Function at 0x4070e0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5442e1
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x5960c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor edi, edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x264], edi
mov dword [ebp - 0x258], edi
call fcn.00401ea0
push 0x2f
lea eax, [ebp - 0x43]
push edi
mov dword [ebp - 4], edi
push eax
mov byte [ebp - 0x44], 0
call fcn.00521f30
push 0x207
lea ecx, [ebp - 0x24b]
push edi
push ecx
mov byte [ebp - 0x24c], 0
call fcn.00521f30
add esp, 0x18
push str.INTERPASS3000_IBK
lea ecx, [ebp - 0x25c]
mov dword [ebp - 0x278], 0x208
mov dword [ebp - 0x274], edi
mov byte [ebp - 4], 1
call fcn.00401ea0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x25c]
mov edx, dword [ecx - 8]
mov eax, 1
sub eax, dword [ecx - 4]
or edx, eax
jge 0x4071ad
push edi
lea ecx, [ebp - 0x25c]
call fcn.00402080
mov ecx, dword [ebp - 0x25c]
lea edx, [ebp - 0x44]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4071b0
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x254], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
je 0x4071ed
lea edx, [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
lea ecx, [ebp - 0x250]
cmp dword [ebp - 0x254], edi
je 0x407204
push 0x39
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun
jmp 0x40720b
push 0x2d
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.00402150
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x254], edi
mov dword [ebp - 0x260], edi
call fcn.00412c50
mov edi, dword [ebp - 0x254]
mov ebx, dword [ebp - 0x260]
add esp, 4
xor esi, esi
nop
cmp esi, ebx
jae 0x407282
mov eax, esi
imul eax, eax, 0x402
add eax, edi
push str.certd2ka_IBK.exe
push eax
call fcn.0051bef0
add esp, 8
test eax, eax
je 0x40727f
xor eax, eax
push 0x58a844
lea ecx, [ebp - 0x268]
push ecx
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x268], eax
call fcn.005222e2
inc esi
jmp 0x407240
mov edx, dword [ebp - 0x250]
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
or ecx, eax
jge 0x4072aa
push 0
lea ecx, [ebp - 0x250]
call fcn.00402080
mov edx, dword [ebp - 0x250]
lea eax, [ebp - 0x264]
push eax
push 0x20019
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x258], eax
test eax, eax
je 0x4072e5
push 0x58a844
lea ecx, [ebp - 0x270]
push ecx
mov dword [ebp - 0x270], eax
call fcn.005222e2
lea edx, [ebp - 0x278]
push edx
lea eax, [ebp - 0x24c]
push eax
mov eax, dword [ebp - 0x264]
lea ecx, [ebp - 0x274]
push ecx
push 0
lea edx, [ebp - 0x44]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x258], eax
test eax, eax
je 0x40732e
push 0x58a844
lea ecx, [ebp - 0x26c]
push ecx
mov dword [ebp - 0x26c], eax
call fcn.005222e2
push ecx
mov edi, esp
mov dword [ebp - 0x260], esp
mov ebx, 0x708
mov dword [ebp - 0x260], edi
call fcn.004219a6
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40735c
push 0x80004005
call fcn.00402210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 3
test ecx, 0xffff0000
jne 0x407396
mov edx, ecx
movzx esi, dx
push esi
call fcn.00422d52
test eax, eax
je 0x4073b8
push esi
push eax
mov ecx, edi
call fcn.00401d30
jmp 0x4073b8
lea eax, [ebp - 0x24c]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4073a0
sub eax, edx
push eax
lea eax, [ebp - 0x24c]
push eax
mov ecx, edi
call fcn.00402150
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.0040dc80
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4073ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x264]
test eax, eax
je 0x4073fd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x250]
add eax, 0xfffffff0
mov dword [ebp - 0x264], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407430
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0051ac68
mov esp, ebp
pop ebp
ret