Function at 0x40d5c3
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43880f
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x4444c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3f0], ecx
mov dword [ebp - 0x238], 1
push 0
push 0x26
lea eax, [ebp - 0x374]
push eax
call fcn.0041aee6
add esp, 0xc
and dword [ebp - 4], 0
push 0x43b782
lea ecx, [ebp - 0x390]
call fcn.00408211
mov byte [ebp - 4], 1
push 0x43bb1c
lea ecx, [ebp - 0x358]
call fcn.00408e1f
mov byte [ebp - 4], 2
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x374]
push eax
call fcn.00408632
pop ecx
pop ecx
mov dword [ebp - 0x3f4], 0x43bb18
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0x3f4]
mov al, byte [eax]
mov byte [ebp - 0x3f9], al
inc dword [ebp - 0x3f4]
cmp byte [ebp - 0x3f9], 0
jne 0x40d669
mov eax, dword [ebp - 0x3f4]
sub eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x400], eax
push dword [ebp - 0x400]
push 0x43bb18
push 2
push 1
lea ecx, [ebp - 0x390]
call fcn.00416775
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x390]
push eax
call fcn.00408591
pop ecx
pop ecx
xor eax, eax
mov word [ebp - 0x234], ax
push 0x1fe
push 0
lea eax, [ebp - 0x232]
push eax
call fcn.0041d130
add esp, 0xc
xor eax, eax
mov word [ebp - 0x33c], ax
push 0xfe
push 0
lea eax, [ebp - 0x33a]
push eax
call fcn.0041d130
add esp, 0xc
push 0x200
push 0
lea eax, [ebp - 0x234]
push eax
call fcn.0041d130
add esp, 0xc
push str.___
push 0x100
lea eax, [ebp - 0x234]
push eax
call fcn.0041d850
add esp, 0xc
lea ecx, [ebp - 0x358]
call fcn.00416ddb
mov dword [ebp - 0x3c0], eax
push dword [ebp - 0x3c0]
push 0x100
lea eax, [ebp - 0x234]
push eax
call fcn.0041d7db
add esp, 0xc
push 0x43ba2c
push 0x100
lea eax, [ebp - 0x234]
push eax
call fcn.0041d7db
add esp, 0xc
push str.YSDrv
push 0x100
lea eax, [ebp - 0x234]
push eax
call fcn.0041d7db
add esp, 0xc
push str..sys
push 0x100
lea eax, [ebp - 0x234]
push eax
call fcn.0041d7db
add esp, 0xc
push str.SYSTEMControlSet001Services_
lea ecx, [ebp - 0x2c]
call fcn.00408e1f
mov byte [ebp - 4], 3
mov dword [ebp - 0x404], str.YSDrv
mov eax, dword [ebp - 0x404]
add eax, 2
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x404]
mov ax, word [eax]
mov word [ebp - 0x40a], ax
add dword [ebp - 0x404], 2
cmp word [ebp - 0x40a], 0
jne 0x40d7d4
mov eax, dword [ebp - 0x404]
sub eax, dword [ebp - 0x408]
sar eax, 1
mov dword [ebp - 0x410], eax
push dword [ebp - 0x410]
push str.YSDrv
lea ecx, [ebp - 0x2c]
call fcn.004073b3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x394], esp
lea eax, [ebp - 0x234]
push eax
call fcn.00408e1f
mov dword [ebp - 0x414], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
call fcn.00416ddb
mov dword [ebp - 0x3dc], eax
push str.ImagePath
push dword [ebp - 0x3dc]
push 0x80000002
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x3f0]
call fcn.00414c25
mov dword [ebp - 0x418], str.SYSTEMCurrentControlSetServices_
mov eax, dword [ebp - 0x418]
add eax, 2
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x418]
mov ax, word [eax]
mov word [ebp - 0x41e], ax
add dword [ebp - 0x418], 2
cmp word [ebp - 0x41e], 0
jne 0x40d883
mov eax, dword [ebp - 0x418]
sub eax, dword [ebp - 0x41c]
sar eax, 1
