Function at 0x40d514
Capabilities:
Get common file path
Persist via windows service
Set registry value

Disassembly:
mov eax, 0x46bf83
call fcn.0045b030
sub esp, 0x310
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
je 0x40d536
cmp eax, 2
jne 0x40d53d
xor eax, eax
jmp 0x40dc0d
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x1c], ebx
call fcn.0040ce32
mov edi, dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, 0xc35a
test eax, eax
je 0x40d64c
lea ecx, [ebp - 0x178]
call fcn.0043e890
push 0xc3a2
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.004028d8
mov eax, dword [eax]
push 0x489444
push eax
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 1
call fcn.0043f52d
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00403037
push 0xc364
lea ecx, [ebp - 0x10]
call fcn.004028d8
mov eax, dword [eax]
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], eax
call fcn.004028d8
mov eax, dword [eax]
push 4
push ebx
push 0x489444
push dword [ebp - 0x14]
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 3
push eax
call fcn.0043f4be
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.00403037
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00403037
push 0x96
push 0x12c
lea ecx, [ebp - 0x178]
call fcn.0043f576
call edi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x170]
push eax
push 0x489158
call fcn.0040482a
mov eax, dword [0x489160]
push ebx
push 0x404a2e
push dword [ebp - 0x14]
push 9
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x1c], 1
call fcn.0043eb6e
cmp dword [ebp + 8], ebx
je 0x40d72f
push 0x208
lea eax, [ebp - 0x260]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x260]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x260]
lea ecx, [ebp - 0x10]
push eax
call fcn.004028d8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 4
cmp dword [eax - 8], ebx
je 0x40d6cb
mov ecx, str.drivers360AntiArp.sys
mov eax, ecx
test eax, eax
je 0x40d6b1
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, str.drivers360AntiArp.sys
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.00403152
push dword [ebp - 0x10]
call fcn.0040c5f9
movzx eax, al
cmp eax, ebx
pop ecx
jne 0x40d723
push 0xc43d
lea ecx, [ebp - 0x1c]
call fcn.004028d8
mov eax, dword [eax]
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 5
mov dword [ebp - 0x14], eax
call fcn.004028d8
mov eax, dword [eax]
push ebx
push 1
push 0x489444
push dword [ebp - 0x14]
mov byte [ebp - 4], 6
push eax
call fcn.0040e3b9
add esp, 0x14
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 5
call fcn.00403037
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.00403037
mov dword [ebp - 0x1c], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00403037
cmp dword [ebp - 0x1c], ebx
jne 0x40d8c1
cmp dword [ebp + 8], ebx
je 0x40d8c1
lea ecx, [ebp - 0x178]
call fcn.0043e890
push 0xc3d7
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 7
call fcn.004028d8
mov eax, dword [eax]
push 0xc40e
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 8
mov dword [ebp - 0x14], eax
call fcn.004028d8
mov eax, dword [eax]
push esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 9
mov dword [ebp - 0x20], eax
call fcn.004028d8
mov eax, dword [eax]
push ebx
push 1
lea ecx, [ebp - 0x178]
push dword [ebp - 0x14]
mov byte [ebp - 4], 0xa
push dword [ebp - 0x20]
push eax
call fcn.0043f4be
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 9
call fcn.00403037
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 8
call fcn.00403037
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
call fcn.00403037
push 0xc3af
lea ecx, [ebp - 0x14]
call fcn.004028d8
mov eax, dword [eax]
push 0xc440
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x18], eax
call fcn.004028d8
push dword [ebp - 0x18]
mov eax, dword [eax]
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 0xc
push eax
call fcn.0043f52d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xb
call fcn.00403037
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 7
call fcn.00403037
call edi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x170]
push eax
push 0x489158
call fcn.0040482a
mov eax, dword [0x489160]
push ebx
push 0x404a2e
push dword [ebp - 0x18]
push 9
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push 1
pop ecx
cmp eax, ecx
je 0x40d857
mov dword [ebp - 0x1c], ecx
jmp 0x40d8b2
push ecx
push 0x7f02
push ecx
lea ecx, [ebp - 0x34]
call fcn.0040dc19
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0xd
call fcn.0040e449
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0xe
call fcn.0040e4e8
cmp byte [ebp - 0x2c], bl
je 0x40d895
push dword [ebp - 0x30]
call dword [sym.imp.USER32.dll_SetCursor]
mov byte [ebp - 0x2c], bl
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0xd
call fcn.0040e4b4
cmp byte [ebp - 0x2c], bl
je 0x40d8b2
push dword [ebp - 0x30]
call dword [sym.imp.USER32.dll_SetCursor]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x178]
call fcn.0043eb6e
lea ecx, [ebp - 0x31c]
call fcn.0040dc90
mov dword [ebp - 0x2b4], ebx
cmp dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x10], ebx
jne 0x40d93c
call fcn.00406018
cmp eax, ebx
je 0x40d906
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push ecx
push 0x64
push 1
push dword [ebp + 8]
push 0xc
push 0x591
push eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
call fcn.0040cf15
sub eax, dword [ebp + 8]
neg eax
sbb eax, eax
inc eax
cmp dword [ebp + 8], ebx
mov dword [ebp - 0x10], eax
jne 0x40d94e
push 4
lea ecx, [ebp - 0x18]
pop eax
push eax
push ecx
push eax
push str.Start
push str.SYSTEMCurrentControlSetServices360AntiArp
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp dword [ebp + 8], ebx
je 0x40dbe9
cmp dword [ebp - 0x1c], ebx
jne 0x40dbfc
cmp dword [ebp - 0x10], ebx
jne 0x40db9a
mov eax, dword [0x4802e0]
mov dword [ebp - 0x10], eax
mov eax, 0x104
lea ecx, [ebp - 0x10]
push eax
push eax
mov byte [ebp - 4], 0x10
call fcn.00402f9c
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0040300e
mov ecx, str.drivers_
mov eax, ecx
test eax, eax
je 0x40d99a
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, str.drivers_
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.00403152
lea ecx, [ebp - 0x58]
call fcn.004321ef
push str.Base
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x11
call fcn.004028d8
push str.360AntiArp
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x12
call fcn.004028d8
lea eax, [ebp - 0x10]
push str.360AntiArp.sys
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0x13
call fcn.0040e9a0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x14
push ecx
push eax
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x58]
push eax
call fcn.004322a8
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x13
call fcn.00403037
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x12
call fcn.00403037
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x11
call fcn.00403037
lea ecx, [ebp - 0x58]
call fcn.004322f8
lea ecx, [ebp - 0x178]
call fcn.0043e890
push 0xc432
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x15
call fcn.004028d8
mov eax, dword [eax]
push 0xc366
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x18], eax
call fcn.004028d8
mov eax, dword [eax]
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x28], eax
call fcn.004028d8
mov eax, dword [eax]
push 1
push 1
lea ecx, [ebp - 0x178]
push dword [ebp - 0x18]
mov byte [ebp - 4], 0x18
push dword [ebp - 0x28]
push eax
call fcn.0043f4be
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x17
call fcn.00403037
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x16
call fcn.00403037
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x15
call fcn.00403037
push 0xc3af
lea ecx, [ebp - 0x18]
call fcn.004028d8
mov esi, dword [eax]
push 0xc43f
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x19
call fcn.004028d8
mov eax, dword [eax]
push esi
push eax
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 0x1a
call fcn.0043f52d
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x19
call fcn.00403037
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x15
call fcn.00403037
call edi
mov esi, eax
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x170]
push eax
push 0x489158
call fcn.0040482a
mov eax, dword [0x489160]
push ebx
push 0x404a2e
push esi
push 9
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push 1
pop esi
cmp eax, esi
jne 0x40db6e
call fcn.00406018
cmp eax, ebx
je 0x40db4e
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
push ecx
push 0x64
push esi
push esi
push 0xd
push 0x591
push eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
lea ecx, [ebp - 0x31c]
call fcn.0040d019
push 0x12
call fcn.0040cca9
test eax, eax
pop ecx
je 0x40db71
push ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x40db71
mov dword [ebp - 0x1c], esi
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 0x11
call fcn.0043eb6e
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x10
call fcn.0043222f
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xf
call fcn.00403037
jmp 0x40dbe9
call fcn.0043233e
test eax, eax
je 0x40dbc5
lea eax, [ebp - 0x24]
push 4
push eax
push 4
push str.Start
push str.SYSTEMCurrentControlSetServices360AntiArp
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x24], ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x40dbee
lea eax, [ebp - 0x24]
push 4
push eax
push 4
push str.Start
push str.SYSTEMCurrentControlSetServices360AntiArp
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x24], 1
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp dword [ebp - 0x1c], ebx
jne 0x40dbfc
push ebx
push dword [ebp + 8]
push 8
call fcn.0040dca4
add esp, 0xc
lea ecx, [ebp - 0x31c]
call fcn.0040cff0
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret