Function at 0x409588
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x408
mov dword [ecx + 0x20], 1
push 0x4978a0
push 0
push 0x481eac
call fcn.00407ffc
lea eax, [esp + 0x14]
push 0x9c
push 0
push eax
call fcn.0046e690
add esp, 0x18
mov eax, 0x9c
xor ecx, ecx
lea edx, [esp + 8]
mov word [esp + 0x2c], ax
mov word [esp + 0x2e], cx
push edx
push 0xffffffffffffffff
push ecx
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
mov dword [esp + 0x30], 0x3c0020
push 0x4977bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
push 0x4977c4
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x497900
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp], eax
mov edx, eax
test edx, edx
je 0x409787
test esi, esi
je 0x40998e
lea edx, [esp + 0xa4]
push 0x1a8
push 0
push edx
call fcn.0046e690
add esp, 0xc
mov dword [esp + 0xa4], 0x1a8
xor edx, edx
xor ebp, ebp
mov byte [esp + 8], dl
lea ecx, [esp + 0xa4]
push edx
push ecx
push edx
push edx
call esi
test eax, eax
je 0x4096ab
mov dword [esp + 4], ebx
mov ebx, esi
lea edi, [esp + 0xc8]
mov esi, 0x4977a0
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x40968e
or dl, dl
je 0x40968a
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x40968e
add edi, 2
add esi, 2
or dl, dl
jne 0x40966e
xor eax, eax
jmp 0x409693
sbb eax, eax
or eax, 1
test eax, eax
je 0x4096ca
inc ebp
xor ecx, ecx
lea edx, [esp + 0xa4]
push ecx
push edx
push ebp
push ecx
call ebx
test eax, eax
jne 0x409662
mov eax, 0x4977a0
push eax
push 0x49791c
call fcn.00463d03
xor eax, eax
add esp, 0x410
pop ebx
pop ebp
pop esi
pop edi
ret 0x14
mov ebx, dword [esp + 4]
lea esi, [esp + 0x24c]
mov edi, 0x49792c
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4096da
mov dword [esp + 0x350], 0
lea edx, [esp + 0x350]
push edx
push 0x497940
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x40971a
xor eax, eax
add esp, 0x408
pop ebx
pop ebp
pop esi
pop edi
ret 0x14
mov dword [esp + 0x354], 0
lea ecx, [esp + 0x24c]
lea edx, [esp + 0x354]
push edx
push ecx
push dword [esp + 0x358]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x409755
xor eax, eax
add esp, 0x408
pop ebx
pop ebp
pop esi
pop edi
ret 0x14
mov dword [esp + 0x358], 1
mov ecx, 4
lea edx, [esp + 0x358]
push ecx
push edx
push ecx
push 0
push 0x4979a0
push dword [esp + 0x368]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x409796
xor eax, eax
add esp, 0x408
pop ebx
pop ebp
pop esi
pop edi
ret 0x14
lea esi, [esp + 8]
mov edi, 0x4979b4
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x40979f
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov esi, eax
test esi, esi
je 0x4097dc
xor edx, edx
push 0x2000000
push edx
push edx
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov ebp, eax
test ebp, ebp
je 0x4099b6
push ebp
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov dword [esp + 0x30], 0x3c0020
mov edx, dword [esp + 0x70]
cmp edx, 8
je 0x4097fb
cmp edx, 0x10
je 0x4097fb
cmp edx, 0x20
jne 0x409925
mov edx, dword [esp + 0x428]
mov ecx, dword [esp + 0x42c]
mov edi, dword [esp + 0x420]
mov dword [esp + 0x74], edx
mov edx, dword [esp + 0x424]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edx
lea edx, [esp + 0x360]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea ecx, [esp + 8]
xor edx, edx
push edx
push 1
push edx
push ecx
lea edi, [esp + 0xb8]
push edi
mov edx, dword [esp + 0x14]
call edx
push dword [esp + 0x364]
push dword [esp + 0x364]
call dword [sym.imp.USER32.dll_SetCursorPos]
lea edx, [esp + 0x368]
push 0x9c
push 0
push edx
call fcn.0046e690
add esp, 0xc
mov edx, 0x9c
xor ecx, ecx
mov edi, dword [esp + 0x420]
mov word [esp + 0x38c], dx
mov edx, dword [esp + 0x424]
mov word [esp + 0x38e], cx
mov dword [esp + 0x390], 0x20
mov dword [esp + 0x394], edi
mov dword [esp + 0x398], edx
push esi
call dword [sym.imp.USER32.dll_SetThreadDesktop]
push ebp
call dword [sym.imp.USER32.dll_CloseDesktop]
mov dword [esp + 0x404], 1
mov ecx, 4
lea edx, [esp + 0x404]
push ecx
push edx
push ecx
push 0
push 0x4979a0
push dword [esp + 0x368]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x409909
mov eax, 1
add esp, 0x408
pop ebx
pop ebp
pop esi
pop edi
ret 0x14
push dword [esp + 0x350]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esp + 0x354]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40998e
push esi
call dword [sym.imp.USER32.dll_SetThreadDesktop]
push ebp
call dword [sym.imp.USER32.dll_CloseDesktop]
xor ebp, ebp
mov ecx, 4
lea edx, [esp + 0x35c]
mov dword [esp + 0x35c], ebp
push ecx
push edx
push ecx
push ebp
push 0x4979a0
push dword [esp + 0x368]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x409974
mov eax, 1
add esp, 0x408
pop ebx
pop ebp
pop esi
pop edi
ret 0x14
push dword [esp + 0x350]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esp + 0x354]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x409999
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
add esp, 0x408
pop ebx
pop ebp
pop esi
pop edi
ret 0x14
push 0x1f4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Beep]
jmp 0x4097dc