Function at 0x4013c0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413230
push 0x402c94
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffb00
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x510]
mov ecx, 0x13e
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x39c], 0x378
mov esi, esp
lea eax, [ebp - 0x20]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp esi, esp
call fcn.004029f0
test eax, eax
je 0x40143e
mov eax, 0xfffffcdd
jmp 0x40168e
mov dword [ebp - 4], 0
mov esi, esp
lea eax, [ebp - 0x39c]
push eax
lea ecx, [ebp - 0x398]
push ecx
push 0
push 0
push str.PackedCatalogItem
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp esi, esp
call fcn.004029f0
test eax, eax
jne 0x40147f
cmp dword [ebp - 0x39c], 0x378
je 0x4014a2
push 0xffffffffffffffff
mov dword [ebp - 0x4c0], 0xfffffcdd
lea eax, [ebp - 0x10]
push eax
call fcn.00402bde
add esp, 8
mov eax, dword [ebp - 0x4c0]
jmp 0x40168e
lea ecx, [ebp - 0x294]
mov dword [ebp - 0x3a0], ecx
mov edx, dword [ebp - 0x3a0]
cmp dword [edx + 0x28], 1
jne 0x40166a
mov eax, dword [ebp - 0x3a0]
cmp dword [eax + 0x4c], 2
jne 0x40166a
mov ecx, dword [ebp - 0x3a0]
mov edx, dword [ecx + 0x24]
push edx
push 0x413214
lea eax, [ebp - 0x3b8]
push eax
call fcn.00402d70
add esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x4015b8
push 1
push str.SYSTEMCurrentControlSetServicesWinSock2MiniSPI
push CreateStatusWindowA
lea ecx, [ebp - 0x398]
push ecx
call fcn.00402b20
add esp, 4
push eax
lea edx, [ebp - 0x398]
push edx
lea eax, [ebp - 0x3b8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00401770
test eax, eax
jne 0x40154f
push 0xffffffffffffffff
mov dword [ebp - 0x4c4], 0xfffffcda
lea ecx, [ebp - 0x10]
push ecx
call fcn.00402bde
add esp, 8
mov eax, dword [ebp - 0x4c4]
jmp 0x40168e
mov edx, dword [ebp - 0x1c]
push edx
lea eax, [ebp - 0x398]
push eax
call fcn.00402a30
add esp, 8
mov esi, esp
mov ecx, dword [ebp - 0x39c]
push ecx
lea edx, [ebp - 0x398]
push edx
push 3
push 0
push str.PackedCatalogItem
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp esi, esp
call fcn.004029f0
test eax, eax
je 0x4015b3
push 0xffffffffffffffff
mov dword [ebp - 0x4c8], 0xfffffcd9
lea ecx, [ebp - 0x10]
push ecx
call fcn.00402bde
add esp, 8
mov eax, dword [ebp - 0x4c8]
jmp 0x40168e
jmp 0x40166a
push 1
push str.SYSTEMCurrentControlSetServicesWinSock2MiniSPI
push CreateStatusWindowA
push 0x104
lea edx, [ebp - 0x4bc]
push edx
lea eax, [ebp - 0x3b8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004016b0
test eax, eax
jne 0x401606
push 0xffffffffffffffff
mov dword [ebp - 0x4cc], 0xfffffcdb
lea ecx, [ebp - 0x10]
push ecx
call fcn.00402bde
add esp, 8
mov eax, dword [ebp - 0x4cc]
jmp 0x40168e
lea edx, [ebp - 0x4bc]
push edx
lea eax, [ebp - 0x398]
push eax
call fcn.00402a30
add esp, 8
mov esi, esp
mov ecx, dword [ebp - 0x39c]
push ecx
lea edx, [ebp - 0x398]
push edx
push 3
push 0
push str.PackedCatalogItem
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp esi, esp
call fcn.004029f0
test eax, eax
je 0x40166a
push 0xffffffffffffffff
mov dword [ebp - 0x4d0], 0xfffffcd9
lea ecx, [ebp - 0x10]
push ecx
call fcn.00402bde
add esp, 8
mov eax, dword [ebp - 0x4d0]
jmp 0x40168e
mov dword [ebp - 4], 0xffffffff
call fcn.00401678
jmp 0x40168c
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x510
cmp ebp, esp
call fcn.004029f0
mov esp, ebp
pop ebp
ret 0xc