Function at 0x40f83d
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push 0x4dc63c
push 0x42d5c0
call fcn.0041d13c
add esp, 8
push 0x4dc660
push 0x42d5c0
call fcn.0041d138
add esp, 8
push 0x4dc668
push 0x42cfa0
call fcn.0041d13c
add esp, 8
push 0x4dc6a8
push 0x42ccf0
call fcn.0041d13c
add esp, 8
push 0x42d5b4
push 0xf003f
push 0
push 0x42d5c0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40f8ce
push 0x10001
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40fc4d
push 0x4dc6bc
push 0x42cf50
call fcn.0041d13c
add esp, 8
push 5
push 0x4dc6c4
push 1
push 0
push 0x42cf50
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40f920
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40fc4d
push 0x4dc6cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x42cf94], eax
cmp dword [0x42cf94], 0
jne 0x40f951
push 1
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40fc4d
push 0x4dc6dc
mov eax, dword [0x42cf94]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x42cf48], eax
cmp dword [0x42cf48], 0
jne 0x40f988
push 2
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40fc4d
push 0x50
lea eax, [ebp - 0x58]
push eax
push 0x4dc6ec
push 0
push 0
push 0x409
call dword [0x42cf48]
mov dword [ebp - 4], eax
mov eax, dword [0x42cf94]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x40f9da
push 0x2001000
call fcn.0040648e
add esp, 4
push 3
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40fc4d
cmp dword [ebp - 4], 0
jne 0x40f9f8
push 6
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40fc4d
push 0x4dc6fc
push 0x42cf50
call fcn.0041d13c
add esp, 8
lea eax, [ebp - 0x58]
push eax
call fcn.0041d0c4
add esp, 4
push eax
lea eax, [ebp - 0x58]
push eax
push 1
push 0
push 0x42cf50
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40fa54
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40fc4d
push str.Type
push 0x42cf50
call fcn.0041d13c
add esp, 8
mov dword [0x42d7c0], 1
push 4
push 0x42d7c0
push 4
push 0
push 0x42cf50
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40fab0
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40fc4d
push 0x4dc70c
push 0x42cf50
call fcn.0041d13c
add esp, 8
mov dword [0x42d7c0], 2
push 4
push 0x42d7c0
push 4
push 0
push 0x42cf50
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40fb0c
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40fc4d
push 0x4dc714
push 0x42cf50
call fcn.0041d13c
add esp, 8
mov dword [0x42d7c0], 1
push 4
push 0x42d7c0
push 4
push 0
push 0x42cf50
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40fb68
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40fc4d
push str.Group
push 0x42cf50
call fcn.0041d13c
add esp, 8
push 0x14
push 0x4dc720
push 1
push 0
push 0x42cf50
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40fbba
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40fc4d
push str.ErrorControl
push 0x42cf50
call fcn.0041d13c
add esp, 8
mov dword [0x42d7c0], 1
push 4
push 0x42d7c0
push 4
push 0
push 0x42cf50
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40fc16
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40fc4d
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40fc46
push 0x10002
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40fc4d
xor eax, eax
jmp 0x40fc4d
pop edi
pop esi
pop ebx
leave
ret