Function at 0x43bb10
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x340
push ebx
push edi
call fcn.00445640
test eax, eax
jne 0x43bb2a
pop edi
pop ebx
add esp, 0x340
ret
call fcn.004459b0
test eax, eax
jne 0x43bb3c
push eax
call fcn.004458a0
add esp, 4
xor ebx, ebx
push 0x47443c
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x1c], edi
jne 0x43bb6a
pop edi
xor eax, eax
pop ebx
add esp, 0x340
ret
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x474420
push edi
call esi
mov ebp, eax
cmp ebp, ebx
je 0x43c0cc
push 0x47440c
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x43c0cc
mov eax, dword [esp + 0x354]
mov ecx, dword [eax + 0x7d4]
shl ecx, 4
lea edx, [ecx + eax + 0x7f0]
lea eax, [esp + 0x34]
push edx
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov ecx, 0x37
xor eax, eax
mov edi, 0x485e78
push 0x485e78
push 0xffffffffffffffff
push eax
rep stosd dword es:[edi], eax
mov word [0x485ebc], 0xdc
mov word [0x485ebe], ax
call dword [sym.imp.USER32.dll_EnumDisplaySettingsW]
test eax, eax
mov dword [0x485ec0], 0x1c0020
je 0x43c0cc
mov ecx, 0xd2
xor eax, eax
mov edi, 0x485b30
rep stosd dword es:[edi], eax
xor edi, edi
mov dword [0x485b30], 0x348
push edi
push 0x485b30
push edi
push edi
mov word [0x485e78], di
call ebx
mov esi, eax
test esi, esi
je 0x43bc5e
push 0x4743c4
push 0x485b74
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x43bc5a
inc edi
push 0
push 0x485b30
push edi
push 0
mov dword [0x485b30], 0x348
call ebx
mov esi, eax
test esi, esi
jne 0x43bc27
jmp 0x43bc5e
test esi, esi
jne 0x43bc99
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x43bc6f
mov esi, 2
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x43bc8c
push esi
push 0x47a2a0
call fcn.00446e00
add esp, 8
mov dword [esp + 0x18], 2
jmp 0x43c0cc
push 0x485d78
call fcn.004529cf
push 0x4743b4
push 0x485d78
call fcn.0045298e
add esp, 0xc
test eax, eax
jne 0x43bcc8
lea ecx, [esp + 0x148]
push 0x4743a4
push ecx
jmp 0x43bcd4
add eax, 2
lea edx, [esp + 0x148]
push eax
push edx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea eax, [esp + 0x10]
push eax
push 0x4742e8
push reloc.WSOCK32.dll_bind
call esi
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x148]
push ecx
push edx
push eax
call esi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push 4
push ecx
push 4
push 0
mov ebx, 1
push 0x4742c4
push edx
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x4742b4
push 0x485e78
call edi
mov eax, dword [0x479a4c]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4c
mov dword [0x485f20], eax
call esi
push 0x4d
mov dword [0x485ec4], eax
call esi
push 0x4e
mov dword [0x485ec8], eax
call esi
push 0x4f
mov dword [0x485f24], eax
call esi
mov esi, dword [0x485ec0]
push 0
or esi, 0x1c0020
push ebx
mov dword [0x485ec0], esi
push 0
mov esi, 0x348
push 0x485e78
push 0x485b34
mov dword [0x485f28], eax
mov dword [0x485b30], esi
call ebp
cmp eax, 0xffffffff
jne 0x43bdc1
call fcn.004459b0
test eax, eax
jne 0x43bdb0
push eax
call fcn.004458a0
add esp, 4
push 0
push ebx
push 0
push 0x485e78
push 0x485b34
call ebp
lea ecx, [eax + 6]
cmp ecx, 7
ja case.default.0x43bdcd
jmp dword [ecx*4 + 0x43c10c]
push 0
push 0
push 0
push 0x485e78
push 0x485b34
mov dword [0x485b30], esi
call ebp
lea ecx, [eax + 6]
cmp ecx, 7
ja case.default.0x43bdf8
jmp dword [ecx*4 + 0x43c12c]
push 0
push 0
push 0x485b34
push 0x47a290
mov dword [0x485b2c], 0
call dword [sym.imp.GDI32.dll_CreateDCW]
