Function at 0x4083d0
Capabilities:
Get session user name
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x422040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.00401d50
test al, al
je 0x408524
push ebx
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x314], 0xff
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x40843e
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416a63
mov esp, ebp
pop ebp
ret
call fcn.00407e00
mov dword [ebp - 0x318], eax
test eax, eax
je 0x40842a
mov esi, eax
push edi
mov edi, esi
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x408455
lea ebx, [ebp - 0x104]
sub edi, ecx
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x408467
sub ebx, ecx
cmp ebx, edi
jg 0x4084a3
mov eax, ebx
sub eax, esi
mov dword [ebp - 0x310], eax
nop
push ebx
lea eax, [ebp - 0x104]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbicmp]
add esp, 0xc
test eax, eax
je 0x4084c7
mov eax, dword [ebp - 0x310]
inc esi
add eax, esi
cmp eax, edi
jle 0x408480
xor ebx, ebx
push dword [ebp - 0x318]
call dword [sym.imp.mfc140.dll_Ordinal_266]
add esp, 4
mov eax, ebx
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416a63
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4084a3
cmp esi, dword [ebp - 0x318]
jbe 0x4084f7
mov al, byte [esi - 1]
cmp al, 0x2c
je 0x4084f7
cmp al, 0x3b
je 0x4084f7
lea ecx, [ebp - 0x104]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4084e7
sub ecx, edx
add esi, ecx
jmp 0x408450
lea ecx, [ebp - 0x104]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408500
sub ecx, edx
add esi, ecx
mov al, byte [esi]
test al, al
je 0x40851d
cmp al, 0x2c
je 0x40851d
cmp al, 0x3b
jne 0x408450
mov ebx, 1
jmp 0x4084a5
push 0xfe
lea eax, [ebp - 0x30c]
mov dword [ebp - 0x310], 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x30c]
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x408550
mov eax, dword [str.__quiet]
movups xmm0, xmmword [str.SOFTWAREMicrosoftWindowsCurrentVersionRun]
mov dword [ecx], eax
mov eax, dword [0x41b368]
mov dword [ecx + 4], eax
mov eax, dword [0x41b394]
mov dword [ebp - 0x1e0], eax
mov ax, word [0x41b398]
mov word [ebp - 0x1dc], ax
lea eax, [ebp - 0x318]
push eax
movups xmmword [ebp - 0x208], xmm0
push 0xf003f
movups xmm0, xmmword [0x41b37c]
push 0
lea eax, [ebp - 0x208]
movups xmmword [ebp - 0x1f8], xmm0
push eax
movq xmm0, qword [0x41b38c]
push 0x80000002
movq qword [ebp - 0x1e8], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4085e2
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416a63
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0x41b39c
push dword [ebp - 0x318]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
push dword [ebp - 0x318]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop esi
sete al
xor ecx, ebp
call fcn.00416a63
mov esp, ebp
pop ebp
ret