Function at 0x418530
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x334
push esi
mov dword [ebp - 0x334], ecx
mov eax, dword [0x449dfc]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x328]
mov dword [ebp - 0x120], ecx
mov edx, dword [0x449df8]
movzx eax, byte [edx + 0x449c24]
test eax, eax
jne 0x41857c
push str.SystemCurrentControlSetServices_sisraid
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
jmp 0x4185c4
mov edx, dword [0x449df8]
movzx eax, byte [edx + 0x449c24]
test eax, eax
je 0x4185c4
mov ecx, dword [0x449df8]
movzx edx, byte [ecx + 0x449c24]
cmp edx, 0xff
je 0x4185c4
mov eax, dword [0x449df8]
movzx ecx, byte [eax + 0x449c24]
push ecx
push str.SystemCurrentControlSetServices_sisraid_d
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x43a
mov ecx, dword [ebp - 0x334]
call fcn.00431fef
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4185e7
push 1
mov ecx, dword [ebp - 8]
call fcn.00432188
movzx eax, byte [0x44a1fc]
test eax, eax
je 0x41870c
mov byte [0x44a1fc], 0
mov ecx, dword [ebp - 0x334]
mov byte [ecx + 0x2e8], 0
push 0x43e308
mov ecx, dword [ebp - 0x334]
add ecx, 0xc0
call fcn.004320ed
mov edx, dword [ebp - 0x334]
mov eax, dword [edx + 0x2ec]
mov ecx, dword [0x449df8]
cmp ecx, dword [eax + 0x3c]
jne 0x4186b5
mov edx, dword [ebp - 0x334]
mov eax, dword [edx + 0x2ec]
mov ecx, dword [eax + 0x20]
mov dword [ebp - 0x11c], ecx
push 4
lea edx, [ebp - 0x11c]
push edx
push 4
push 0
push 0x43e310
mov eax, dword [ebp - 0x334]
mov ecx, dword [eax + 0x2f4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x334]
mov ecx, dword [edx + 0x2ec]
mov eax, dword [ecx + 0x20]
mov edx, dword [ecx + 0x24]
mov cl, 0x20
call fcn.00421ea0
mov dword [ebp - 0x11c], eax
push 4
lea edx, [ebp - 0x11c]
push edx
push 4
push 0
push 0x43e324
mov eax, dword [ebp - 0x334]
mov ecx, dword [eax + 0x2f4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x334]
mov byte [edx + 0x23d], 0
mov eax, dword [ebp - 0x334]
mov ecx, dword [eax + 0x2ec]
mov dl, byte [0x44a1fc]
mov byte [ecx + 0x28], dl
push 0x16
mov ecx, dword [ebp - 0x334]
call fcn.00414fb0
mov eax, dword [ebp - 0x334]
mov ecx, dword [eax + 0x2f4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x334]
mov dword [edx + 0x2f4], 0
jmp 0x418b27
mov ecx, dword [ebp - 0x334]
add ecx, 0x160
call fcn.00408d40
test eax, eax
je 0x418736
mov ecx, dword [ebp - 0x334]
add ecx, 0x110
call fcn.00408d40
test eax, eax
jne 0x418749
push 0
push 0
push str.Please_Check_Source_or_Destination_Menu__
call fcn.00434ce8
jmp 0x418b27
mov ecx, dword [ebp - 0x334]
call fcn.00419510
mov eax, dword [ebp - 0x334]
movzx ecx, byte [eax + 0x23d]
test ecx, ecx
je 0x4187b2
mov edx, dword [ebp - 0x334]
movzx eax, byte [edx + 0x2a2]
test eax, eax
je 0x418787
mov ecx, dword [ebp - 0x334]
movzx edx, byte [ecx + 0x2a3]
test edx, edx
jne 0x4187b2
push 0x34
push 0x43e368
push str._Insufficient_Disk_size._Check_your_destination_disk_size___n_If_you_want_to_keep_going_on__the_data_of_HD_will_be_lost_or_the_system_may_be_crashed__n_Do_you_want_to_continue__
mov ecx, dword [ebp - 0x334]
call fcn.0042f915
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 7
jne 0x4187b2
jmp 0x418b27
mov byte [0x44a1fc], 1
push str.Pause
mov ecx, dword [ebp - 0x334]
add ecx, 0xc0
call fcn.004320ed
push 0x42c
mov ecx, dword [ebp - 0x334]
call fcn.00431fef
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4187f2
push 0
mov ecx, dword [ebp - 0xc]
call fcn.00432188
push 0x42d
mov ecx, dword [ebp - 0x334]
call fcn.00431fef
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x418815
push 0
mov ecx, dword [ebp - 0xc]
call fcn.00432188
mov eax, dword [ebp - 0x334]
mov ecx, dword [eax + 0x2ec]
mov dl, byte [0x44a1fc]
mov byte [ecx + 0x28], dl
mov eax, dword [ebp - 0x334]
movzx ecx, byte [eax + 0x23d]
test ecx, ecx
je 0x418a86
mov edx, dword [ebp - 0x334]
mov eax, dword [edx + 0x2ec]
mov ecx, dword [ebp - 0x334]
mov dl, byte [ecx + 0x238]
mov byte [eax + 0xc], dl
mov eax, dword [ebp - 0x334]
mov ecx, dword [eax + 0x2ec]
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov byte [ebp - 0x32d], 0
jmp 0x41888c
mov dl, byte [ebp - 0x32d]
add dl, 1
mov byte [ebp - 0x32d], dl
movzx eax, byte [ebp - 0x32d]
mov ecx, dword [ebp - 0x334]
movzx edx, byte [ecx + 0x238]
cmp eax, edx
jge 0x4188fb
movzx eax, byte [ebp - 0x32d]
movzx ecx, byte [ebp - 0x32d]
mov edx, dword [ebp - 0x334]
mov edx, dword [edx + 0x2ec]
mov esi, dword [ebp - 0x334]
mov al, byte [esi + eax + 0x22c]
mov byte [ecx + edx], al
movzx ecx, byte [ebp - 0x32d]
mov edx, dword [ebp - 0x334]
mov eax, dword [edx + 0x2ec]
movzx edx, byte [ebp - 0x32d]
mov esi, dword [ebp - 0x334]
mov cl, byte [esi + ecx + 0x230]
mov byte [eax + edx + 4], cl
jmp 0x41887d
mov edx, dword [ebp - 0x334]
mov eax, dword [edx + 0x2ec]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov byte [ebp - 0x32d], 0
jmp 0x41892d
mov cl, byte [ebp - 0x32d]
add cl, 1
mov byte [ebp - 0x32d], cl
movzx edx, byte [ebp - 0x32d]
mov eax, dword [ebp - 0x334]
mov ecx, dword [eax + 0x2ec]
movzx eax, byte [ecx + 0xc]
cmp edx, eax
jge 0x4189fe
movzx ecx, byte [ebp - 0x32d]
mov edx, dword [ebp - 0x334]
mov eax, dword [edx + 0x2ec]
mov cl, byte [ecx + eax]
mov byte [ebp - 0x32e], cl
mov edx, dword [ebp - 0x334]
mov eax, dword [edx + 0x2ec]
movzx ecx, byte [ebp - 0x32e]
imul ecx, ecx, 0x98
mov edx, dword [eax + 0x10]
add edx, dword [ecx + 0x449e30]
mov eax, dword [eax + 0x14]
adc eax, dword [ecx + 0x449e34]
mov ecx, dword [ebp - 0x334]
mov ecx, dword [ecx + 0x2ec]
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], eax
movzx edx, byte [ebp - 0x32d]
test edx, edx
jne 0x4189f9
push 0x200
movzx eax, byte [ebp - 0x32e]
mov ecx, dword [eax*4 + 0x44a070]
push ecx
lea edx, [ebp - 0x328]
push edx
mov al, byte [ebp - 0x32e]
push eax
mov ecx, dword [0x449df0]
push ecx
call fcn.00405170
add esp, 0x14
mov edx, dword [ebp - 0x334]
mov eax, dword [edx + 0x2ec]
mov ecx, dword [ebp - 0x120]
mov edx, dword [ecx + 0x10]
mov dword [eax + 8], edx
jmp 0x41891e
mov byte [ebp - 0xd], 0xff
mov eax, dword [ebp - 0x334]
mov cl, byte [eax + 0x239]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0040d620
mov byte [ebp - 0xd], al
movzx edx, byte [ebp - 0xd]
cmp edx, 0xff
je 0x418a7b
movzx eax, byte [ebp - 0xd]
cmp eax, 9
jg 0x418a7b
mov ecx, dword [ebp - 0x334]
movzx edx, byte [ecx + 0x239]
shl edx, 4
movzx eax, dl
and eax, 0xf0
mov ecx, dword [ebp - 0x334]
mov edx, dword [ecx + 0x2ec]
mov byte [edx + 0xe], al
mov eax, dword [ebp - 0x334]
mov ecx, dword [eax + 0x2ec]
movzx edx, byte [ecx + 0xe]
movzx eax, byte [ebp - 0xd]
add edx, eax
mov ecx, dword [ebp - 0x334]
mov eax, dword [ecx + 0x2ec]
mov byte [eax + 0xe], dl
mov ecx, dword [ebp - 0x334]
call fcn.00417950
mov ecx, dword [ebp - 0x334]
mov edx, dword [ecx + 0x2ec]
mov al, byte [edx + 0x2a]
add al, 1
mov ecx, dword [ebp - 0x334]
mov edx, dword [ecx + 0x2ec]
mov byte [edx + 0x2a], al
mov ecx, dword [ebp - 0x334]
call fcn.00417c70
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x334]
mov ecx, dword [eax + 0x2ec]
push ecx
push 0x418b30
call fcn.00433247
push 0
push 0x1f4
push 0x16
mov ecx, dword [ebp - 0x334]
call fcn.00414f80
mov edx, dword [ebp - 0x334]
add edx, 0x2f4
push edx
push 0x20006
push 0
lea eax, [ebp - 0x118]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
je 0x418b27
push 0
push 0
push str._Can_not_open_the_RaidKey_
call fcn.00434ce8
pop esi
mov esp, ebp
pop ebp
ret