Function at 0x413ae2
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x370
mov eax, dword [0x4242b4]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x368], ecx
call fcn.0040d401
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor esi, esi
test eax, eax
jne 0x413b1e
call fcn.0040d7cb
test eax, eax
je 0x413b95
push esi
lea eax, [ebp - 0x364]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x404a80
push 0x80000002
call ebx
cmp eax, esi
jne 0x413b88
push 4
lea eax, [ebp - 0x36c]
push eax
push 4
push esi
push 0x406294
push dword [ebp - 0x364]
mov dword [ebp - 0x36c], 1
call edi
cmp eax, esi
je 0x413b70
push eax
push 0x406250
call fcn.0040be00
pop ecx
pop ecx
push dword [ebp - 0x364]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x413b95
push eax
push 0x40620c
jmp 0x413b8e
push eax
push 0x4061c8
call fcn.0040be00
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x364]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x4061ac
push 0x80000002
call ebx
cmp eax, esi
jne 0x413d82
mov ecx, dword [ebp - 0x368]
test byte [ecx + 0x6b], 8
je 0x413bd6
call fcn.004115c4
test eax, eax
mov dword [ebp - 0x370], 1
jne 0x413bdc
mov dword [ebp - 0x370], esi
push 4
lea eax, [ebp - 0x370]
push eax
push 4
push esi
push 0x406198
push dword [ebp - 0x364]
call edi
push dword [ebp - 0x364]
mov dword [ebp - 0x36c], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x413c18
push eax
push 0x406150
call fcn.0040be00
pop ecx
pop ecx
cmp dword [ebp - 0x36c], esi
je 0x413c30
push dword [ebp - 0x36c]
push 0x406108
jmp 0x413d88
call fcn.0040dcd4
test eax, eax
jne 0x413c42
call fcn.0040ddf3
test eax, eax
je 0x413c5a
mov ecx, dword [ebp - 0x368]
push 0x4060fc
call fcn.00410a48
test eax, eax
je 0x413d8f
mov eax, dword [ebp - 0x368]
push 0x4060ec
add eax, 0x384
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0040c2ca
test eax, eax
jne 0x413c85
push 0x4060c4
jmp 0x413d76
mov ecx, dword [ebp - 0x368]
test byte [ecx + 0x6b], 8
je 0x413c9f
call fcn.004115c4
test eax, eax
mov eax, 0x4060b8
jne 0x413ca4
mov eax, 0x4060b4
push esi
push eax
lea eax, [ebp - 0x108]
push eax
push 0x401820
lea eax, [ebp - 0x360]
push 0x258
push eax
call fcn.0041ae94
add esp, 0x18
test eax, eax
jge 0x413cd4
push 0x40608c
jmp 0x413d76
mov ecx, dword [ebp - 0x368]
mov eax, dword [ecx + 0x178]
cmp eax, 1
jne 0x413d5c
push esi
lea eax, [ebp - 0x364]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x40605c
push 0x80000002
call ebx
cmp eax, esi
jne 0x413d54
lea eax, [ebp - 0x360]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x360]
push eax
push 1
push esi
push 0x406050
push dword [ebp - 0x364]
call edi
push dword [ebp - 0x364]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x413d48
push eax
push 0x40601c
call fcn.0040be00
pop ecx
pop ecx
cmp edi, esi
je 0x413d7d
push edi
push 0x405fe4
jmp 0x413d88
push eax
push 0x405fb0
jmp 0x413d88
cmp eax, esi
jne 0x413d7d
push esi
lea eax, [ebp - 0x360]
push eax
call fcn.0041098f
test eax, eax
jne 0x413d7d
push 0x405f8c
call fcn.0040be00
jmp 0x413d8e
xor eax, eax
inc eax
jmp 0x413d91
push eax
push 0x405f40
call fcn.0040be00
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0041a84f
leave
ret