Function at 0x40a040
Capabilities:
Delete registry key
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x530
push ebx
push esi
push edi
push 0x41ee00
call fcn.00409f20
mov eax, dword [esp + 0x544]
lea ecx, [esp + 0x2c]
push eax
push 0x41edd8
push ecx
call fcn.00410876
add esp, 0x10
lea edx, [esp + 0xc]
lea eax, [esp + 0x28]
push edx
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x40a09a
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x530
ret
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebp
lea ecx, [esp + 0x14]
push 4
push ecx
push 4
push 0
mov ebx, 1
push 0x41d084
push edx
mov dword [esp + 0x2c], ebx
call esi
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 4
push eax
push 4
push 0
push 0x41edc8
push ecx
mov dword [esp + 0x2c], ebx
call esi
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push 4
push edx
push 4
push 0
push 0x41d098
push eax
mov dword [esp + 0x2c], 3
call esi
mov ecx, dword [esp + 0x548]
lea edx, [esp + 0x338]
push ecx
push 0x41edc0
push edx
call fcn.00410876
lea edi, [esp + 0x344]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x338]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push ebx
push 0
push 0x41d058
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x41eda8
push 0x41ed9c
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x41ed7c
push 0x41ed9c
mov dword [esp + 0x20], eax
call esi
push eax
call edi
push 0x41ed6c
push 0x41ed9c
mov ebx, eax
call esi
push eax
call edi
push 0x41ed54
push 0x41ed9c
mov ebp, eax
call esi
push eax
call edi
mov esi, eax
mov eax, dword [esp + 0x544]
push eax
lea ecx, [esp + 0x440]
push 0x41ed1c
push ecx
call fcn.00410876
lea edi, [esp + 0x448]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x24]
mov word [esp + 0x24], cx
push 1
lea ecx, [esp + 0x20]
lea edx, [esp + 0x440]
push eax
push ecx
mov dword [esp + 0x34], edx
call ebx
lea edx, [esp + 0x1c]
push edx
call ebp
mov edi, eax
lea eax, [esp + 0x1c]
push eax
call esi
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x130]
push ecx
push 0x41d050
push edx
call fcn.00410876
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
add esp, 0xc
lea eax, [esp + 0x130]
push eax
push reloc.WS2_32.dll_bind
call esi
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x130]
push ecx
push 0x41d044
push edx
call fcn.00410876
add esp, 0xc
lea eax, [esp + 0x130]
push eax
push reloc.WS2_32.dll_bind
call esi
lea ecx, [esp + 0x2c]
push ecx
push reloc.WS2_32.dll_bind
call esi
test edi, edi
pop ebp
je 0x40a28b
cmp edi, 0xc000010e
je 0x40a28b
cmp edi, 0xc0000035
je 0x40a28b
push edi
call dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x530
ret
mov ebx, dword [esp + 0x540]
lea edx, [esp + 0x230]
push ebx
push 0x41ed14
push edx
call fcn.00410876
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea eax, [esp + 0x230]
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push eax
call edi
mov esi, dword [esp + 0x548]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x40a30c
push ebx
lea ecx, [esp + 0x234]
push 0x41ed04
push ecx
call fcn.00410876
add esp, 0xc
lea edx, [esp + 0x230]
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push edx
call edi
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
cmp ecx, 0xffffffff
pop edi
pop esi
pop ebx
setne al
add esp, 0x530
ret