Function at 0x4d4220
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x639ac0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0xf003f
push 0
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp + 0x18]
push 0
mov dword [ebp - 0x81c], eax
mov dword [ebp - 0x810], 1
mov dword [ebp - 0x808], 0
mov dword [ebp - 0x814], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x4d42b6
push str.LoadDeviceDriverPP:_OpenSCManager_failed___schSCManager_is_null
push 0x6411e0
call fcn.00432fe0
push 0x6411e0
call fcn.00455a00
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f66cd
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x10]
push edi
push esi
push str.LoadDeviceDriverPP:_Name:__s___Path:__s____LPTNumber__d
push 0x6411e0
call fcn.00432fe0
push 0x6411e0
call fcn.00455a00
add esp, 0x18
cmp dword [0x1aab338], 0
je 0x4d42ea
mov eax, dword [0x1aab33c]
cmp dword [eax], 0
jg 0x4d42fe
push str.LoadDeviceDriverPP:_g_pSharedAppCount___0
call fcn.00455a00
push esi
push ebx
call fcn.004d4700
add esp, 0xc
push edi
push esi
push ebx
call fcn.004d40a0
push esi
lea eax, [ebp - 0x804]
push str.SystemCurrentControlSetServices_s
push eax
call fcn.00432fe0
add esp, 0x18
lea eax, [ebp - 0x808]
push eax
push 0x2001f
push 0
lea eax, [ebp - 0x804]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4d4384
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push str.DIRECTIOLPT
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x810], eax
test eax, eax
je 0x4d4384
push dword [ebp + 0x10]
push eax
push str.LoadDeviceDriverPP:_RegSetValueEx_failed:__d____dwLPTNumber:__d
push 0x6411e0
call fcn.00432fe0
push 0x6411e0
call fcn.00455a00
add esp, 0x14
mov eax, dword [ebp - 0x808]
test eax, eax
jne 0x4d43cb
push edi
push esi
push str.LoadDeviceDriverPP:_Failed_to_write_parallel_port_number_to_registry_1___s___s__n
push 0x400
push 0x1b2dd00
call fcn.00424aa0
push 0x1b2dd00
call fcn.00455a00
add esp, 0x18
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f66cd
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x810], 0
je 0x4d441f
push edi
push esi
push str.LoadDeviceDriverPP:_Failed_to_write_parallel_port_number_to_registry_2___s___s__n
push 0x400
push 0x1b2dd00
call fcn.00424aa0
push 0x1b2dd00
call fcn.00455a00
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x18
call eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f66cd
mov esp, ebp
pop ebp
ret
push esi
push ebx
call fcn.004d47c0
push dword [ebp - 0x80c]
push esi
call fcn.004d45a0
add esp, 0x10
mov dword [ebp - 0x80c], eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [ebp - 0x808]
mov dword [ebp - 0x818], 4
push eax
push 0x2001f
push 0
lea eax, [ebp - 0x804]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4d44bb
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x814]
push eax
push 0
push 0
push str.IOAddress
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
je 0x4d44c0
push ebx
push dword [ebp + 0x10]
push str.LoadDeviceDriverPP:_LPT__d_RegQueryValueEx_failed:__d____IOAddress
push 0x6411e0
call fcn.00432fe0
push 0x6411e0
call fcn.00455a00
add esp, 0x14
jmp 0x4d44c0
mov ebx, 1
mov eax, dword [ebp - 0x808]
test eax, eax
jne 0x4d4501
push edi
push esi
push str.LoadDeviceDriverPP:_Failed_to_read_IO_address_from_registry_1___s___s__n
push 0x400
push 0x1b2dd00
call fcn.00424aa0
push 0x1b2dd00
call fcn.00455a00
add esp, 0x18
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f66cd
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x4d4563
mov ecx, dword [ebp - 0x814]
lea eax, [ecx - 1]
cmp eax, 0xfffe
ja 0x4d455a
mov eax, dword [ebp - 0x81c]
mov esi, dword [ebp - 0x80c]
push esi
push str.LoadDeviceDriverPP:_Return__d
push 0x6411e0
mov dword [eax], ecx
call fcn.00432fe0
push 0x6411e0
call fcn.00455a00
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f66cd
mov esp, ebp
pop ebp
ret
push edi
push esi
push str.LoadDeviceDriverPP:_Failed_to_read_IO_address_from_registry_2___s___s__n
jmp 0x4d4571
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push edi
push esi
push str.LoadDeviceDriverPP:_Failed_to_read_IO_address_from_registry_3___s___s__n
push 0x400
push 0x1b2dd00
call fcn.00424aa0
push 0x1b2dd00
call fcn.00455a00
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.004f66cd
mov esp, ebp
pop ebp
ret