Function at 0x40dcd1
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push 0x51e3a4
push 0x5a2aa0
call fcn.0041bfa0
add esp, 8
push 0x51e3c8
push 0x5a2aa0
call fcn.0041bfb0
add esp, 8
push 0x51e3d0
push 0x5a2440
call fcn.0041bfa0
add esp, 8
push 0x51e410
push 0x5a2cc0
call fcn.0041bfa0
add esp, 8
push 0x5a2860
push 0xf003f
push 0
push 0x5a2aa0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x40dd59
push 0x10001
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e087
push 0x51e424
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
push 5
push 0x51e42c
push 1
push 0
push 0x5a2d00
mov eax, dword [0x5a2860]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x40dda5
push 0x10003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e087
push 0x51e434
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x5a2648], eax
cmp dword [0x5a2648], 0
jne 0x40ddd0
push 1
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e087
push 0x51e444
mov ecx, dword [0x5a2648]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5a2ca0], eax
cmp dword [0x5a2ca0], 0
jne 0x40de02
push 2
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e087
push 0x50
lea edx, [ebp - 0x50]
push edx
push 0x51e454
push 0
push 0
push 0x409
call dword [0x5a2ca0]
mov dword [ebp - 0x58], eax
mov eax, dword [0x5a2648]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x40de4e
push 0x2001000
call fcn.004042f8
add esp, 4
push 3
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e087
cmp dword [ebp - 0x58], 0
jne 0x40de66
push 6
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e087
push 0x51e464
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
lea ecx, [ebp - 0x50]
push ecx
call fcn.0041bdf0
add esp, 4
push eax
lea edx, [ebp - 0x50]
push edx
push 1
push 0
push 0x5a2d00
mov eax, dword [0x5a2860]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x40debc
push 0x10003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e087
push 0x51e46c
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
mov dword [0x5a2a88], 1
push 4
push 0x5a2a88
push 4
push 0
push 0x5a2d00
mov ecx, dword [0x5a2860]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x40df13
push 0x10003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e087
push 0x51e474
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
mov dword [0x5a2a88], 2
push 4
push 0x5a2a88
push 4
push 0
push 0x5a2d00
mov edx, dword [0x5a2860]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x40df6a
push 0x10003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e087
push 0x51e47c
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
mov dword [0x5a2a88], 1
push 4
push 0x5a2a88
push 4
push 0
push 0x5a2d00
mov eax, dword [0x5a2860]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x40dfc0
push 0x10003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e087
push 0x51e480
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
push 0x14
push 0x51e488
push 1
push 0
push 0x5a2d00
mov ecx, dword [0x5a2860]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x40e00a
push 0x10003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e087
push 0x51e49c
push 0x5a2d00
call fcn.0041bfa0
add esp, 8
mov dword [0x5a2a88], 1
push 4
push 0x5a2a88
push 4
push 0
push 0x5a2d00
mov edx, dword [0x5a2860]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x40e05e
push 0x10003
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e087
mov eax, dword [0x5a2860]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x40e085
push 0x10002
call fcn.0040435c
add esp, 4
or eax, 0xffffffff
jmp 0x40e087
xor eax, eax
mov esp, ebp
pop ebp
ret