Function at 0x40ffc7
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x533458]
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x53345c]
mov dword [ebp - 0x18], ecx
mov edx, dword [0x533460]
mov dword [ebp - 0x14], edx
mov ax, word [0x533464]
mov word [ebp - 0x10], ax
mov cl, byte [0x533466]
mov byte [ebp - 0xe], cl
mov dword [ebp - 0xb0], 0x378
mov dword [ebp - 0xac], 0x278
mov dword [ebp - 0xa8], 0x3bc
cmp dword [0x430044], 0
jne 0x410036
call fcn.0041054a
cmp eax, 0xffffffff
jne 0x410036
or eax, 0xffffffff
jmp 0x410276
cmp dword [ebp + 8], 0
je 0x410069
call fcn.0041c84e
push 0x533468
push 0x2b
call fcn.0040616c
mov dword [ebp - 0xa0], eax
call fcn.0041c863
cmp dword [ebp - 0xa0], 0xffffffff
jne 0x410069
or eax, 0xffffffff
jmp 0x410276
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x53346c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41009f
or eax, 0xffffffff
jmp 0x410276
mov dword [ebp - 0xa4], 0
jmp 0x4100ba
mov ecx, dword [ebp - 0xa4]
add ecx, 1
mov dword [ebp - 0xa4], ecx
cmp dword [ebp - 0xa4], 3
jge 0x41011a
push 4
mov edx, dword [ebp - 0xa4]
lea eax, [ebp + edx*4 - 0xb0]
push eax
push 4
push 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4100f0
jmp 0x41011a
lea eax, [ebp - 0x1c]
push eax
call fcn.00420150
add esp, 4
lea ecx, [ebp + eax - 0x1d]
mov dword [ebp - 0xb8], ecx
mov edx, dword [ebp - 0xb8]
mov al, byte [edx]
add al, 1
mov ecx, dword [ebp - 0xb8]
mov byte [ecx], al
jmp 0x4100ab
mov dword [ebp - 0xb4], 1
push 4
lea edx, [ebp - 0xb4]
push edx
push 4
push 0x5334a4
push 0x5334ac
call fcn.00408266
add esp, 0x14
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xffffffff
jne 0x410162
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x410276
mov dword [ebp - 0xb4], 0xffff
push 4
lea ecx, [ebp - 0xb4]
push ecx
push 4
push 0x5334e4
push 0x5334f0
call fcn.00408266
add esp, 0x14
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xffffffff
jne 0x4101aa
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x410276
push 0x80
push 0x533528
lea eax, [ebp - 0x9c]
push eax
call fcn.004211eb
add esp, 0xc
mov dword [ebp - 0xb4], 0x14
push 4
lea ecx, [ebp - 0xb4]
push ecx
push 4
lea edx, [ebp - 0x9c]
push edx
push 0x533550
call fcn.00408266
add esp, 0x14
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xffffffff
jne 0x41020a
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x410276
push 0x80
push 0x533588
lea ecx, [ebp - 0x9c]
push ecx
call fcn.004211eb
add esp, 0xc
mov dword [ebp - 0xb4], 3
push 4
lea edx, [ebp - 0xb4]
push edx
push 4
lea eax, [ebp - 0x9c]
push eax
push 0x5335b8
call fcn.00408266
add esp, 0x14
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xffffffff
jne 0x41026a
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x410276
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret