Function at 0x404740
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417b41
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x422040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x419912
lea ecx, [ebp - 0x15c]
call dword [sym.imp.mfc140.dll_Ordinal_310]
push 0x32
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x164], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor esi, esi
xor eax, eax
lea ecx, [ebp - 0x54]
add ecx, eax
lea eax, [edi + esi]
movzx eax, byte [eax + 0x30]
push eax
test esi, esi
jne 0x4047d6
push 0x41b004
push ecx
call fcn.00401d30
mov eax, dword [ebp - 0x164]
add esp, 0xc
inc esi
add eax, 3
mov dword [ebp - 0x164], eax
jmp 0x4047a5
cmp esi, 0xf
je 0x404800
push str.__2.2X
push ecx
call fcn.00401d30
mov eax, dword [ebp - 0x164]
inc esi
add eax, 3
add esp, 0xc
mov dword [ebp - 0x164], eax
cmp esi, 0x10
jl 0x4047a5
jmp 0x40480e
push 0x41b00c
push ecx
call fcn.00401d30
add esp, 0xc
mov ax, word [0x41b04c]
movups xmm0, xmmword [str.SYSTEMCurrentControlSetServicesExt2FsdVolumes]
push 0
mov word [ebp - 0x128], ax
lea eax, [ebp - 0x160]
push eax
push 0
push 0xf003f
push 0
movups xmmword [ebp - 0x158], xmm0
push 0
movups xmm0, xmmword [0x41b02c]
push 0
lea eax, [ebp - 0x158]
movups xmmword [ebp - 0x148], xmm0
push eax
movups xmm0, xmmword [0x41b03c]
push 0x80000002
movups xmmword [ebp - 0x138], xmm0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x404ad1
cmp byte [edi + 0xc], al
je 0x404881
push str.Readonly_
jmp 0x404892
cmp byte [edi + 0xf], 0
je 0x40489e
cmp byte [edi + 0xd], 0
je 0x40489e
push str.Ext3ForceWriting_
lea ecx, [ebp - 0x15c]
call dword [sym.imp.mfc140.dll_Ordinal_1696]
mov al, byte [edi + 0x40]
test al, al
je 0x4048eb
test al, 0x7f
je 0x4048da
cmp al, 0xff
je 0x4048da
push str.MountPoint
lea ecx, [ebp - 0x15c]
call dword [sym.imp.mfc140.dll_Ordinal_1696]
mov al, byte [edi + 0x40]
lea ecx, [ebp - 0x15c]
and al, 0x7f
movzx eax, al
push eax
call dword [sym.imp.mfc140.dll_Ordinal_1693]
push 0x41b088
jmp 0x4048df
push str.MountPoint_
lea ecx, [ebp - 0x15c]
call dword [sym.imp.mfc140.dll_Ordinal_1696]
lea esi, [edi + 0x10]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4048f3
sub ecx, edx
je 0x40492d
push 0x41b08c
lea ecx, [ebp - 0x15c]
call dword [sym.imp.mfc140.dll_Ordinal_1696]
push esi
lea ecx, [ebp - 0x15c]
call dword [sym.imp.mfc140.dll_Ordinal_1696]
push 0x41b098
lea ecx, [ebp - 0x15c]
call dword [sym.imp.mfc140.dll_Ordinal_1696]
cmp byte [edi + 0x42], 0
je 0x404965
push 0x41b09c
lea ecx, [ebp - 0x15c]
call dword [sym.imp.mfc140.dll_Ordinal_1696]
lea eax, [edi + 0x44]
push eax
lea ecx, [ebp - 0x15c]
call dword [sym.imp.mfc140.dll_Ordinal_1696]
push 0x41b098
lea ecx, [ebp - 0x15c]
call dword [sym.imp.mfc140.dll_Ordinal_1696]
cmp byte [edi + 0x43], 0
je 0x40499d
push 0x41b0ac
lea ecx, [ebp - 0x15c]
call dword [sym.imp.mfc140.dll_Ordinal_1696]
lea eax, [edi + 0x64]
push eax
lea ecx, [ebp - 0x15c]
call dword [sym.imp.mfc140.dll_Ordinal_1696]
push 0x41b098
lea ecx, [ebp - 0x15c]
call dword [sym.imp.mfc140.dll_Ordinal_1696]
mov eax, dword [edi + 0x88]
and eax, 2
or eax, 0
je 0x404a99
movzx eax, word [edi + 0x94]
push eax
lea eax, [ebp - 0x20]
push 0x41b0bc
push eax
call fcn.00401d30
add esp, 0xc
lea ecx, [ebp - 0x15c]
push str.uid
call dword [sym.imp.mfc140.dll_Ordinal_1696]
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x15c]
call dword [sym.imp.mfc140.dll_Ordinal_1696]
push 0x41b098
lea ecx, [ebp - 0x15c]
call dword [sym.imp.mfc140.dll_Ordinal_1696]
movzx eax, word [edi + 0x96]
push eax
lea eax, [ebp - 0x20]
push 0x41b0bc
push eax
call fcn.00401d30
add esp, 0xc
lea ecx, [ebp - 0x15c]
push str.gid
call dword [sym.imp.mfc140.dll_Ordinal_1696]
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x15c]
call dword [sym.imp.mfc140.dll_Ordinal_1696]
push 0x41b098
lea ecx, [ebp - 0x15c]
call dword [sym.imp.mfc140.dll_Ordinal_1696]
test byte [edi + 0x90], 2
je 0x404a99
movzx eax, word [edi + 0x98]
push eax
lea eax, [ebp - 0x20]
push 0x41b0bc
push eax
call fcn.00401d30
add esp, 0xc
lea ecx, [ebp - 0x15c]
push str.euid
call dword [sym.imp.mfc140.dll_Ordinal_1696]
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x15c]
call dword [sym.imp.mfc140.dll_Ordinal_1696]
push 0x41b098
lea ecx, [ebp - 0x15c]
call dword [sym.imp.mfc140.dll_Ordinal_1696]
mov eax, dword [ebp - 0x15c]
lea ecx, [ebp - 0x15c]
mov eax, dword [eax - 0xc]
push eax
push eax
call dword [sym.imp.mfc140.dll_Ordinal_5095]
push eax
push 1
push 0
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x160]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x160]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x15c]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416a63
mov esp, ebp
pop ebp
ret