Function at 0x417950
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov dword [ebp - 0x118], ecx
mov eax, dword [0x449df8]
movzx ecx, byte [eax + 0x449c24]
test ecx, ecx
jne 0x417986
push 0x43dee8
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
jmp 0x4179cd
mov eax, dword [0x449df8]
movzx ecx, byte [eax + 0x449c24]
test ecx, ecx
je 0x4179cd
mov edx, dword [0x449df8]
movzx eax, byte [edx + 0x449c24]
cmp eax, 0xff
je 0x4179cd
mov ecx, dword [0x449df8]
movzx edx, byte [ecx + 0x449c24]
push edx
push 0x43df14
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x10c]
push ecx
push 0x20006
push 0
lea edx, [ebp - 0x108]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x417a03
xor al, al
jmp 0x417c5d
push 4
push 0x449df8
push 4
push 0
push 0x43df40
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x417a38
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x417c5d
push 4
mov edx, dword [ebp - 0x118]
mov eax, dword [edx + 0x2ec]
add eax, 0x28
push eax
push 4
push 0
push 0x43df50
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x417a78
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x417c5d
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax + 0x2ec]
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x110], edx
push 4
lea eax, [ebp - 0x110]
push eax
push 4
push 0
push 0x43df5c
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x417ac4
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x417c5d
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax + 0x2ec]
mov eax, dword [ecx + 0x20]
mov edx, dword [ecx + 0x24]
mov cl, 0x20
call fcn.00421ea0
mov dword [ebp - 0x110], eax
push 4
lea edx, [ebp - 0x110]
push edx
push 4
push 0
push 0x43df70
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x417b1a
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x417c5d
push 4
mov edx, dword [ebp - 0x118]
mov eax, dword [edx + 0x2ec]
push eax
push 4
push 0
push 0x43df88
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x417b57
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x417c5d
push 4
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax + 0x2ec]
add ecx, 4
push ecx
push 4
push 0
push 0x43df98
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x417b97
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x417c5d
push 4
mov ecx, dword [ebp - 0x118]
mov edx, dword [ecx + 0x2ec]
add edx, 0xc
push edx
push 4
push 0
push 0x43dfac
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x417bd7
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x417c5d
push 0x64
mov edx, dword [ebp - 0x118]
add edx, 0x23e
push edx
push 1
push 0
push 0x43dfb4
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x417c11
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x417c5d
push 4
mov edx, dword [ebp - 0x118]
mov eax, dword [edx + 0x2ec]
add eax, 8
push eax
push 4
push 0
push 0x43dfc4
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x417c4e
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x417c5d
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret