Function at 0x40cd29
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov eax, 0x45feaf
call fcn.00452e40
sub esp, 0x308
push 0x43
call dword [0x464578]
cmp eax, 1
je 0x40cd4b
cmp eax, 2
jne 0x40cd52
xor eax, eax
jmp 0x40d25f
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x14], ebx
call fcn.0040c647
test eax, eax
mov esi, 0x47be6c
mov edi, 0x47199c
je 0x40ce08
lea ecx, [ebp - 0x1dc]
call fcn.0043863f
push esi
push 0x471990
lea ecx, [ebp - 0x1dc]
mov dword [ebp - 4], ebx
call fcn.004392d8
push 4
push ebx
push esi
push 0x472184
push edi
lea ecx, [ebp - 0x1dc]
call fcn.00439269
push 0x96
push 0x12c
lea ecx, [ebp - 0x1dc]
call fcn.00439321
call dword [0x464488]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1dc]
push eax
lea eax, [ebp - 0x1d4]
push eax
push 0x47bb88
call fcn.00403e62
mov eax, dword [0x47bb90]
push ebx
push 0x4046df
push dword [ebp - 0x18]
push 9
push eax
call dword [0x464574]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1dc]
mov dword [ebp - 0x14], 1
call fcn.0043891c
cmp dword [ebp + 8], ebx
je 0x40ceac
push 0x208
lea eax, [ebp - 0x2c4]
push ebx
push eax
call fcn.00452e6c
add esp, 0xc
lea eax, [ebp - 0x2c4]
push 0x104
push eax
call dword [0x4641d0]
lea eax, [ebp - 0x2c4]
lea ecx, [ebp - 0x10]
push eax
call fcn.004026c2
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 1
cmp dword [eax - 8], ebx
je 0x40ce87
mov ecx, str.drivers360AntiArp.sys
mov eax, ecx
test eax, eax
je 0x40ce6d
push ecx
call dword [0x464264]
mov ecx, str.drivers360AntiArp.sys
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.00402f3c
push dword [ebp - 0x10]
call fcn.0040bdcf
movzx eax, al
cmp eax, ebx
pop ecx
jne 0x40cea0
push ebx
push 1
push esi
push 0x47211c
push edi
call fcn.0040d81d
add esp, 0x14
mov dword [ebp - 0x14], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402e21
cmp dword [ebp - 0x14], ebx
jne 0x40cfa7
cmp dword [ebp + 8], ebx
je 0x40cfa7
lea ecx, [ebp - 0x1dc]
call fcn.0043863f
push ebx
push 1
push 0x472104
push 0x4720d4
push edi
lea ecx, [ebp - 0x1dc]
mov dword [ebp - 4], 2
call fcn.00439269
push 0x4720cc
push 0x4720c0
lea ecx, [ebp - 0x1dc]
call fcn.004392d8
call dword [0x464488]
mov esi, eax
lea eax, [ebp - 0x1dc]
push eax
lea eax, [ebp - 0x1d4]
push eax
push 0x47bb88
call fcn.00403e62
mov eax, dword [0x47bb90]
push ebx
push 0x4046df
push esi
push 9
push eax
call dword [0x464574]
push 1
pop ecx
cmp eax, ecx
je 0x40cf3f
mov dword [ebp - 0x14], ecx
jmp 0x40cf98
push ecx
push 0x7f02
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0040d26b
lea ecx, [ebp - 0x314]
mov byte [ebp - 4], 3
call fcn.0040d8ad
lea ecx, [ebp - 0x314]
mov byte [ebp - 4], 4
call fcn.0040d94c
cmp byte [ebp - 0x24], bl
mov esi, dword [0x4644d0]
je 0x40cf7f
push dword [ebp - 0x28]
call esi
mov byte [ebp - 0x24], bl
lea ecx, [ebp - 0x314]
mov byte [ebp - 4], 3
call fcn.0040d918
cmp byte [ebp - 0x24], bl
je 0x40cf98
push dword [ebp - 0x28]
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1dc]
call fcn.0043891c
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x64], ebx
call fcn.0040c7af
mov dword [ebp - 0x54], ebx
xor esi, esi
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 4], 5
jne 0x40d023
call fcn.00405ce1
cmp eax, ebx
je 0x40cfee
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push ecx
push 0x64
push 1
push dword [ebp + 8]