test eax, eax
mov dword [0x485b2c], eax
jne 0x43be67
mov cl, byte [0x481910]
lea edi, [esp + 0x45]
mov byte [esp + 0x44], cl
mov ecx, 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x485b34
lea edx, [esp + 0x48]
push 0x47a264
push edx
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x48]
push eax
jmp 0x43c0c4
mov ecx, dword [0x479a44]
mov edx, dword [0x479a48]
mov dword [esp + 0x28], ecx
mov esi, dword [sym.imp.GDI32.dll_ExtEscape]
lea ecx, [esp + 0x28]
mov dword [esp + 0x2c], edx
push ecx
lea edx, [esp + 0x2c]
push 0xc
push edx
push 0xc
push 0x54495801
push eax
call esi
test eax, eax
jne 0x43beca
mov esi, dword [esp + 0x354]
mov ecx, esi
call fcn.004255c0
mov ecx, esi
call fcn.004255d0
cmp eax, 5
jl 0x43c0cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x47a23c
jmp 0x43c0c4
mov eax, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4863b4], eax
mov eax, dword [0x4859f4]
test eax, eax
je 0x43bf3c
mov edx, dword [0x485b2c]
push 0
lea ecx, [esp + 0x20]
push 0
push ecx
push 4
push 0x54495805
push edx
mov dword [esp + 0x34], eax
call esi
test eax, eax
jne 0x43bf13
call edi
push eax
push 0x47a224
call fcn.00446e00
add esp, 8
mov eax, dword [0x485b2c]
push 0
push 0
push 0
push 0
push 0x54495806
push eax
call esi
test eax, eax
jne 0x43bf3c
call edi
push eax
push 0x47a208
call fcn.00446e00
add esp, 8
mov eax, dword [0x4863b8]
test eax, eax
jne 0x43bf71
mov ecx, dword [0x479a40]
imul ecx, dword [0x4863b0]
push ecx
call fcn.004520a2
add esp, 4
mov dword [0x4863b8], eax
test eax, eax
jne 0x43bf71
call edi
push eax
push 0x47a1cc
jmp 0x43c0c4
mov eax, dword [0x4863bc]
test eax, eax
jne 0x43bfab
mov edx, dword [0x479a40]
lea eax, [edx*4 + 8]
push eax
mov dword [0x485b28], eax
call fcn.004520a2
add esp, 4
mov dword [0x4863bc], eax
test eax, eax
jne 0x43bfab
call edi
push eax
push 0x47a190
jmp 0x43c0c4
mov ecx, dword [0x479a40]
mov dword [eax], ecx
mov ecx, dword [0x479a40]
xor eax, eax
test ecx, ecx
jle 0x43bfec
mov edx, 4
mov ecx, dword [0x4863b0]
mov esi, dword [0x4863b8]
imul ecx, eax
add ecx, esi
mov esi, dword [0x4863bc]
inc eax
mov dword [edx + esi], ecx
mov ecx, dword [0x479a40]
add edx, 4
cmp eax, ecx
jl 0x43bfc4
mov eax, dword [0x4863c0]
test eax, eax
jne 0x43c023
shl ecx, 4
add ecx, 0x3f8
push ecx
mov dword [0x485b24], ecx
call fcn.004520a2
add esp, 4
mov dword [0x4863c0], eax
test eax, eax
jne 0x43c023
call edi
push eax
push 0x47a168
jmp 0x43c0c4
add eax, 4
mov dword [0x4863c4], eax
mov dword [0x4863c8], eax
mov eax, dword [0x4863b8]
test eax, eax
je 0x43c0cc
mov dword [esp + 0x18], ebx
jmp 0x43c0cc
push eax
push 0x47a13c
jmp 0x43c0c4
push eax
push 0x47a110
jmp 0x43c0c4
push eax
push 0x47a0e4
jmp 0x43c0c4
push eax
push 0x47a0b4
jmp 0x43c0c4
push eax
push 0x47a088
jmp 0x43c0c4
push eax
push 0x47a05c
jmp 0x43c0c4
push eax
push 0x47a02c
jmp 0x43c0c4
push eax
push 0x47a00c
jmp 0x43c0c4
push eax
push 0x479fe0
jmp 0x43c0c4
push eax
push 0x479fb4
jmp 0x43c0c4
push eax
push 0x479f88
jmp 0x43c0c4
push eax
push 0x479f58
jmp 0x43c0c4
push eax
push 0x479f2c
jmp 0x43c0c4
push eax
push 0x479f00
jmp 0x43c0c4
push eax
push 0x479ed0
jmp 0x43c0c4
push eax
push 0x479eb0
call fcn.00446e00
add esp, 8
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x43c0f0
push eax
call esi
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x43c0fb
push eax
call esi
mov eax, dword [esp + 0x18]
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x340
ret