Function at 0x404a60
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x46726d
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x487bb0]
xor eax, esp
mov dword [esp + 0xd8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x487bb0]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
push str.SYSTEMCurrentControlSetServicesDMProtect
xor edi, edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, eax
cmp esi, edi
je 0x404b2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
mov ebx, 7
push ebx
xor edx, edx
mov dword [ecx + 0x18], ebx
mov dword [ecx + 0x14], edi
push str.InsErr2
mov word [ecx + 4], dx
call fcn.00403680
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x58], esp
push 0xf
xor eax, eax
mov dword [ecx + 0x18], ebx
mov dword [ecx + 0x14], edi
push 0x46ccb0
mov dword [esp + 0x13c], edi
mov word [ecx + 4], ax
call fcn.00403680
push SysReAllocString
mov dword [esp + 0x138], 0xffffffff
call fcn.00402da0
add esp, 0x40
mov eax, esi
jmp 0x404ddf
mov edx, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea ecx, [esp + 0x24]
push ecx
push 4
push edi
push str.ErrorControl
mov ebp, 1
push edx
mov dword [esp + 0x38], ebp
call ebx
mov esi, eax
cmp esi, edi
je 0x404b9e
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.InsErr2
call fcn.00404430
mov dword [esp + 0x118], ebp
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x54], esp
push 0x46ccb0
call fcn.00404430
jmp 0x404b10
mov edx, dword [esp + 0x14]
push 4
lea ecx, [esp + 0x24]
push ecx
push 4
push edi
push str.Start
push edx
mov dword [esp + 0x38], ebp
call ebx
mov esi, eax
cmp esi, edi
je 0x404bf0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.InsErr2
call fcn.00404430
mov dword [esp + 0x118], 2
jmp 0x404b86
mov edx, dword [esp + 0x14]
push 4
lea ecx, [esp + 0x24]
push ecx
push 4
push edi
push str.Type
push edx
mov dword [esp + 0x38], ebp
call ebx
mov esi, eax
cmp esi, edi
je 0x404c45
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.InsErr2
call fcn.00404430
mov dword [esp + 0x118], 3
jmp 0x404b86
call fcn.0040a9b0
cmp eax, edi
je 0x404c66
xor eax, eax
movzx ecx, word [eax + str.system32DRIVERSDMProtect64.sys]
mov word [esp + eax + 0x24], cx
add eax, 2
cmp cx, di
jne 0x404c50
jmp 0x404c84
xor eax, eax
jmp 0x404c70
movzx ecx, word [eax + str.system32DRIVERSDMProtect.sys]
mov word [esp + eax + 0x24], cx
add eax, 2
cmp cx, di
jne 0x404c70
lea eax, [esp + 0x24]
lea edx, [eax + 2]
jmp 0x404c90
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x404c90
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
push 2
push edi
push str.ImagePath
push eax
call ebx
mov esi, eax
cmp esi, edi
je 0x404cf3
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.InsErr2
call fcn.00404430
mov dword [esp + 0x118], 4
jmp 0x404b86
xor eax, eax
jmp 0x404d00
movzx ecx, word [eax + str.DMProtect]
mov word [esp + eax + 0x24], cx
add eax, 2
cmp cx, di
jne 0x404d00
lea eax, [esp + 0x24]
lea edx, [eax + 2]
jmp 0x404d20
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x404d20
mov ecx, dword [esp + 0x14]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [esp + 0x28]
push eax
push ebp
push edi
push 0x46cbb4
push ecx
call ebx
mov esi, eax
cmp esi, edi
je 0x404d82
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.InsErr2
call fcn.00404430
mov dword [esp + 0x118], 5
jmp 0x404b86
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.InsErr2
call fcn.00404430
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x54], esp
push 0x46ccb0
mov dword [esp + 0x138], 6
call fcn.00404430
push SysReAllocString
mov dword [esp + 0x138], 0xffffffff
call fcn.00402da0
add esp, 0x40
xor eax, eax
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xd8]
xor ecx, esp
call fcn.0044ffb3
add esp, 0xe8
ret