Function at 0x404228
Capabilities:
Copy file
Create service
Delete file
Delete service
Get common file path
Persist via windows service
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd88
mov eax, dword [str.ROCKEYNT]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov word [ebp - 6], 0
mov dword [ebp - 0x10], eax
mov eax, dword [0x48312c]
test di, di
mov dword [ebp - 0xc], eax
mov al, byte [0x483130]
mov byte [ebp - 8], al
jne 0x404266
mov ax, 8
jmp 0x404515
cmp dword [0x483120], 0
jne 0x40449f
call sub.KERNEL32.DLL_GetVersion
cmp eax, 0x80000000
jae 0x404436
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push 0x483135
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
mov dword [0x483120], ebx
cmp ebx, 0xffffffff
jne 0x40449f
push 0xf003f
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jne 0x4042cd
mov ax, 0xffff
jmp 0x404515
push 0x100
lea edx, [ebp - 0x178]
push edx
call sub.KERNEL32.DLL_GetSystemDirectoryA
push str.drivers_rockeynt.sys
lea ecx, [ebp - 0x178]
push ecx
call fcn.0046303c
add esp, 8
push 0
lea eax, [ebp - 0x178]
push eax
call fcn.004644b8
add esp, 8
inc eax
je 0x404335
push 0xf01ff
lea edx, [ebp - 0x10]
push edx
push ebx
call sub.ADVAPI32.DLL_OpenServiceA
mov esi, eax
test esi, esi
je 0x404392
lea eax, [ebp - 0x78]
push eax
push 1
push esi
call sub.ADVAPI32.DLL_ControlService
push esi
call sub.ADVAPI32.DLL_DeleteService
push esi
call sub.ADVAPI32.DLL_CloseServiceHandle
jmp 0x404392
lea edx, [ebp - 0x278]
push edx
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push str._rockeynt.sys
lea ecx, [ebp - 0x278]
push ecx
call fcn.0046303c
add esp, 8
push 0
lea eax, [ebp - 0x278]
push eax
call fcn.004644b8
add esp, 8
inc eax
jne 0x40437d
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
mov ax, 2
jmp 0x404515
push 0
lea edx, [ebp - 0x178]
push edx
lea ecx, [ebp - 0x278]
push ecx
call sub.KERNEL32.DLL_CopyFileA
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x178]
push eax
push 1
push 2
push 1
push 0xf01ff
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x10]
push ecx
push ebx
call sub.ADVAPI32.DLL_CreateServiceA
push 0xf01ff
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.ADVAPI32.DLL_OpenServiceA
mov esi, eax
push 0
push 0
push esi
call sub.ADVAPI32.DLL_StartServiceA
test eax, eax
jne 0x4043e1
mov word [ebp - 6], 0xffff
push esi
call sub.ADVAPI32.DLL_CloseServiceHandle
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
push 0x3e8
call sub.KERNEL32.DLL_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push str..ROCKEYNT
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
mov dword [0x483120], ebx
cmp ebx, 0xffffffff
jne 0x404426
mov word [ebp - 6], 0xffff
cmp word [ebp - 6], 0
je 0x40449f
mov ax, word [ebp - 6]
jmp 0x404515
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push 0x483173
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
mov dword [0x483120], ebx
cmp ebx, 0xffffffff
jne 0x40449f
push 0
push 0x4000000
push 1
push 0
push 0
push 0
push str.._rockey9x.vxd
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
mov dword [0x483120], ebx
cmp ebx, 0xffffffff
jne 0x40449f
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x32
jne 0x404499
push str..ROCKEY9X
call sub.KERNEL32.DLL_DeleteFileA
mov ax, 2
jmp 0x404515
movzx edx, di
mov dword [ebp - 0x34], edx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp + 0x20]
mov dword [ebp - 0x1c], edx
lea edx, [ebp - 0x5c]
mov ecx, dword [ebp + 0x24]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x34]
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x14], eax
push edx
push ecx
call fcn.00404008
add esp, 8
lea eax, [ebp - 4]
lea edx, [ebp - 6]
lea ecx, [ebp - 0x5c]
push 0
push eax
push 2
push edx
push 0x28
push ecx
mov eax, dword [0x483120]
push 0xa410e400
push eax
call sub.KERNEL32.DLL_DeviceIoControl
test eax, eax
jne 0x404511
mov ax, 0xffff
jmp 0x404515
mov ax, word [ebp - 6]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret