Function at 0x4037e0
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
sub esp, 8
push esi
push edi
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServices_nlsX86ccBlessed
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
mov eax, dword [0x4117b8]
sub eax, 0x12182009
je 0x4038ac
sub eax, 1
je 0x40382d
mov eax, dword [esp + 8]
push eax
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
add esp, 8
ret
test edi, edi
jne 0x403a62
mov ecx, dword [esp + 8]
push 0x4117bc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x4117bc
mov edi, eax
call fcn.004036e0
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je 0x403a62
mov edx, dword [0x411c00]
mov eax, dword [edx + esi*4]
push eax
call fcn.00404863
mov ecx, dword [0x411e18]
mov edx, dword [ecx + esi*4]
push edx
call fcn.00404863
mov eax, dword [0x411c00]
mov dword [eax + esi*4], 0x411e34
mov ecx, dword [0x411e18]
mov dword [ecx + esi*4], 0x411e34
mov eax, dword [esp + 0x10]
add esp, 8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
add esp, 8
ret
test edi, edi
jne 0x403a62
mov eax, 0x4117bc
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4038c0
sub eax, edx
je 0x403a5d
mov eax, 0x4117cc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4038d7
sub eax, edx
je 0x403a5d
mov eax, 0x4117cc
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4038f0
sub eax, edx
mov edx, dword [esp + 8]
inc eax
push eax
push 0x4117cc
push 2
push 0
push 0x4117bc
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x4117bc
mov edi, eax
call fcn.004036e0
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je 0x403993
mov eax, dword [0x411c00]
mov ecx, dword [eax + esi*4]
push ecx
call fcn.00404863
mov eax, 0x4117cc
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403943
sub eax, edx
inc eax
push eax
call fcn.0040432a
mov edx, dword [0x411c00]
mov dword [edx + esi*4], eax
mov eax, dword [0x411c00]
add esp, 4
cmp dword [eax + esi*4], 0
je 0x403a45
mov esi, dword [eax + esi*4]
mov ecx, 0x4117cc
mov al, byte [ecx]
mov byte [esi], al
inc ecx
inc esi
test al, al
jne 0x403976
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
add esp, 8
ret
call fcn.00403740
mov esi, eax
cmp esi, 0xffffffff
je 0x403a45
mov eax, 0x4117cc
lea edx, [eax + 1]
jmp 0x4039b0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4039b0
sub eax, edx
inc eax
push eax
call fcn.0040432a
mov ecx, dword [0x411c00]
mov dword [ecx + esi*4], eax
mov eax, 0x4117bc
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4039d4
sub eax, edx
inc eax
push eax
call fcn.0040432a
mov edx, dword [0x411e18]
mov dword [edx + esi*4], eax
mov eax, dword [0x411c00]
add esp, 4
cmp dword [eax + esi*4], 0
je 0x403a45
mov ecx, dword [0x411e18]
cmp dword [ecx + esi*4], 0
je 0x403a45
mov edx, dword [eax + esi*4]
mov ecx, 0x4117cc
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x403a10
mov edx, dword [0x411e18]
mov edx, dword [edx + esi*4]
mov ecx, 0x4117bc
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x403a28
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
add esp, 8
ret
mov eax, dword [esp + 8]
push eax
mov edi, 8
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
add esp, 8
ret
mov edi, 0xd
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
add esp, 8
ret