push 0xc
push 0x591
push eax
call dword [0x4645b8]
call fcn.0040c72a
mov esi, eax
sub esi, dword [ebp + 8]
neg esi
sbb esi, esi
inc esi
cmp dword [ebp + 8], ebx
jne 0x40d035
push 4
lea ecx, [ebp - 0x18]
pop eax
push eax
push ecx
push eax
push str.Start
push str.SYSTEMCurrentControlSetServices360AntiArp
push 0x80000002
mov dword [ebp - 0x18], eax
call dword [0x464444]
cmp dword [ebp + 8], ebx
je 0x40d23b
cmp dword [ebp - 0x14], ebx
jne 0x40d24e
cmp esi, ebx
jne 0x40d1ec
mov eax, dword [0x4712e0]
mov dword [ebp - 0x10], eax
mov eax, 0x104
lea ecx, [ebp - 0x10]
push eax
push eax
mov byte [ebp - 4], 6
call fcn.00402d86
push eax
call dword [0x4641d0]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00402df8
mov esi, str.drivers_
mov eax, esi
test eax, eax
je 0x40d07b
push esi
call dword [0x464264]
push esi
push eax
lea ecx, [ebp - 0x10]
call fcn.00402f3c
lea ecx, [ebp - 0x50]
call fcn.0042e92d
push str.Base
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
call fcn.004026c2
push str.360AntiArp
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 8
call fcn.004026c2
lea eax, [ebp - 0x10]
push str.360AntiArp.sys
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 9
call fcn.0040ddb5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xa
push ecx
push eax
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x50]
push eax
call fcn.0042e9e6
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 9
call fcn.00402e21
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 8
call fcn.00402e21
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
call fcn.00402e21
lea ecx, [ebp - 0x50]
call fcn.0042ea36
lea ecx, [ebp - 0x1dc]
call fcn.0043863f
push 1
lea ecx, [ebp - 0x1dc]
pop esi
mov byte [ebp - 4], 0xb
push esi
push esi
push 0x471fec
push 0x471fbc
push edi
call fcn.00439269
push 0x4720cc
push 0x471fb0
lea ecx, [ebp - 0x1dc]
call fcn.004392d8
call dword [0x464488]
mov edi, eax
lea eax, [ebp - 0x1dc]
push eax
lea eax, [ebp - 0x1d4]
push eax
push 0x47bb88
call fcn.00403e62
mov eax, dword [0x47bb90]
push ebx
push 0x4046df
push edi
push 9
push eax
call dword [0x464574]
cmp eax, esi
jne 0x40d1c0
call fcn.00405ce1
cmp eax, ebx
je 0x40d1a0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
push ecx
push 0x64
push esi
push esi
push 0xd
push 0x591
push eax
call dword [0x4645b8]
lea ecx, [ebp - 0xbc]
call fcn.0040c82e
push 0x12
call fcn.0040c47f
test eax, eax
pop ecx
je 0x40d1c3
push ebx
call dword [0x4644cc]
jmp 0x40d1c3
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x1dc]
mov byte [ebp - 4], 7
call fcn.0043891c
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 6
call fcn.0042e96d
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.00402e21
jmp 0x40d23b
call fcn.0042ea7c
test eax, eax
je 0x40d217
lea eax, [ebp - 0x1c]
push 4
push eax
push 4
push str.Start
push str.SYSTEMCurrentControlSetServices360AntiArp
push 0x80000002
mov dword [ebp - 0x1c], ebx
call dword [0x464444]
jmp 0x40d240
lea eax, [ebp - 0x1c]
push 4
push eax
push 4
push str.Start
push str.SYSTEMCurrentControlSetServices360AntiArp
push 0x80000002
mov dword [ebp - 0x1c], 1
call dword [0x464444]
cmp dword [ebp - 0x14], ebx
jne 0x40d24e
push ebx
push dword [ebp + 8]
push 8
call fcn.0040d2e2
add esp, 0xc
lea ecx, [ebp - 0xbc]
call fcn.0040c805
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret