Function at 0x409fe8
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403b34
mov eax, dword [ebp - 8]
call fcn.00403b34
mov eax, dword [ebp - 0xc]
call fcn.00403b34
mov eax, dword [ebp + 8]
call fcn.00403b34
xor eax, eax
push ebp
push 0x40a2aa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_RegSetValueExA
mov esi, eax
test esi, esi
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403b44
mov edi, eax
mov edx, edi
lea eax, [ebp - 0x40]
call fcn.004038a0
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
mov edx, 0x40a2c8
call fcn.00403990
mov eax, dword [ebp - 0x3c]
call fcn.00403b44
push eax
push 0
push 2
push 0x110
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.00403b44
push eax
push edi
push esi
call sub.advapi32.dll_RegSaveKeyA
mov ebx, eax
test ebx, ebx
jne 0x40a0be
push esi
call sub.advapi32.dll_RegOpenKeyA
push ebx
call sub.advapi32.dll_RegOpenKeyA
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x40a2f8
mov eax, dword [ebp - 4]
call fcn.00403b44
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.004038a0
push dword [ebp - 0x48]
push 0x40a324
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.00403a04
mov eax, dword [ebp - 0x44]
call fcn.00403b44
push eax
push 0x80000002
call fcn.0040483c
test eax, eax
jne 0x40a155
mov eax, dword [ebp - 0xc]
call fcn.00403b44
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.004038a0
mov eax, dword [ebp - 0x4c]
call fcn.00403944
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403b44
push eax
push 2
push 0
push 0x40a330
mov eax, dword [ebp - 0x18]
push eax
call fcn.0040487c
mov eax, dword [ebp - 0x18]
push eax
call fcn.0040482c
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.00403b44
mov edx, eax
lea eax, [ebp - 0x54]
call fcn.004038a0
mov ecx, dword [ebp - 0x54]
lea eax, [ebp - 0x50]
mov edx, 0x40a2f8
call fcn.00403990
mov eax, dword [ebp - 0x50]
call fcn.00403b44
push eax
push 0x80000002
call fcn.0040485c
test eax, eax
jne 0x40a1d8
mov eax, dword [ebp + 8]
call fcn.00403b44
mov edx, eax
lea eax, [ebp - 0x58]
call fcn.004038a0
mov eax, dword [ebp - 0x58]
call fcn.00403944
push eax
mov eax, dword [ebp + 8]
call fcn.00403b44
push eax
push 1
push 0
push 0x40a33c
mov eax, dword [ebp - 0x18]
push eax
call fcn.0040487c
mov eax, dword [ebp - 0x18]
push eax
call fcn.0040482c
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push 0
push 0x40a348
push 0x80000002
call fcn.0040485c
test eax, eax
jne 0x40a229
mov eax, dword [ebp - 4]
call fcn.00403b44
mov edx, eax
lea eax, [ebp - 0x5c]
call fcn.004038a0
mov eax, dword [ebp - 0x5c]
call fcn.00403944
push eax
push edi
push 7
push 0
push edi
mov eax, dword [ebp - 0x18]
push eax
call fcn.0040487c
mov eax, dword [ebp - 0x18]
push eax
call fcn.0040482c
lea eax, [ebp - 0x38]
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40a243
push esi
call sub.advapi32.dll_RegOpenKeyA
push ebx
call sub.advapi32.dll_RegOpenKeyA
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x34], 1
jne 0x40a26a
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x40a26a
push esi
call sub.advapi32.dll_RegOpenKeyA
push ebx
call sub.advapi32.dll_RegOpenKeyA
mov byte [ebp - 0xd], 1
push esi
call sub.advapi32.dll_RegOpenKeyA
push ebx
call sub.advapi32.dll_RegOpenKeyA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a2b1
lea eax, [ebp - 0x5c]
mov edx, 9
call fcn.004036cc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004036cc
lea eax, [ebp + 8]
call fcn.004036a8
ret