Function at 0x40bee0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa54
mov eax, dword [0x4b555c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0xa54], ecx
mov dword [ebp - 0x948], 0xffffffff
mov dword [ebp - 0x118], 0xffffffff
cmp dword [ebp + 8], 0
jne 0x40bf1d
mov eax, 0x28000002
jmp 0x40c23e
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x938], 0x100
mov dword [ebp - 0x934], 0
lea eax, [ebp - 0x528]
mov dword [ebp - 0x93c], eax
mov dword [ebp - 0x124], 0
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 4], 0
lea edx, [ebp - 0x930]
mov dword [ebp - 4], edx
push 0x105
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jne 0x40bfc6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x948], eax
mov ecx, dword [ebp - 0x948]
push ecx
push 0x48fc1c
mov edx, dword [ebp + 8]
push edx
call fcn.0046e29b
add esp, 0xc
xor eax, eax
jmp 0x40c23e
push 0x64
call fcn.0046e0a3
add esp, 4
mov dword [ebp - 0x124], eax
push 0x48f8df
mov eax, dword [ebp - 0x124]
push eax
call fcn.0046fa70
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x124]
push edx
call fcn.0046fa70
add esp, 8
push 0x48fc24
mov eax, dword [ebp - 0x124]
push eax
call fcn.0046fa80
add esp, 8
mov dword [ebp - 0x118], 0xffffffff
mov ecx, dword [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
jne 0x40c054
push 0x210
push 0x48fc34
mov edx, dword [ebp + 8]
push edx
call fcn.0046e29b
add esp, 0xc
xor eax, eax
jmp 0x40c23e
mov eax, dword [ebp - 4]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x124]
push edx
call fcn.0046fa70
add esp, 8
push str.GECSP.dll
mov eax, dword [ebp - 0x124]
push eax
call fcn.0046fa80
add esp, 8
mov dword [ebp - 0x118], 0xffffffff
mov ecx, dword [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
jne 0x40c0cd
push 0x211
push 0x48fc48
mov edx, dword [ebp + 8]
push edx
call fcn.0046e29b
add esp, 0xc
xor eax, eax
jmp 0x40c23e
mov dword [ebp - 0x94c], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x944], str.SOFTWAREMicrosoftCryptographyDefaultsProviderHaiTai_Cryptographic_Service_Provider
lea eax, [ebp - 0x120]
push eax
push 0x20019
push 0
mov ecx, dword [ebp - 0x944]
push ecx
mov edx, dword [ebp - 0x94c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40c13a
push 0x110
push 0x48fca8
mov eax, dword [ebp + 8]
push eax
call fcn.0046e29b
add esp, 0xc
cmp dword [ebp - 0x120], 0
je 0x40c133
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40c23e
mov dword [ebp - 0x94c], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x944], 0x48fcb0
mov dword [ebp - 0x11c], 0x48fce0
lea edx, [ebp - 0x120]
push edx
push 0x20019
push 0
mov eax, dword [ebp - 0x944]
push eax
mov ecx, dword [ebp - 0x94c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40c1b1
push 0x100
push 0x48fcec
mov edx, dword [ebp + 8]
push edx
call fcn.0046e29b
add esp, 0xc
cmp dword [ebp - 0x120], 0
je 0x40c1aa
mov eax, dword [ebp - 0x120]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40c23e
mov dword [ebp - 0x944], 0x48fcf4
mov dword [ebp - 0x52c], str.HaiKeySrv
mov dword [ebp - 0x938], 0xff
lea ecx, [ebp - 0x938]
push ecx
lea edx, [ebp - 0xa50]
push edx
lea eax, [ebp - 0x114]
push eax
push 0
mov ecx, dword [ebp - 0x52c]
push ecx
mov edx, dword [ebp - 0x120]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x940], eax
cmp dword [ebp - 0x940], 0
je 0x40c239
push 0x101
push str.0x_x
mov eax, dword [ebp + 8]
push eax
call fcn.0046e29b
add esp, 0xc
cmp dword [ebp - 0x120], 0
je 0x40c235
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40c23e
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0046df66
mov esp, ebp
pop ebp
ret 4