [esp + 0x10], ecx
push edx
lea ecx, [esp + 0x14]
call fcn.0040271c
lea eax, [esp + 0xf8]
lea ecx, [esp + 0x20]
push eax
mov byte [esp + 0x20c], bl
call fcn.004026fe
mov ecx, dword [esp + 0x210]
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.MSVCRT.dll__mbscmp]
push ecx
push edx
call edi
add esp, 8
test eax, eax
jne 0x401719
mov eax, dword [esp + 0x214]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call edi
add esp, 8
test eax, eax
je 0x401799
lea ecx, [esp + 0x20]
mov byte [esp + 0x208], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x208], 2
call sub.MFC42.DLL_CString::CString
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xf8]
lea edx, [esp + 0x1c]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x32
xor eax, eax
lea edi, [esp + 0x30]
push edx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
lea ecx, [esp + 0x30]
push eax
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x30]
push 0
lea eax, [esp + 0x108]
inc esi
push edx
push eax
push esi
push ecx
mov dword [esp + 0x44], 0x105
mov dword [esp + 0x3c], 0xc8
call ebp
test eax, eax
je 0x4016b2
jmp 0x4017c2
lea ecx, [esp + 0x20]
mov dword [esp + 0x28], 1
mov byte [esp + 0x208], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x208], 2
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x18]
mov byte [esp + 0x208], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x210]
mov byte [esp + 0x208], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x214]
mov dword [esp + 0x208], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x200]
mov eax, dword [esp + 0x28]
pop edi
pop ebp
pop ebx
pop esi
mov dword fs:[0], ecx
add esp, 0x1fc
ret