mov dword [ebp - 0x424], eax
push dword [ebp - 0x424]
push str.SYSTEMCurrentControlSetServices_
lea ecx, [ebp - 0x2c]
call fcn.0040606c
mov dword [ebp - 0x428], str.YSDrv
mov eax, dword [ebp - 0x428]
add eax, 2
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x428]
mov ax, word [eax]
mov word [ebp - 0x42e], ax
add dword [ebp - 0x428], 2
cmp word [ebp - 0x42e], 0
jne 0x40d8e4
mov eax, dword [ebp - 0x428]
sub eax, dword [ebp - 0x42c]
sar eax, 1
mov dword [ebp - 0x434], eax
push dword [ebp - 0x434]
push str.YSDrv
lea ecx, [ebp - 0x2c]
call fcn.004073b3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x398], esp
lea eax, [ebp - 0x234]
push eax
call fcn.00408e1f
mov dword [ebp - 0x438], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c]
call fcn.00416ddb
mov dword [ebp - 0x3ec], eax
push str.ImagePath
push dword [ebp - 0x3ec]
push 0x80000002
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x3f0]
call fcn.00414c25
push str.SYSTEMControlSet001_services_
push 0x80
lea eax, [ebp - 0x33c]
push eax
call fcn.0041d850
add esp, 0xc
push str.YSDrv
push 0x80
lea eax, [ebp - 0x33c]
push eax
call fcn.0041d7db
add esp, 0xc
push 4
lea eax, [ebp - 0x238]
push eax
push 4
push str.Start
lea eax, [ebp - 0x33c]
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x40da45
or dword [ebp - 0x39c], 0xffffffff
mov byte [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004050af
mov byte [ebp - 4], 2
mov byte [ebp - 4], 7
push 0
push 1
lea ecx, [ebp - 0x358]
call fcn.004050af
mov byte [ebp - 4], 1
mov byte [ebp - 4], 8
push 0
push 1
lea ecx, [ebp - 0x390]
call fcn.00402ad2
mov byte [ebp - 4], 0
mov dword [ebp - 4], 9
push 0
push 1
lea ecx, [ebp - 0x374]
call fcn.004050af
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x39c]
jmp 0x40db8c
push 0x100
push 0
lea eax, [ebp - 0x33c]
push eax
call fcn.0041d130
add esp, 0xc
push str.SYSTEMCurrentControlSetServices_
push 0x80
lea eax, [ebp - 0x33c]
push eax
call fcn.0041d850
add esp, 0xc
push str.YSDrv
push 0x80
lea eax, [ebp - 0x33c]
push eax
call fcn.0041d7db
add esp, 0xc
push 4
lea eax, [ebp - 0x238]
push eax
push 4
push str.Start
lea eax, [ebp - 0x33c]
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x40db23
or dword [ebp - 0x3a0], 0xffffffff
mov byte [ebp - 4], 0xa
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004050af
mov byte [ebp - 4], 2
mov byte [ebp - 4], 0xb
push 0
push 1
lea ecx, [ebp - 0x358]
call fcn.004050af
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0xc
push 0
push 1
lea ecx, [ebp - 0x390]
call fcn.00402ad2
mov byte [ebp - 4], 0
mov dword [ebp - 4], 0xd
push 0
push 1
lea ecx, [ebp - 0x374]
call fcn.004050af
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3a0]
jmp 0x40db8c
and dword [ebp - 0x3a4], 0
mov byte [ebp - 4], 0xe
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004050af
mov byte [ebp - 4], 2
mov byte [ebp - 4], 0xf
push 0
push 1
lea ecx, [ebp - 0x358]
call fcn.004050af
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0x10
push 0
push 1
lea ecx, [ebp - 0x390]
call fcn.00402ad2
mov byte [ebp - 4], 0
mov dword [ebp - 4], 0x11
push 0
push 1
lea ecx, [ebp - 0x374]
call fcn.004050af
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c438
leave
ret