Function at 0x433430
Capabilities:
Persist via windows service
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4d044c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x60], 0
push edi
push esi
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0
push str.SYSTEMCurrentControlSetServicesK7ElamData
push reloc.OLEAUT32.dll_SysReAllocString
movaps xmmword [ebp - 0x40], xmm0
movaps xmmword [ebp - 0x30], xmm0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x5c], 4
call fcn.0045e320
mov dword [ebp - 0x54], eax
test eax, eax
je 0x43368e
push esi
push esi
push esi
lea ecx, [ebp - 0x44]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x4334d7
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x4334d7
cmp eax, 0x400
ja 0x43368e
jmp 0x4334dc
mov eax, 0x190
inc eax
push eax
mov dword [ebp - 0x44], eax
call fcn.0048b928
mov edi, eax
add esp, 4
test edi, edi
je 0x43368e
push dword [ebp - 0x44]
push 0
push edi
call fcn.004644e0
add esp, 0xc
push dword [ebp - 0x44]
push edi
push dword [ebp - 0x58]
push dword [ebp - 0x54]
call fcn.0045e2b0
test eax, eax
je 0x43366f
inc dword [ebp - 0x58]
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push edi
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4334f3
cmp dword [ebp - 0x48], eax
jne 0x4334f3
push dword [ebp - 0x5c]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 1
push eax
push 4
push 0
push edi
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x50]
push eax
lea edx, [ebp - 0x60]
call fcn.00433130
add esp, 0xc
test eax, eax
je 0x4334f3
test esi, esi
jne 0x433593
mov eax, dword [ebp - 0x44]
add eax, 0x64
push eax
call fcn.0048b928
mov esi, eax
add esp, 4
mov dword [ebp - 0x4c], esi
test esi, esi
je 0x43367c
mov ecx, dword [ebp - 0x44]
add ecx, 0x64
push ecx
push 0
push esi
call fcn.004644e0
push 0xafc9
push str.ID_d
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, eax
add esi, dword [ebp - 0x4c]
push 0
call fcn.0048baa1
push eax
push str.TS_lu
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esi, eax
mov ecx, str.NULL
mov eax, dword [ebp - 0x60]
test eax, eax
cmovne ecx, eax
push ecx
push str.FN_s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 0x50]
add esi, eax
test ecx, ecx
mov eax, str.NULL
cmovne eax, ecx
push eax
push str.AH_s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esi, eax
add esp, 0x40
mov eax, dword [ebp - 0x64]
mov ecx, str.NULL
test eax, eax
cmovne ecx, eax
push ecx
push str.AL_s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esi, eax
lea eax, [ebp - 0x40]
push eax
push str.MD5_s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esi, eax
mov dl, 2
sub esi, dword [ebp - 0x4c]
mov ecx, str.Elam
inc esi
push esi
mov esi, dword [ebp - 0x4c]
push esi
call fcn.00432c10
mov eax, dword [ebp - 0x50]
add esp, 0x20
test eax, eax
je 0x4334f3
push eax
call fcn.0048b923
add esp, 4
mov dword [ebp - 0x50], 0
jmp 0x4334f3
test esi, esi
je 0x43367c
push esi
call fcn.0048b923
add esp, 4
push edi
call fcn.0048b923
add esp, 4
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004606ac
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret