Function at 0xc25000
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [0xc57104]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x840], ecx
mov ecx, dword [ebp - 0x840]
call fcn.00c25330
test eax, eax
je 0xc2531b
mov eax, dword [ebp - 0x840]
cmp dword [eax + 0x18c], 0
je 0xc2531b
mov dword [ebp - 4], 0
mov dword [ebp - 0x818], 0
lea ecx, [ebp - 0x818]
push ecx
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 0
jne 0xc250b9
mov dword [ebp - 0x820], 0
cmp dword [ebp - 4], 0
je 0xc250a4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x820], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0x81c], eax
mov ecx, dword [ebp - 0x818]
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x81c], 0
jne 0xc252e2
push 0x400
push 0
lea edx, [ebp - 0x808]
push edx
call fcn.00c33270
add esp, 0xc
push 0x400
push 0
lea eax, [ebp - 0x408]
push eax
call fcn.00c33270
add esp, 0xc
mov ecx, dword [ebp - 0x840]
add ecx, 0xf18
mov dword [ebp - 0x824], ecx
mov edx, dword [ebp - 0x824]
cmp dword [edx + 0x18], 0x10
jb 0xc25121
mov eax, dword [ebp - 0x824]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x844], ecx
jmp 0xc25130
mov edx, dword [ebp - 0x824]
add edx, 4
mov dword [ebp - 0x844], edx
mov eax, dword [ebp - 0x844]
push eax
lea ecx, [ebp - 0x808]
push ecx
call fcn.00c33974
add esp, 8
lea edx, [ebp - 0x808]
push edx
call fcn.00c332d0
add esp, 4
test eax, eax
je 0xc2518c
lea eax, [ebp - 0x808]
sub eax, 1
push eax
call fcn.00c332d0
add esp, 4
movsx ecx, byte [ebp + eax - 0x808]
cmp ecx, 0x5c
je 0xc2518c
push 0xc4b588
lea edx, [ebp - 0x808]
push edx
call fcn.00c33c10
add esp, 8
mov eax, dword [ebp - 0x840]
add eax, 0x190
mov dword [ebp - 0x828], eax
mov ecx, dword [ebp - 0x828]
cmp dword [ecx + 0x18], 0x10
jb 0xc251ba
mov edx, dword [ebp - 0x828]
mov eax, dword [edx + 4]
mov dword [ebp - 0x848], eax
jmp 0xc251c9
mov ecx, dword [ebp - 0x828]
add ecx, 4
mov dword [ebp - 0x848], ecx
mov edx, dword [ebp - 0x848]
push edx
lea eax, [ebp - 0x808]
push eax
call fcn.00c33c10
add esp, 8
mov ecx, dword [ebp - 0x840]
add ecx, 0x1ac
mov dword [ebp - 0x82c], ecx
mov edx, dword [ebp - 0x82c]
cmp dword [edx + 0x18], 0x10
jb 0xc2520e
mov eax, dword [ebp - 0x82c]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x84c], ecx
jmp 0xc2521d
mov edx, dword [ebp - 0x82c]
add edx, 4
mov dword [ebp - 0x84c], edx
mov eax, dword [ebp - 0x84c]
push eax
lea ecx, [ebp - 0x808]
push ecx
push str._s::Enabled:_s
lea edx, [ebp - 0x408]
push edx
call fcn.00c33974
add esp, 0x10
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
lea ecx, [ebp - 0x408]
push ecx
push 1
push 0
lea edx, [ebp - 0x808]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0xc252a9
mov dword [ebp - 0x80c], 1
mov dword [ebp - 0x830], 0
cmp dword [ebp - 4], 0
je 0xc252a1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x830], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x80c]
jmp 0xc25320
mov dword [ebp - 0x810], 0
mov dword [ebp - 0x834], 0
cmp dword [ebp - 4], 0
je 0xc252da
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x834], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x810]
jmp 0xc25320
mov dword [ebp - 0x814], 0
mov dword [ebp - 0x838], 0
cmp dword [ebp - 4], 0
je 0xc25313
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x838], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x814]
jmp 0xc25320
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00c32666
mov esp, ebp
pop ebp
ret