Function at 0x43c150
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x21c
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call esi
call fcn.00445640
test eax, eax
je 0x43c401
call fcn.004459b0
test eax, eax
jne 0x43c183
push ebx
call fcn.004458a0
add esp, 4
push 0x47443c
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, ebx
mov dword [esp + 0x18], ebp
je 0x43c401
push edi
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x474420
push ebp
call edi
cmp eax, ebx
mov dword [esp + 0x20], eax
je case.0x43c388.0
push ebx
call esi
push 0x47440c
push ebp
call edi
mov ebp, eax
cmp ebp, ebx
je case.0x43c388.0
mov ecx, 0x37
xor eax, eax
mov edi, 0x485e78
push 0x485e78
push 0xffffffffffffffff
push ebx
rep stosd dword es:[edi], eax
mov word [0x485ebc], 0xdc
mov word [0x485ebe], bx
call dword [sym.imp.USER32.dll_EnumDisplaySettingsW]
cmp eax, ebx
mov dword [0x485ec0], 0x1c0000
je case.0x43c388.0
mov ecx, 0xd2
xor eax, eax
mov edi, 0x485b30
push ebx
push 0x485b30
push ebx
rep stosd dword es:[edi], eax
push ebx
mov dword [0x485b30], 0x348
mov word [0x485e78], bx
xor edi, edi
call ebp
mov esi, eax
cmp esi, ebx
je case.0x43c388.0
push 0x4743c4
push 0x485b74
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x43c27e
inc edi
push ebx
push 0x485b30
push edi
push ebx
mov dword [0x485b30], 0x348
call ebp
mov esi, eax
cmp esi, ebx
jne 0x43c24a
jmp case.0x43c388.0
cmp esi, ebx
je case.0x43c388.0
push 0x485d78
call fcn.004529cf
push 0x4743b4
push 0x485d78
call fcn.0045298e
add esp, 0xc
cmp eax, ebx
jne 0x43c2b2
lea eax, [esp + 0x24]
push 0x4743a4
push eax
jmp 0x43c2bb
add eax, 2
lea ecx, [esp + 0x24]
push eax
push ecx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea edx, [esp + 0x10]
push edx
push 0x4742e8
push reloc.WSOCK32.dll_bind
call esi
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x24]
push eax
push ecx
push edx
call esi
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push ebx
push 0x4742c4
push ecx
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [0x485ec0]
push 0x4742b4
or esi, 0x1c0020
push 0x485e78
mov dword [0x485f20], ebx
mov dword [0x485ec4], ebx
mov dword [0x485ec8], ebx
mov dword [0x485f24], ebx
mov dword [0x485f28], ebx
mov dword [0x485ec0], esi
call edi
mov esi, dword [esp + 0x20]
push ebx
push 9
push ebx
push 0x485e78
push 0x485b34
call esi
cmp eax, 0xffffffff
jne 0x43c380
call fcn.004459b0
test eax, eax
jne 0x43c370
push ebx
call fcn.004458a0
add esp, 4
push ebx
push 9
push ebx
push 0x485e78
push 0x485b34
call esi
lea ecx, [eax + 6]
cmp ecx, 7
ja case.default.0x43c388
jmp dword [ecx*4 + 0x43c40c]
push eax
push 0x47a450
jmp 0x43c3cd
push eax
push 0x47a41c
jmp 0x43c3cd
push eax
push 0x47a3e8
jmp 0x43c3cd
push eax
push 0x47a3b0
jmp 0x43c3cd
push eax
push 0x47a37c
jmp 0x43c3cd
push eax
push 0x47a348
jmp 0x43c3cd
push eax
push 0x47a310
jmp 0x43c3cd
push eax
push 0x47a2e8
call fcn.00446e00
add esp, 8
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
pop edi
je 0x43c3f6
push eax
call esi
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x43c401
push eax
call esi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret