Function at 0x40a730
Capabilities:
Delete registry key
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x53c
mov eax, dword [0x43d68c]
xor eax, esp
mov dword [esp + 0x538], eax
mov eax, dword [esp + 0x548]
push esi
mov esi, dword [esp + 0x544]
push edi
mov edi, dword [esp + 0x54c]
push 0x436204
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], eax
call fcn.0040a560
push esi
lea ecx, [esp + 0x34]
push 0x4361dc
push ecx
call fcn.004124f2
add esp, 0x10
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x30]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x40a7ba
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x538]
xor ecx, esp
call fcn.004126a4
add esp, 0x53c
ret
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebx
push 4
lea ecx, [esp + 0x10]
push ecx
push 4
push 0
push 0x4345b8
mov ebx, 1
push edx
mov dword [esp + 0x24], ebx
call esi
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4361cc
push ecx
mov dword [esp + 0x24], ebx
call esi
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x10]
push edx
push 4
push 0
push 0x4345cc
push eax
mov dword [esp + 0x24], 3
call esi
push edi
lea ecx, [esp + 0x340]
push 0x4361c4
push ecx
call fcn.004124f2
lea eax, [esp + 0x348]
add esp, 0xc
lea ecx, [eax + 1]
jmp 0x40a840
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40a840
push ebp
sub eax, ecx
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x344]
push edx
push ebx
push 0
push 0x43458c
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x4361ac
push 0x4361a0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x436180
push 0x4361a0
mov dword [esp + 0x24], eax
call esi
push eax
call edi
push 0x436170
push 0x4361a0
mov ebx, eax
call esi
push eax
call edi
push 0x436158
push 0x4361a0
mov ebp, eax
call esi
push eax
call edi
mov edx, dword [esp + 0x18]
push edx
mov esi, eax
lea eax, [esp + 0x448]
push 0x436120
push eax
call fcn.004124f2
lea ecx, [esp + 0x450]
mov eax, ecx
add esp, 0xc
mov dword [esp + 0x28], ecx
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a8f0
sub eax, edi
push 1
lea edx, [esp + 0x28]
mov word [esp + 0x28], ax
push edx
lea eax, [esp + 0x34]
push eax
call ebx
lea ecx, [esp + 0x2c]
push ecx
call ebp
lea edx, [esp + 0x2c]
push edx
mov edi, eax
call esi
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x13c]
push 0x434578
push ecx
call fcn.004124f2
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
add esp, 0xc
lea edx, [esp + 0x138]
push edx
push reloc.WS2_32.dll_bind
call esi
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x13c]
push 0x43456c
push ecx
call fcn.004124f2
add esp, 0xc
lea edx, [esp + 0x138]
push edx
push reloc.WS2_32.dll_bind
call esi
lea eax, [esp + 0x34]
push eax
push reloc.WS2_32.dll_bind
call esi
pop ebp
test edi, edi
je 0x40a9bb
cmp edi, 0xc000010e
je 0x40a9bb
cmp edi, 0xc0000035
je 0x40a9bb
push edi
call dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x538]
xor ecx, esp
call fcn.004126a4
add esp, 0x53c
ret
mov ebx, dword [esp + 0x14]
push ebx
lea ecx, [esp + 0x23c]
push 0x436118
push ecx
call fcn.004124f2
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [esp + 0x250]
push edx
call edi
mov esi, dword [esp + 0x1c]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x40aa36
push ebx
lea eax, [esp + 0x23c]
push 0x436108
push eax
call fcn.004124f2
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea ecx, [esp + 0x250]
push ecx
call edi
mov dword [esi], eax
mov ecx, dword [esp + 0x544]
xor eax, eax
cmp dword [esi], 0xffffffff
pop ebx
pop edi
setne al
pop esi
xor ecx, esp
call fcn.004126a4
add esp, 0x53c
ret