Function at 0x406359
Capabilities:
Persist via run registry key

Disassembly:
push 0x228
mov eax, 0x40c52c
call fcn.0040bbad
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov eax, dword [0x40f038]
cmp eax, 0x40f038
je 0x406394
test byte [eax + 0x1c], 8
je 0x406394
push edi
push dword [eax + 0x14]
mov edx, 0x401cc0
push dword [eax + 0x10]
push 0x24
pop ecx
call fcn.0040417f
lea eax, [ebp - 0x21c]
push eax
push ecx
push 3
push 0
push ecx
push 0x40f3d8
push 0x80000001
mov ecx, ebx
call fcn.004040c6
mov esi, eax
test esi, esi
je 0x4063ef
mov eax, dword [0x40f038]
cmp eax, 0x40f038
je 0x4063d9
test byte [eax + 0x1c], 8
je 0x4063d9
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x25
pop ecx
call fcn.00404152
test esi, esi
jle 0x40667d
movzx esi, si
or esi, 0x80070000
jmp 0x40667d
push ecx
push edi
push 0x40f33c
mov ecx, ebx
call fcn.00403b6d
mov esi, eax
test esi, esi
je 0x406420
mov eax, dword [0x40f038]
cmp eax, 0x40f038
je 0x4063d9
test byte [eax + 0x1c], 8
je 0x4063d9
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x26
jmp 0x4063d3
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x22c], ecx
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], ecx
push eax
push 0x20019
push ecx
push 0x401b70
push 0x80000001
mov dword [ebp - 0x21c], ecx
call dword [section..idata]
mov esi, eax
test esi, esi
jne 0x406639
mov ebx, dword [ebp - 0x21c]
push 0x208
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x234], ebx
push eax
call fcn.0040c118
add esp, 0xc
mov dword [ebp - 0x21c], 0x104
lea eax, [ebp - 0x21c]
lea ecx, [ebp - 0x234]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x401bf4
call fcn.00403c20
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x228]
call fcn.004068b5
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x224]
call fcn.004068b5
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x220]
call fcn.004068b5
push 0x401c04
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 3
call fcn.004068fb
push 0x401c34
lea ecx, [ebp - 0x224]
call fcn.004068fb
push 0x401c50
lea ecx, [ebp - 0x220]
call fcn.004068fb
push dword [ebp - 0x228]
call dword [0x410294]
cmp eax, 0xffffffff
je 0x40656e
push 0x401c70
mov ecx, edi
call fcn.004073d7
push dword [ebp - 0x228]
call dword [0x410290]
mov eax, dword [0x40f038]
mov esi, 0x40f038
cmp eax, esi
je 0x406573
test byte [eax + 0x1c], 0x10
je 0x406573
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x28
pop ecx
call fcn.0040412b
jmp 0x406573
mov esi, 0x40f038
push dword [ebp - 0x224]
call dword [0x410294]
cmp eax, 0xffffffff
je 0x4065b9
push 0x401c80
mov ecx, edi
call fcn.004073d7
push dword [ebp - 0x224]
call dword [0x410290]
mov eax, dword [0x40f038]
cmp eax, esi
je 0x4065b9
test byte [eax + 0x1c], 0x10
je 0x4065b9
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x29
pop ecx
call fcn.0040412b
push dword [ebp - 0x220]
call dword [0x410294]
cmp eax, 0xffffffff
je 0x4065ff
push 0x401ca0
mov ecx, edi
call fcn.004073d7
push dword [ebp - 0x220]
call dword [0x410290]
mov eax, dword [0x40f038]
cmp eax, esi
je 0x4065ff
test byte [eax + 0x1c], 0x10
je 0x4065ff
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2a
pop ecx
call fcn.0040412b
mov byte [ebp - 4], 2
xor esi, esi
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.0040735d
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x224]
lea ecx, [ecx - 0x10]
call fcn.0040735d
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x228]
lea ecx, [ecx - 0x10]
call fcn.0040735d
jmp 0x406667
mov eax, dword [0x40f038]
cmp eax, 0x40f038
je 0x40665a
test byte [eax + 0x1c], 8
je 0x40665a
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x27
pop ecx
call fcn.00404152
test esi, esi
jle 0x406667
movzx esi, si
or esi, 0x80070000
or dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x40667d
push ebx
call dword [0x410004]
and dword [ebp - 0x234], 0
mov eax, esi
call fcn.0040bb4d
ret 0xc