Function at 0x440210
Capabilities:
Delete registry key
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57e140
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x634384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 4], 0
jne 0x440254
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00455e30
test eax, eax
je 0x440285
mov eax, dword [0x651df0]
and eax, 0x7fff0000
cmp eax, 0x2230000
je 0x440275
cmp eax, 0x2130000
jne 0x440285
mov dword [ebp - 0x28], 0x30106
mov dword [ebp - 0x18], 0x20106
jmp 0x440293
mov dword [ebp - 0x28], 0x30006
mov dword [ebp - 0x18], 0x20006
mov ecx, dword [ebx + 4]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4402a0
sub ecx, edx
mov byte [ebp - 0xd], 0
mov eax, 0x104
lea esi, [ecx + 0x3a]
cmp esi, eax
lea ecx, [ebp - 0xe]
cmovb esi, eax
mov dword [ebp - 0x20], esi
call fcn.00412f80
push eax
lea eax, [ebp - 0xd]
push eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x40]
call fcn.0043e300
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], vtable.Utils::ResourceHolders::resource_t_struct_HKEY_____struct_Utils::ResourceHolders::kh_dtor_t__struct_Utils::ResourceHolders::puredrop_and_null_t_struct_HKEY_____struct_Utils::ResourceHolders::kh_dtor_t__.0
mov dword [ebp - 0x30], 0
mov byte [ebp - 4], 1
mov dword [ebp - 0x34], 0x5b3ea4
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x40]
sub edi, esi
push str.SYSTEMCurrentControlSetServicesEventLog
push edi
push esi
mov dword [ebp - 0x1c], edi
call fcn.0055c7a7
push str.Doctor_Web
push edi
push esi
call fcn.00561801
add esp, 0x18
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
push dword [ebp - 0x18]
push 0
push 0
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4404ee
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push 0
push str.MaxSize
push dword [ebp - 0x30]
mov dword [ebp - 0x14], 0x2000000
call edi
test eax, eax
jne 0x4404ee
push 4
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push str.Retention
push dword [ebp - 0x30]
call edi
test eax, eax
jne 0x4404ee
call fcn.0044b0e0
test al, al
mov edx, 0x32
mov ecx, 0x2c
cmovne ecx, edx
push ecx
call fcn.0044b0e0
test al, al
mov edx, str._SystemRoot__system32configDoctor_Web.evt
mov ecx, str._SystemRoot_System32winevtLogsDoctor_Web.evtx
cmove ecx, edx
push ecx
push 2
push 0
push str.File
push dword [ebp - 0x30]
call edi
test eax, eax
jne 0x4404ee
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4403dd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x5eae00
push dword [ebp - 0x1c]
mov dword [ebp - 0x30], 0
push esi
call fcn.00561801
push dword [ebx + 4]
push dword [ebp - 0x1c]
push esi
call fcn.00561801
add esp, 0x18
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
push dword [ebp - 0x18]
push 0
push 0
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4404ee
push dword [ebp - 0x20]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4404ee
mov ecx, dword [ebp - 0x20]
cmp eax, ecx
jb 0x44044c
lea eax, [ecx - 1]
mov byte [esi + eax], 0
inc eax
push eax
push esi
push 2
push 0
push str.EventMessageFile
push dword [ebp - 0x30]
call edi
test eax, eax
jne 0x4404ee
push 4
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x1f
push eax
push 4
push 0
push str.TypesSupported
push dword [ebp - 0x30]
call edi
test eax, eax
jne 0x4404ee
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x440496
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x1c]
push str.SYSTEMCurrentControlSetServicesEventLog
push edi
push esi
mov dword [ebp - 0x30], 0
call fcn.0055c7a7
push str.Application
push edi
push esi
call fcn.00561801
add esp, 0x18
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
push dword [ebp - 0x28]
push 0
push 0
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4404ee
push dword [ebx + 4]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov bl, 1
jmp 0x4404f0
xor bl, bl
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], vtable.Utils::ResourceHolders::resource_t_struct_HKEY_____struct_Utils::ResourceHolders::kh_dtor_t__struct_Utils::ResourceHolders::puredrop_and_null_t_struct_HKEY_____struct_Utils::ResourceHolders::kh_dtor_t__.0
test eax, eax
je 0x440509
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x440559
mov ecx, dword [ebp - 0x38]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x44053a
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44056d
push ecx
push esi
call fcn.00539070
add esp, 8
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00555b08
int3