Function at 0x425330
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x640
push ebx
push ebp
push esi
call fcn.00445640
test eax, eax
je 0x4255a4
call fcn.004459b0
test eax, eax
jne 0x425358
push eax
call fcn.004458a0
add esp, 4
xor ebx, ebx
push 0x47443c
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
cmp ebp, ebx
mov dword [esp + 0x10], ebp
je 0x4255a4
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x474420
push ebp
call edi
cmp eax, ebx
mov dword [esp + 0x20], eax
je 0x425578
push ebx
call esi
push 0x47440c
push ebp
call edi
mov ebx, eax
test ebx, ebx
je 0x425578
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov word [esp + 0x6a], ax
lea eax, [esp + 0x24]
push eax
push 0xffffffffffffffff
push 0
mov word [esp + 0x74], 0xdc
call dword [sym.imp.USER32.dll_EnumDisplaySettingsW]
test eax, eax
mov dword [esp + 0x6c], 0x1c0000
je 0x425578
mov ecx, 0xd2
xor eax, eax
lea edi, [esp + 0x100]
mov ebp, 0x348
rep stosd dword es:[edi], eax
xor edi, edi
lea ecx, [esp + 0x100]
push edi
push ecx
push edi
push edi
mov dword [esp + 0x110], ebp
mov word [esp + 0x34], di
call ebx
mov esi, eax
test esi, esi
je 0x425574
lea edx, [esp + 0x144]
push 0x4743c4
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x42545f
lea eax, [esp + 0x100]
inc edi
push 0
push eax
push edi
push 0
mov dword [esp + 0x110], ebp
call ebx
mov esi, eax
test esi, esi
jne 0x425426
jmp 0x425574
test esi, esi
je 0x425574
lea ecx, [esp + 0x348]
push ecx
call fcn.004529cf
lea edx, [esp + 0x34c]
push 0x4743b4
push edx
call fcn.0045298e
add esp, 0xc
test eax, eax
jne 0x42549c
lea eax, [esp + 0x448]
push 0x4743a4
push eax
jmp 0x4254a8
add eax, 2
lea ecx, [esp + 0x448]
push eax
push ecx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea edx, [esp + 0x10]
push edx
push 0x4742e8
push reloc.WSOCK32.dll_bind
call edi
test eax, eax
jne 0x425574
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x448]
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x425574
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push 4
push eax
push 4
push 0
push 0x4742c4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x425574
lea edx, [esp + 0x24]
push 0x4742b4
push edx
call esi
mov esi, dword [esp + 0x20]
push 0
push 1
lea eax, [esp + 0x2c]
push 0
lea ecx, [esp + 0x110]
push eax
push ecx
call esi
cmp eax, 0xffffffff
jne 0x42555f
call fcn.004459b0
test eax, eax
jne 0x42554a
push eax
call fcn.004458a0
add esp, 4
push 0
push 1
lea edx, [esp + 0x2c]
push 0
lea eax, [esp + 0x110]
push edx
push eax
call esi
push 0
push 0
lea ecx, [esp + 0x2c]
push 0
lea edx, [esp + 0x110]
push ecx
push edx
call esi
mov ebp, dword [esp + 0x14]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
pop edi
je 0x425599
push eax
call esi
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4255a4
push eax
call esi
pop esi
pop ebp
pop ebx
add esp, 0x640
ret