Function at 0x401a30
Capabilities:
Check if file exists
Copy file
Create service
Delete file
Delete service
Get common file path
Get file attributes
Persist via windows service
Start service
Stop service

Disassembly:
sub esp, 0x27c
mov ecx, str.ROCKEYNT
mov word [esp + 2], 0
lea edx, [esp + 4]
push ebx
push esi
mov eax, dword [ecx]
push edi
mov ebx, dword [ecx + 4]
push ebp
mov dword [edx], eax
mov si, word [esp + 0x290]
mov cl, byte [ecx + 8]
test si, si
mov dword [edx + 4], ebx
mov byte [edx + 8], cl
jne 0x401a76
mov ax, 8
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x27c
ret
cmp dword [0x49f010], 0
jne 0x401cd2
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0
cmp eax, 0x80000000
push 0x80
push 3
push 0
push 0
push 0xc0000000
jae 0x401c76
push str..ROCKEYNT
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
call edi
mov dword [0x49f010], eax
cmp eax, 0xffffffff
jne 0x401cd2
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x401ae5
mov ax, 0xffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x27c
ret
lea eax, [esp + 0x8c]
push 0x100
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call ebp
lea ecx, [esp + 0x8c]
push str.drivers_rockeynt.sys
push ecx
call fcn.00401830
lea eax, [esp + 0x94]
add esp, 8
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push eax
call ebp
cmp eax, 0xffffffff
je 0x401b5d
lea eax, [esp + 0x14]
push 0xf01ff
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, eax
test ebp, ebp
je 0x401bc4
lea eax, [esp + 0x70]
push eax
push 1
push ebp
call dword [sym.imp.ADVAPI32.dll_ControlService]
push ebp
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x401bc4
lea eax, [esp + 0x18c]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0x18c]
push str._rockeynt.sys
push ecx
call fcn.00401830
lea ecx, [esp + 0x194]
add esp, 8
push ecx
call ebp
cmp eax, 0xffffffff
jne 0x401baa
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ax, 2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x27c
ret
lea eax, [esp + 0x8c]
push 0
lea ecx, [esp + 0x190]
push eax
push ecx
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
call ebp
lea eax, [esp + 0x8c]
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push eax
push 1
push 2
push 1
push 0xf01ff
push ecx
lea ecx, [esp + 0x40]
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
lea ecx, [esp + 0x14]
push 0xf01ff
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, eax
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x401c1b
mov word [esp + 0x12], 0xffff
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push str..ROCKEYNT
call edi
mov dword [0x49f010], eax
cmp eax, 0xffffffff
jne 0x401c5e
mov word [esp + 0x12], 0xffff
cmp word [esp + 0x12], 0
je 0x401cd2
mov ax, word [esp + 0x12]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x27c
ret
push str..ROCKEY9X
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
call edi
mov dword [0x49f010], eax
cmp eax, 0xffffffff
jne 0x401cd2
push 0
push 0x4000000
push 1
push 0
push 0
push 0
push str.._rockey9x.vxd
call edi
mov dword [0x49f010], eax
cmp eax, 0xffffffff
jne 0x401cd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x32
jne 0x401cc3
push str..ROCKEY9X
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ax, 2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x27c
ret
mov ecx, dword [esp + 0x294]
mov edx, dword [esp + 0x298]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
mov ecx, dword [esp + 0x2a0]
mov edx, dword [esp + 0x2a4]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
movzx eax, si
mov ecx, dword [esp + 0x2ac]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x29c]
mov edx, dword [esp + 0x2b0]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x3c], ecx
mov eax, dword [esp + 0x2a8]
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], edx
lea eax, [esp + 0x48]
push eax
push ecx
call fcn.00401860
lea ecx, [esp + 0x4c]
lea edx, [esp + 0x1a]
lea eax, [esp + 0x50]
add esp, 8
push 0
push ecx
push 2
mov ecx, dword [0x49f010]
push edx
push 0x28
push eax
push 0xa410e400
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x401d7d
mov ax, 0xffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x27c
ret
mov ax, word [esp + 0x12]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x27c
ret