Function at 0x410641
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push 0x5221fc
push 0x5ac1a0
call fcn.0041e930
add esp, 8
push 0x522220
push 0x5ac1a0
call fcn.0041e940
add esp, 8
push 0x522228
push 0x5abb40
call fcn.0041e930
add esp, 8
push 0x522268
push 0x5ac3c0
call fcn.0041e930
add esp, 8
push 0x5abf60
push 0xf003f
push 0
push 0x5ac1a0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x4106c9
push 0x10001
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4109f7
push 0x52227c
push 0x5ac400
call fcn.0041e930
add esp, 8
push 5
push 0x522284
push 1
push 0
push 0x5ac400
mov eax, dword [0x5abf60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x410715
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4109f7
push 0x52228c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x5abd48], eax
cmp dword [0x5abd48], 0
jne 0x410740
push 1
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4109f7
push 0x52229c
mov ecx, dword [0x5abd48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5ac3a0], eax
cmp dword [0x5ac3a0], 0
jne 0x410772
push 2
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4109f7
push 0x50
lea edx, [ebp - 0x50]
push edx
push 0x5222ac
push 0
push 0
push 0x409
call dword [0x5ac3a0]
mov dword [ebp - 0x58], eax
mov eax, dword [0x5abd48]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x4107be
push 0x2001000
call fcn.00406c68
add esp, 4
push 3
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4109f7
cmp dword [ebp - 0x58], 0
jne 0x4107d6
push 6
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4109f7
push 0x5222bc
push 0x5ac400
call fcn.0041e930
add esp, 8
lea ecx, [ebp - 0x50]
push ecx
call fcn.0041e7b0
add esp, 4
push eax
lea edx, [ebp - 0x50]
push edx
push 1
push 0
push 0x5ac400
mov eax, dword [0x5abf60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x41082c
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4109f7
push str.Type
push 0x5ac400
call fcn.0041e930
add esp, 8
mov dword [0x5ac188], 1
push 4
push 0x5ac188
push 4
push 0
push 0x5ac400
mov ecx, dword [0x5abf60]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x410883
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4109f7
push 0x5222cc
push 0x5ac400
call fcn.0041e930
add esp, 8
mov dword [0x5ac188], 2
push 4
push 0x5ac188
push 4
push 0
push 0x5ac400
mov edx, dword [0x5abf60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x4108da
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4109f7
push 0x5222d4
push 0x5ac400
call fcn.0041e930
add esp, 8
mov dword [0x5ac188], 1
push 4
push 0x5ac188
push 4
push 0
push 0x5ac400
mov eax, dword [0x5abf60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x410930
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4109f7
push str.Group
push 0x5ac400
call fcn.0041e930
add esp, 8
push 0x14
push 0x5222e0
push 1
push 0
push 0x5ac400
mov ecx, dword [0x5abf60]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x41097a
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4109f7
push str.ErrorControl
push 0x5ac400
call fcn.0041e930
add esp, 8
mov dword [0x5ac188], 1
push 4
push 0x5ac188
push 4
push 0
push 0x5ac400
mov edx, dword [0x5abf60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x4109ce
push 0x10003
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4109f7
mov eax, dword [0x5abf60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x4109f5
push 0x10002
call fcn.00406ccc
add esp, 4
or eax, 0xffffffff
jmp 0x4109f7
xor eax, eax
mov esp, ebp
pop ebp
ret