Function at 0x405240
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x244
mov eax, dword [0x422040]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [esp + 0x28]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, 1
push 0x110
push 0
mov dword [esp + 0x1c], ebx
mov ebx, dword [ebp + 0x10]
push eax
mov byte [esp + 0x1f], dl
mov dword [esp + 0x38], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call sub.VCRUNTIME140.dll_memset
mov al, byte [esp + 0x1f]
lea edx, [esp + 0x4c]
or dword [esp + 0x40], esi
add esp, 0xc
mov ecx, dword [esp + 0x14]
sub edx, ecx
mov byte [esp + 0x3c], al
mov al, byte [ebp + 8]
mov dword [esp + 0x30], 0x4556504d
mov dword [esp + 0x38], 7
mov byte [esp + 0x3d], al
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x4052d0
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4052e2
sub ecx, edx
je 0x405307
lea edx, [esp + 0x74]
mov ecx, ebx
sub edx, ebx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x4052f5
mov byte [esp + 0x72], 1
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405310
sub ecx, edx
je 0x405338
lea edx, [esp + 0x94]
mov ecx, edi
sub edx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x405326
mov byte [esp + 0x73], 1
mov ax, word [0x41b110]
movups xmm0, xmmword [str.SYSTEMCurrentControlSetServicesExt2Fsd]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov word [esp + 0x168], ax
lea eax, [esp + 0x20]
push eax
movups xmmword [esp + 0x144], xmm0
push 0xf003f
movups xmm0, xmmword [0x41b0f8]
push 0
lea eax, [esp + 0x14c]
movups xmmword [esp + 0x15c], xmm0
push eax
movq xmm0, qword [0x41b108]
push 0x80000002
movq qword [esp + 0x174], xmm0
call ebx
test eax, eax
je 0x4053a1
xor esi, esi
jmp 0x405560
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [esp + 0x2c]
push 4
push eax
push 4
push 0
push 0x41b114
push dword [esp + 0x34]
call edi
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x41b14c]
movups xmm0, xmmword [0x41b11c]
mov dword [esp + 0x170], eax
mov al, byte [0x41b150]
mov byte [esp + 0x174], al
lea eax, [esp + 0x20]
push eax
movups xmmword [esp + 0x144], xmm0
push 0xf003f
movups xmm0, xmmword [0x41b12c]
push 0
lea eax, [esp + 0x14c]
movups xmmword [esp + 0x15c], xmm0
push eax
movups xmm0, xmmword [0x41b13c]
push 0x80000002
movups xmmword [esp + 0x174], xmm0
call ebx
test eax, eax
je 0x405432
xor esi, esi
jmp 0x405560
xor eax, eax
cmp byte [esp + 0x13], al
push 4
sete al
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push eax
push 4
push 0
push str.WritingSupport
push dword [esp + 0x34]
call edi
movzx eax, byte [ebp + 8]
push 4
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push eax
push 4
push 0
push str.Ext3ForceWriting
push dword [esp + 0x34]
call edi
mov eax, dword [ebp + 0x18]
push 4
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push eax
push 4
push 0
push str.AutoMount
push dword [esp + 0x34]
call edi
mov ebx, dword [esp + 0x14]
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4054a0
sub ecx, edx
push ecx
push ebx
push 1
push 0
push str.CodePage
push dword [esp + 0x34]
call edi
mov edx, dword [esp + 0x18]
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4054c3
sub ecx, ebx
push ecx
push edx
push 1
push 0
push str.HidingPrefix
push dword [esp + 0x34]
call edi
mov ebx, dword [esp + 0x1c]
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4054e6
sub ecx, edx
push ecx
push ebx
push 1
push 0
push str.HidingSuffix
push dword [esp + 0x34]
call edi
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x80000000
lea edx, [esp + 0x28]
mov ecx, str.DosDevicesExt2Fsd
call fcn.00402770
add esp, 4
test eax, eax
js 0x405560
mov eax, dword [esp + 0xc0]
lea edx, [esp + 0x30]
mov ecx, dword [0x425424]
and eax, 0xfffffffe
and ecx, esi
mov dword [esp + 0xb8], esi
or ecx, eax
mov dword [esp + 0xbc], 0
mov dword [esp + 0xc0], ecx
mov ecx, dword [esp + 0x24]
call fcn.00404d70
mov esi, eax
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40558c
cmp eax, 0xffffffff
je 0x40558c
push eax
call dword [sym.imp.ntdll.dll_ZwClose]
test eax, eax
jns 0x40558c
push 0
push str.Ext2Close
push str.Failed_to_close_handle
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x24c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00416a63
mov esp, ebp
pop ebp
ret