Function at 0x403d80
Capabilities:
Persist via windows service
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x89c
mov eax, dword [0x43b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x88c], 0
push edi
push str.SYSTEMCurrentControlSetServices
push 0x80000002
call fcn.00413e50
mov esi, eax
test esi, esi
je 0x404197
push edi
push str.K7PSSrvc
push esi
call fcn.00413e50
test eax, eax
je 0x403dd8
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 1
test edi, edi
je 0x404197
cmp dword [0x43c4f4], 3
je 0x404197
push 0
lea eax, [ebp - 0x88c]
mov dword [ebp - 0x894], 3
push eax
push 0
push 3
push 0
push 0
push 0
push str.SoftwarePoliciesGoogleChromeExtensionInstallForcelist
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x404197
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, dword [sym.imp.USER32.dll_CharLowerW]
nop
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x890]
mov dword [ebp - 0x890], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x88c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [ebp - 0x890]
xor esi, esi
test eax, eax
je 0x403ee5
nop dword [eax]
lea eax, [ebp - 0x898]
mov dword [ebp - 0x898], 0x800
push eax
lea eax, [ebp - 0x888]
mov dword [ebp - 0x89c], 0x40
push eax
push 0
push 0
lea eax, [ebp - 0x89c]
push eax
lea eax, [ebp - 0x88]
push eax
push esi
push dword [ebp - 0x88c]
call edi
test eax, eax
jne 0x403ed2
lea eax, [ebp - 0x888]
push eax
call ebx
lea eax, [ebp - 0x888]
push 0x4366e8
push eax
call fcn.00416777
add esp, 8
test eax, eax
jne 0x403edf
mov eax, dword [ebp - 0x890]
inc esi
cmp esi, eax
jb 0x403e70
jmp 0x403ee5
mov eax, dword [ebp - 0x890]
cmp esi, eax
jne 0x403f61
inc eax
push eax
lea eax, [ebp - 0x88]
push 0x43672c
push eax
call fcn.00402210
mov ecx, 0x28
lea edi, [ebp - 0x888]
mov esi, str.dlpfamleaodfgmfnggonbfljhjggbdbe_http:__localhost:7080_k7sr_scripts_k7chrome.xml
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x888]
lea edx, [ecx + 2]
movsw word es:[edi], word [esi]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403f20
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
mov dword [ebp - 0x890], eax
lea eax, [ebp - 0x888]
push eax
push 1
push 0
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x88c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push dword [ebp - 0x88c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea eax, [ebp - 0x88c]
mov dword [ebp - 0x88c], 0
push eax
push 0
push dword [ebp - 0x894]
push 0
push 0
push 0
push str.SoftwarePoliciesGoogleChromeExtensionInstallWhitelist
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x404197
push eax
push eax
push eax
push eax
mov dword [ebp - 0x890], eax
lea eax, [ebp - 0x890]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x88c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [ebp - 0x890]
xor esi, esi
test eax, eax
je 0x404055
nop dword [eax + eax]
lea eax, [ebp - 0x898]
mov dword [ebp - 0x898], 0x800
push eax
lea eax, [ebp - 0x888]
mov dword [ebp - 0x89c], 0x40
push eax
push 0
push 0
lea eax, [ebp - 0x89c]
push eax
lea eax, [ebp - 0x88]
push eax
push esi
push dword [ebp - 0x88c]
call edi
test eax, eax
jne 0x404042
lea eax, [ebp - 0x888]
push eax
call ebx
lea eax, [ebp - 0x888]
push 0x4366e8
push eax
call fcn.00416777
add esp, 8
test eax, eax
jne 0x40404f
mov eax, dword [ebp - 0x890]
inc esi
cmp esi, eax
jb 0x403fe0
jmp 0x404055
mov eax, dword [ebp - 0x890]
cmp esi, eax
jne 0x4040fc
inc eax
push eax
lea eax, [ebp - 0x88]
push 0x43672c
push eax
call fcn.00402210
movups xmm0, xmmword [0x4366e8]
mov ax, word [0x436728]
lea ecx, [ebp - 0x888]
add esp, 0xc
mov word [ebp - 0x848], ax
movups xmmword [ebp - 0x888], xmm0
lea edx, [ecx + 2]
movups xmm0, xmmword [0x4366f8]
movups xmmword [ebp - 0x878], xmm0
movups xmm0, xmmword [0x436708]
movups xmmword [ebp - 0x868], xmm0
movups xmm0, xmmword [0x436718]
movups xmmword [ebp - 0x858], xmm0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4040c1
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
mov dword [ebp - 0x890], eax
lea eax, [ebp - 0x888]
push eax
push 1
push 0
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x88c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x88c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x894], 3
mov dword [ebp - 0x88c], 0
jne 0x4041aa
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x894], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x404156
lea eax, [ebp - 0x894]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x894], 0
je 0x4041aa
push 0
lea eax, [ebp - 0x88c]
mov dword [ebp - 0x894], 0x103
push eax
push 0
push 0x103
push 0
push 0
push 0
push str.SoftwarePoliciesGoogleChromeExtensionInstallForcelist
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x403e30
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041559f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041559f
mov esp, ebp
pop ebp
ret