Function at 0x425b94
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
push esi
push edi
lea eax, [ebp - 0x78]
push eax
push 0xf003f
push 0
push 0x473664
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
mov esi, str.Provides_Application_Metering_and_Control
lea edi, [ebp - 0x74]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x74]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x74]
push eax
push 1
push 0
push str.Description
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x462284], 0
je 0x425c7b
lea eax, [ebp - 0x78]
push eax
push 0xf003f
push 0
push 0x4736d8
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x425c76
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x473704
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x425c76
mov eax, 0xff
jmp 0x425e70
jmp 0x425d55
cmp dword [0x462280], 0
je 0x425cf1
lea eax, [ebp - 0x78]
push eax
push 0xf003f
push 0
push 0x47375c
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x425cec
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x473788
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x425cec
mov eax, 0xff
jmp 0x425e70
jmp 0x425d55
lea eax, [ebp - 0x78]
push eax
push 0xf003f
push 0
push 0x4737dc
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x425d55
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x473808
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x425d55
mov eax, 0xff
jmp 0x425e70
mov dword [ebp - 0x10], 0x64
mov byte [ebp - 0x73], 0
mov al, byte [ebp - 0x73]
mov byte [ebp - 0x74], al
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x74]
push eax
push 0
push 0
push 0x47385c
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x425df6
cmp dword [0x462284], 0
je 0x425db2
mov esi, str.SofTrack_Local_Workstation_Metering_Agent_64bit_Kernel_Driver
lea edi, [ebp - 0x74]
mov ecx, 0xf
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x425dc4
mov esi, str.SofTrack_Local_Workstation_Metering_Agent_32bit_Kernel_Driver
lea edi, [ebp - 0x74]
mov ecx, 0xf
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x74]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x74]
push eax
push 1
push 0
push str.DisplayName
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push str.ErrorControl
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 3
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push str.Start
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 1
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push 0x47391c
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x425e70
pop edi
pop esi
pop ebx
leave
ret