Function at 0x40f090
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x557a63
mov eax, dword fs:[0]
push eax
sub esp, 0x38c
mov eax, dword [0x5adf10]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x370]
mov dword [ebp - 0x378], ebx
mov dword [ebp - 0x374], ebx
call fcn.00405fd0
push 0x2f
lea eax, [ebp - 0x43]
push ebx
mov dword [ebp - 4], ebx
push eax
mov byte [ebp - 0x44], bl
call fcn.005344b0
add esp, 0xc
push 0x207
lea ecx, [ebp - 0x24f]
push ebx
push ecx
mov byte [ebp - 0x250], bl
call fcn.005344b0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x358]
push ebx
push edx
mov dword [ebp - 0x38c], 0x208
mov dword [ebp - 0x394], ebx
mov byte [ebp - 4], 1
call fcn.005344b0
add esp, 0xc
lea ecx, [ebp - 0x358]
call fcn.004178d0
lea eax, [ebp - 0x358]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40f150
mov ecx, dword [0x585730]
mov edx, dword [0x585734]
mov dword [eax], ecx
mov ecx, dword [0x585738]
mov dword [eax + 4], edx
lea edx, [ebp - 0x358]
push edx
mov dword [eax + 8], ecx
call fcn.004179d0
mov edi, eax
mov dword [ebp - 0x35c], eax
cmp edi, 1
jle 0x40f196
mov edi, 1
mov dword [ebp - 0x35c], edi
push 0x586bff
lea ecx, [ebp - 0x36c]
call fcn.00405fd0
mov byte [ebp - 4], 2
cmp edi, ebx
jne 0x40f1b7
push 9
push str.gmMgr_cse
jmp 0x40f1c3
cmp edi, 1
jne 0x40f1ce
push 0x14
push str.CNSRCB_ETOKEY_Client
lea ecx, [ebp - 0x36c]
call fcn.00406280
mov ecx, dword [ebp - 0x36c]
mov edx, dword [ecx - 8]
mov eax, 1
sub eax, dword [ecx - 4]
or edx, eax
jge 0x40f1f5
push ebx
lea ecx, [ebp - 0x36c]
call fcn.004061b0
mov ecx, dword [ebp - 0x36c]
lea edx, [ebp - 0x44]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40f1f8
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x364], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x40f235
lea eax, [ebp - 0x364]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
lea ecx, [ebp - 0x370]
cmp dword [ebp - 0x364], ebx
je 0x40f24c
push 0x39
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun
jmp 0x40f253
push 0x2d
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.00406280
lea ecx, [ebp - 0x364]
push ecx
lea ecx, [ebp - 0x37c]
mov dword [ebp - 0x37c], ebx
mov dword [ebp - 0x364], ebx
call fcn.0041bf70
mov ebx, dword [ebp - 0x37c]
add esp, 4
xor esi, esi
cmp esi, dword [ebp - 0x364]
jae 0x40f32a
test edi, edi
jne 0x40f2cc
mov eax, esi
imul eax, eax, 0x402
add eax, ebx
push str.gmMgr_cse.exe
push eax
call fcn.0052e630
add esp, 8
test eax, eax
je 0x40f324
xor eax, eax
push 0x5a0810
lea edx, [ebp - 0x380]
push edx
mov dword [ebp - 0x374], eax
mov dword [ebp - 0x380], eax
call fcn.00534862
cmp edi, 1
jne 0x40f324
mov edi, esi
imul edi, edi, 0x402
add edi, ebx
push 0x587594
push edi
call fcn.0052e630
add esp, 8
test eax, eax
jne 0x40f2ff
push 0x587594
push edi
call fcn.0052e630
add esp, 8
test eax, eax
je 0x40f31e
xor eax, eax
push 0x5a0810
lea ecx, [ebp - 0x390]
push ecx
mov dword [ebp - 0x374], eax
mov dword [ebp - 0x390], eax
call fcn.00534862
mov edi, dword [ebp - 0x35c]
inc esi
jmp 0x40f281
mov edx, dword [ebp - 0x370]
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
or ecx, eax
jge 0x40f352
push 0
lea ecx, [ebp - 0x370]
call fcn.004061b0
mov edx, dword [ebp - 0x370]
lea eax, [ebp - 0x378]
push eax
push 0x20019
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x374], eax
test eax, eax
je 0x40f38d
push 0x5a0810
lea ecx, [ebp - 0x384]
push ecx
mov dword [ebp - 0x384], eax
call fcn.00534862
lea edx, [ebp - 0x38c]
push edx
lea eax, [ebp - 0x250]
push eax
mov eax, dword [ebp - 0x378]
lea ecx, [ebp - 0x394]
push ecx
push 0
lea edx, [ebp - 0x44]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x374], eax
test eax, eax
je 0x40f3d6
push 0x5a0810
lea ecx, [ebp - 0x388]
push ecx
mov dword [ebp - 0x388], eax
call fcn.00534862
push ecx
mov edi, esp
mov dword [ebp - 0x368], esp
mov ebx, 0x708
mov dword [ebp - 0x368], edi
call fcn.0043c63a
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40f404
push 0x80004005
call fcn.004063a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 3
test ecx, 0xffff0000
jne 0x40f43e
mov edx, ecx
movzx esi, dx
push esi
call fcn.0043d607
test eax, eax
je 0x40f45f
push esi
push eax
mov ecx, edi
call fcn.00405e20
jmp 0x40f45f
lea eax, [ebp - 0x250]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f447
sub eax, edx
push eax
lea eax, [ebp - 0x250]
push eax
mov ecx, edi
call fcn.00406280
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.0040f8f0
add esp, 4
cmp dword [ebp - 0x35c], 1
jne 0x40f85c
lea ecx, [ebp - 0x250]
push ecx
lea ecx, [ebp - 0x35c]
call fcn.00405fd0
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x35c]
push 0x5c
push edx
call fcn.0052e0c8
add esp, 8
test eax, eax
jne 0x40f4aa
or eax, 0xffffffff
jmp 0x40f4b0
sub eax, dword [ebp - 0x35c]
push eax
lea eax, [ebp - 0x368]
push eax
