Function at 0x4055ad
Capabilities:
Create thread
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
push edi
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0x94
mov dword [ebp - 0x90], 0
mov ecx, 0x23
xor eax, eax
lea edi, [ebp - 0x8c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [ebp - 0xa4]
push ecx
push 0x20019
push 0
push 0x413668
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4056b3
mov dword [ebp - 0xa8], 4
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0x98]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0xa4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4056a6
cmp dword [ebp - 0x84], 1
jne 0x405672
mov edx, dword [ebp - 0x98]
and dh, 0xfe
mov dword [ebp - 0x98], edx
mov eax, dword [ebp - 0x98]
and eax, 0x10
test eax, eax
je 0x405689
push 0x10
call fcn.00401773
add esp, 4
mov ecx, dword [ebp - 0x98]
and ecx, 0x100
test ecx, ecx
je 0x4056a6
push 0x100
call fcn.00401773
add esp, 4
mov edx, dword [ebp - 0xa4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
call fcn.00401513
add esp, 4
and al, 0xbf
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x84], 1
jne 0x4056dd
mov eax, dword [ebp - 0x98]
and ah, 0xfe
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jne 0x4056ed
xor eax, eax
jmp 0x4058a5
push 0
lea ecx, [ebp - 0xa4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x4136ac
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x405820
push 4
lea edx, [ebp - 0x98]
push edx
push 4
push 0
push 0x4136cc
mov eax, dword [ebp - 0xa4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xac], 0
jmp 0x405760
mov ecx, dword [ebp - 0xac]
add ecx, 1
mov dword [ebp - 0xac], ecx
cmp dword [ebp - 0xac], 0x20
jae 0x405813
mov edx, 1
mov ecx, dword [ebp - 0xac]
shl edx, cl
mov eax, dword [ebp - 0x98]
and eax, edx
test eax, eax
je 0x40580e
mov ecx, dword [ebp - 0xac]
add ecx, 1
push ecx
push 0x4136d8
lea edx, [ebp - 0xb8]
push edx
call fcn.0040811b
add esp, 0xc
cmp dword [ebp - 0xa0], 0
je 0x4057eb
push 0
lea eax, [ebp - 0xb0]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0xb8]
push ecx
mov edx, dword [ebp - 0xa4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4057eb
mov dword [ebp - 0xbc], 1
jmp 0x4057f5
mov dword [ebp - 0xbc], 0
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xa0], eax
mov ecx, dword [ebp - 0xb0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x405751
mov edx, dword [ebp - 0xa4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xa0], 0
jne 0x40582d
xor eax, eax
jmp 0x4058a5
push 0x4136e0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x4170f0], eax
push 0x413700
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x4170f4], eax
push 0x413720
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x4170f8], eax
lea eax, [ebp - 0x9c]
push eax
push 0
push 0
push 0x405322
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
xor eax, eax
cmp dword [edx], 0
setne al
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
pop edi
mov esp, ebp
pop ebp
ret