Function at 0x40e960
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov ebx, edx
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x214], 0
lea eax, [ebp - 0x214]
xor esi, esi
push eax
push 0x20006
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x40e9e4
push esi
lea eax, [ebp - 0x214]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40ea12
push 0x10
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40ebbd
mov dword [esi + 4], 0x20006
mov eax, dword [ebp - 0x214]
mov dword [esi], eax
test esi, esi
je 0x40ebbd
push edi
lea ecx, [ebp - 0x20c]
mov edi, 0x48bad8
mov eax, ecx
mov edx, 0x104
sub edi, eax
nop
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x40ea4e
movzx eax, word [edi + ecx]
test ax, ax
je 0x40ea4e
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x40ea30
jmp 0x40ea52
test edx, edx
jne 0x40ea55
sub ecx, 2
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x20c]
call fcn.0040e570
mov edi, 0x104
test eax, eax
js 0x40ea90
mov eax, dword [ebp - 0x210]
mov edx, edi
push ecx
push ebx
push ecx
lea ecx, [ebp - 0x20c]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0040e5d0
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x20c]
call fcn.0040e570
test eax, eax
js 0x40eac5
mov eax, dword [ebp - 0x210]
mov edx, edi
push ecx
push 0x48bad8
push ecx
lea ecx, [ebp - 0x20c]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0040e5d0
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x20c]
call fcn.0040e570
test eax, eax
js 0x40eafa
mov eax, dword [ebp - 0x210]
mov edx, edi
push ecx
push 0x48b8e8
push ecx
lea ecx, [ebp - 0x20c]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0040e5d0
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x20c]
call fcn.0040e570
test eax, eax
js 0x40eb2f
mov eax, dword [ebp - 0x210]
sub edi, eax
push ecx
push str._s_auto
push ecx
lea ecx, [ebp - 0x20c]
mov edx, edi
lea ecx, [ecx + eax*2]
call fcn.0040e5d0
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
pop edi
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40eb40
sub ecx, edx
sar ecx, 1
test byte [esi + 4], 2
jne 0x40eb5c
mov eax, 5
jmp 0x40eb7f
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push 0x48a950
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [esi + 0xc], eax
xor ebx, ebx
test eax, eax
mov eax, dword [esi]
sete bl
test eax, eax
je 0x40eb9b
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452da4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.00452da4
mov esp, ebp
pop ebp
ret