Function at 0x20002821
Capabilities:
Delete registry value
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x14f]
mov byte [ebp - 0x150], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x253]
mov byte [ebp - 0x254], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
mov dword [ebp - 8], 2
push eax
push 0xf003f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x4c], str.AMonCDW7.sys
mov dword [ebp - 0x48], str.AMonCDW8.sys
mov dword [ebp - 0x44], str.AMonHKNT.sys
mov dword [ebp - 0x40], str.AMonLWLH.sys
mov dword [ebp - 0x3c], str.AMonTDLH.sys
mov dword [ebp - 0x38], str.AMonTDNt.sys
mov dword [ebp - 0x34], str.AhnFlt2k.sys
mov dword [ebp - 0x30], str.AhnRec2k.sys
mov dword [ebp - 0x2c], str.AhnRghNt.sys
mov dword [ebp - 0x28], str.EstCst.sys
mov dword [ebp - 0x24], str.EstRtw.sys
mov dword [ebp - 0x20], str.EstRtwIFDrv.sys
mov dword [ebp - 0x1c], str.V3ElamDr.sys
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, 0x104
test eax, eax
jne 0x20002c1a
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.NaverVaccine
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20002973
lea eax, [ebp - 0x150]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20002930
mov byte [eax], bl
lea eax, [ebp - 0x14f]
push eax
lea eax, [ebp - 0x254]
push str.___s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x254]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call edi
push str.NaverVaccine
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.NCleaner
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x200029f9
lea eax, [ebp - 0x150]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x200029b6
mov byte [eax], bl
lea eax, [ebp - 0x14f]
push eax
lea eax, [ebp - 0x254]
push str.___s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x254]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call edi
push str.NCleaner
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.AhnLab_V3Lite_Tray_Process
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20002a7f
lea eax, [ebp - 0x150]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20002a3c
mov byte [eax], bl
lea eax, [ebp - 0x14f]
push eax
lea eax, [ebp - 0x254]
push str.___s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x254]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call edi
push str.AhnLab_V3Lite_Tray_Process
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.V3_Application
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20002b05
lea eax, [ebp - 0x150]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20002ac2
mov byte [eax], bl
lea eax, [ebp - 0x14f]
push eax
lea eax, [ebp - 0x254]
push str.___s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x254]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call edi
push str.V3_Application
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.ALYac
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20002b8b
lea eax, [ebp - 0x150]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20002b48
mov byte [eax], bl
lea eax, [ebp - 0x14f]
push eax
lea eax, [ebp - 0x254]
push str.___s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x254]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call edi
push str.ALYac
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x2000868c
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20002c11
lea eax, [ebp - 0x150]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20002bce
mov byte [eax], bl
lea eax, [ebp - 0x14f]
push eax
lea eax, [ebp - 0x254]
push str.___s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x254]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call edi
push 0x2000868c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetServicesV3_Lite_Service
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x20002cce
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.ImagePath
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20002cc5
cmp byte [ebp - 0x150], 0x22
jne 0x20002c90
lea eax, [ebp - 0x150]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20002c88
mov byte [eax], bl
lea eax, [ebp - 0x14f]
jmp 0x20002c96
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x254]
push str.___s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x254]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetServicesV3_Service
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x20002d82
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.ImagePath
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20002d79
cmp byte [ebp - 0x150], 0x22
jne 0x20002d44
lea eax, [ebp - 0x150]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20002d3c
mov byte [eax], bl
lea eax, [ebp - 0x14f]
jmp 0x20002d4a
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x254]
push str.___s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x254]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetServicesALYac_RTSrv
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x20002e25
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.ImagePath
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20002e1c
lea eax, [ebp - 0x150]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20002de7
mov byte [eax], bl
lea eax, [ebp - 0x14f]
push eax
lea eax, [ebp - 0x254]
push str.___s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x254]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetServicesALYac_UpdSrv
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x20002ec8
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.ImagePath
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20002ebf
lea eax, [ebp - 0x150]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20002e8a
mov byte [eax], bl
lea eax, [ebp - 0x14f]
push eax
lea eax, [ebp - 0x254]
push str.___s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x254]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetServicesNsavsvc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x20002f6b
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.ImagePath
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20002f62
lea eax, [ebp - 0x150]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20002f2d
mov byte [eax], bl
lea eax, [ebp - 0x14f]
push eax
lea eax, [ebp - 0x254]
push str.___s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x254]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetServicesNsvmon
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x2000300e
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.ImagePath
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20003005
lea eax, [ebp - 0x150]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20002fd0
mov byte [eax], bl
lea eax, [ebp - 0x14f]
push eax
lea eax, [ebp - 0x254]
push str.___s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x254]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetServicesNaver_Updater
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x200030b1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.ImagePath
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x200030a8
lea eax, [ebp - 0x150]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20003073
mov byte [eax], bl
lea eax, [ebp - 0x14f]
push eax
lea eax, [ebp - 0x254]
push str.___s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x254]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], 0xd
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x150]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x150]
push str.drivers_
push eax
call sub.MSVCRT.dll_strcat
mov eax, dword [ebp - 0x14]
push dword [eax]
lea eax, [ebp - 0x150]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x254]
push str.___s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x254]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call edi
add dword [ebp - 0x14], 4
dec dword [ebp - 0x18]
jne 0x200030be
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4