Function at 0x76e57378
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0xc]
push eax
push 0x76e49eb8
xor esi, esi
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, esi
mov dword [ebp - 8], eax
jne 0x76e575ed
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push 0x76e57798
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
mov dword [ebp - 8], eax
jne 0x76e575e4
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp + 8], eax
je 0x76e5741d
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
push 1
push 0
push 0x76e5776c
push dword [ebp - 4]
call esi
test eax, eax
je 0x76e5741d
push eax
push dword [ebp + 8]
push 0x76e5776c
push 0x76e57740
call fcn.76e42867
add esp, 0x10
mov eax, dword [ebx + 4]
test eax, eax
mov dword [ebp + 8], eax
je 0x76e5745b
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
push 1
push 0
push 0x76e57710
push dword [ebp - 4]
call esi
test eax, eax
je 0x76e5745b
push eax
push dword [ebp + 8]
push 0x76e57710
push 0x76e57740
call fcn.76e42867
add esp, 0x10
push 4
lea eax, [ebx + 8]
push eax
push 4
push 0
push 0x76e576d8
push dword [ebp - 4]
call esi
test eax, eax
je 0x76e57489
push eax
push dword [ebx + 8]
push 0x76e576d8
push 0x76e576ac
call fcn.76e42867
add esp, 0x10
push 0x10
lea eax, [ebx + 0xc]
push eax
push 3
push 0
push 0x76e57694
push dword [ebp - 4]
call esi
test eax, eax
je 0x76e574b4
push eax
push 0x76e57694
push 0x76e57670
call fcn.76e42867
add esp, 0xc
mov eax, dword [ebx + 0x1c]
test eax, eax
mov dword [ebp + 8], eax
je 0x76e574f2
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
push 1
push 0
push 0x76e57658
push dword [ebp - 4]
call esi
test eax, eax
je 0x76e574f2
push eax
push dword [ebp + 8]
push 0x76e57658
push 0x76e57740
call fcn.76e42867
add esp, 0x10
mov eax, dword [ebx + 0x20]
test eax, eax
mov dword [ebp + 8], eax
je 0x76e57530
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
push 1
push 0
push 0x76e5763c
push dword [ebp - 4]
call esi
test eax, eax
je 0x76e57530
push eax
push dword [ebp + 8]
push 0x76e5763c
push 0x76e57740
call fcn.76e42867
add esp, 0x10
push 4
lea eax, [ebx + 0x24]
push eax
push 4
push 0
push 0x76e57630
push dword [ebp - 4]
call esi
test eax, eax
mov dword [ebp - 8], eax
je 0x76e57561
push eax
push dword [ebx + 0x24]
push 0x76e57630
push 0x76e576ac
call fcn.76e42867
add esp, 0x10
mov eax, dword [ebx + 0x28]
test eax, eax
mov dword [ebp + 8], eax
je 0x76e575a2
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
push 1
push 0
push 0x76e57618
push dword [ebp - 4]
call esi
test eax, eax
mov dword [ebp - 8], eax
je 0x76e575a2
push eax
push dword [ebp + 8]
push 0x76e57618
push 0x76e57740
call fcn.76e42867
add esp, 0x10
mov ebx, dword [ebx + 0x2c]
test ebx, ebx
je 0x76e575d9
push ebx
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
mov edi, 0x76e575f8
push edi
push dword [ebp - 4]
call esi
test eax, eax
mov dword [ebp - 8], eax
je 0x76e575d9
push eax
push ebx
push edi
push 0x76e57740
call fcn.76e42867
add esp, 0x10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop esi
leave
ret 4