Function at 0x407ef0
Capabilities:
Get session user name
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x422040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x100
lea eax, [ebp - 0x104]
mov esi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [ebp - 0x20c], 0xff
add esp, 0xc
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x408251
call fcn.00407e00
mov ebx, eax
mov dword [ebp - 0x214], ebx
test ebx, ebx
je 0x408251
test esi, esi
mov esi, ebx
push edi
je 0x408098
nop dword [eax + eax]
mov edi, esi
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x407f75
lea ebx, [ebp - 0x104]
sub edi, ecx
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x407f87
sub ebx, ecx
cmp ebx, edi
jg 0x407fc3
mov eax, ebx
sub eax, esi
mov dword [ebp - 0x210], eax
nop
push ebx
lea eax, [ebp - 0x104]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbicmp]
add esp, 0xc
test eax, eax
je 0x408026
mov eax, dword [ebp - 0x210]
inc esi
add eax, esi
cmp eax, edi
jle 0x407fa0
mov ebx, dword [ebp - 0x214]
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407fd0
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea eax, [ebx - 1]
sub ecx, edx
add eax, ecx
cmp eax, ebx
jbe 0x408002
mov al, byte [eax]
cmp al, 0x2c
je 0x408002
cmp al, 0x3b
je 0x408002
push 0x41b098
push 0xfff
push ebx
call esi
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push 0xfff
push ebx
call esi
push 0x41b098
push 0xfff
push ebx
call esi
add esp, 0x18
jmp 0x40810a
test esi, esi
je 0x407fc3
mov ebx, dword [ebp - 0x214]
cmp esi, ebx
jbe 0x408058
mov al, byte [esi - 1]
cmp al, 0x2c
je 0x408058
cmp al, 0x3b
je 0x408058
lea ecx, [ebp - 0x104]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408048
sub ecx, edx
add esi, ecx
jmp 0x407f70
lea ecx, [ebp - 0x104]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408061
sub ecx, edx
add esi, ecx
mov al, byte [esi]
test al, al
je 0x40819f
cmp al, 0x2c
je 0x40819f
cmp al, 0x3b
jne 0x407f70
jmp 0x40819f
add esp, 0xc
mov dword [ebp - 0x210], 1
mov edi, esi
lea ecx, [edi + 1]
nop dword [eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x4080a0
lea ebx, [ebp - 0x104]
sub edi, ecx
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x4080b2
sub ebx, ecx
cmp ebx, edi
jg 0x4080f7
mov eax, ebx
sub eax, esi
mov dword [ebp - 0x218], eax
nop dword [eax]
push ebx
lea eax, [ebp - 0x104]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbicmp]
add esp, 0xc
test eax, eax
je 0x4081bf
mov eax, dword [ebp - 0x218]
inc esi
add eax, esi
cmp eax, edi
jle 0x4080d0
cmp dword [ebp - 0x210], 0
mov ebx, dword [ebp - 0x214]
je 0x40819f
mov eax, dword [0x41b14c]
movups xmm0, xmmword [0x41b11c]
mov dword [ebp - 0x1d8], eax
mov al, byte [0x41b150]
mov byte [ebp - 0x1d4], al
lea eax, [ebp - 0x210]
push eax
movups xmmword [ebp - 0x208], xmm0
push 0xf013f
movups xmm0, xmmword [0x41b12c]
push 0
lea eax, [ebp - 0x208]
movups xmmword [ebp - 0x1f8], xmm0
push eax
movups xmm0, xmmword [0x41b13c]
push 0x80000002
movups xmmword [ebp - 0x1e8], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408193
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408173
sub ecx, edx
push ecx
push ebx
push 1
push 0
push 0x41b3b0
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call dword [sym.imp.mfc140.dll_Ordinal_266]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416a63
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x4080f7
cmp esi, dword [ebp - 0x214]
jbe 0x4081f3
mov al, byte [esi - 1]
cmp al, 0x2c
je 0x4081f3
cmp al, 0x3b
je 0x4081f3
lea ecx, [ebp - 0x104]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4081e3
sub ecx, edx
add esi, ecx
jmp 0x408098
lea ecx, [ebp - 0x104]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408200
sub ecx, edx
mov al, byte [ecx + esi]
lea edx, [ecx + esi]
test al, al
jne 0x408224
lea eax, [ecx + 1]
push eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
jmp 0x40808b
cmp al, 0x2c
je 0x408233
cmp al, 0x3b
je 0x408233
mov esi, edx
jmp 0x408098
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408238
sub ecx, edi
lea eax, [edx + 1]
push ecx
push eax
push esi
call sub.VCRUNTIME140.dll_memmove
jmp 0x40808b
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.00416a63
mov esp, ebp
pop ebp
ret