lea ecx, [ebp - 0x35c]
call fcn.00406680
mov byte [ebp - 4], 5
mov ecx, dword [eax]
mov esi, dword [ebp - 0x35c]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x40f524
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x40f514
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x40f514
push eax
call fcn.00406330
mov ebx, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x40f509
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [ebp - 0x35c], ebx
jmp 0x40f524
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x35c]
call fcn.00406280
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x368]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f54a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x5875b0
lea ecx, [ebp - 0x35c]
push ecx
lea edx, [ebp - 0x360]
push edx
call fcn.00414160
add esp, 0xc
mov byte [ebp - 4], 6
mov ebx, dword [ebp - 0x37c]
xor edi, edi
xor esi, esi
cmp esi, dword [ebp - 0x364]
jae 0x40f59e
mov eax, esi
imul eax, eax, 0x402
add eax, ebx
push 0x587594
push eax
call fcn.0052e630
add esp, 8
test eax, eax
jne 0x40f660
inc esi
jmp 0x40f573
test edi, edi
jne 0x40f660
mov edx, dword [ebp - 0x360]
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
mov ebx, 0x708
or ecx, eax
jge 0x40f5d2
push edi
lea ecx, [ebp - 0x360]
call fcn.004061b0
mov edx, dword [ebp - 0x360]
push ecx
mov edi, esp
mov dword [ebp - 0x368], esp
mov esi, edx
mov dword [ebp - 0x368], edi
call fcn.0043c63a
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40f5fd
push 0x80004005
call fcn.004063a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 7
test esi, esi
je 0x40f633
test esi, 0xffff0000
jne 0x40f637
movzx esi, si
push esi
call fcn.0043d607
test eax, eax
je 0x40f652
push esi
push eax
mov ecx, edi
call fcn.00405e20
jmp 0x40f652
xor eax, eax
jmp 0x40f649
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f640
sub eax, edx
push eax
push esi
mov ecx, edi
call fcn.00406280
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.0040f8f0
add esp, 4
push 0x5875b0
lea ecx, [ebp - 0x35c]
push ecx
lea edx, [ebp - 0x368]
push edx
call fcn.00414160
add esp, 0xc
mov byte [ebp - 4], 8
mov eax, dword [eax]
mov ebx, dword [ebp - 0x360]
lea esi, [eax - 0x10]
add ebx, 0xfffffff0
cmp esi, ebx
je 0x40f72f
cmp dword [ebx + 0xc], 0
jl 0x40f71f
mov ecx, dword [esi]
cmp ecx, dword [ebx]
jne 0x40f71f
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x40f6c6
cmp eax, dword [esi]
jne 0x40f6c6
mov edi, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x40f6fb
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
jne 0x40f6df
call fcn.00406320
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
inc eax
push eax
add esi, 0x10
push esi
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.0052d9b7
add esp, 0x10
lea eax, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [eax], edx
dec edx
test edx, edx
jg 0x40f714
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
add edi, 0x10
mov dword [ebp - 0x360], edi
jmp 0x40f72f
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x360]
call fcn.00406280
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x368]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f755
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebp - 0x360]
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
mov ebx, 0x708
or ecx, eax
jge 0x40f782
push 0
lea ecx, [ebp - 0x360]
call fcn.004061b0
mov edx, dword [ebp - 0x360]
push ecx
mov edi, esp
mov dword [ebp - 0x364], esp
mov esi, edx
mov dword [ebp - 0x364], edi
call fcn.0043c63a
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40f7ad
push 0x80004005
call fcn.004063a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 9
test esi, esi
je 0x40f7e3
test esi, 0xffff0000
jne 0x40f7e7
movzx esi, si
push esi
call fcn.0043d607
test eax, eax
je 0x40f802
push esi
push eax
mov ecx, edi
call fcn.00405e20
jmp 0x40f802
xor eax, eax
jmp 0x40f7f9
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f7f0
sub eax, edx
push eax
push esi
mov ecx, edi
call fcn.00406280
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.0040f8f0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x360]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f836
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x35c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f85c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x36c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f882
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x378]
test eax, eax
je 0x40f893
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x370]
add eax, 0xfffffff0
mov dword [ebp - 0x378], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f8c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x374]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052d75c
mov esp, ebp
pop ebp
ret