Function at 0x401750
Capabilities:
Delete registry key
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x41c690]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [str.SYSTEMCurrentControlSetServicesEventLogApplication_]
push ebx
xor ebx, ebx
lea edx, [esp + 0x14]
mov dword [esp + 8], ebx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x401776
mov ecx, dword [0x41c04c]
mov edx, dword [ecx + 8]
push 0x100
lea eax, [esp + 0x18]
push eax
mov eax, dword [edx + 4]
push eax
call fcn.004010d0
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [str.SYSTEMCurrentControlSetServicesEventLogApplication_]
lea edx, [esp + 8]
push edx
push 0xf003f
push ebx
push eax
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401962
mov edx, dword [esp + 8]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 8]
push ecx
push ebx
push ebx
push ebx
push str.Sources
push edx
call edi
test eax, eax
jne 0x401956
mov eax, dword [esp + 8]
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
push 0x40
call esi
mov ecx, dword [esp + 0x10]
push ecx
push 0x40
mov ebp, eax
call esi
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push ebp
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
push ebx
push str.Sources
push ecx
call edi
test eax, eax
jne 0x401944
mov edi, dword [esp + 0x18]
mov esi, ebp
cmp word [ebp], bx
je 0x401944
jmp 0x401850
mov edx, dword [0x41c04c]
mov eax, dword [edx + 8]
mov ecx, dword [eax + 4]
mov eax, esi
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401886
test dx, dx
je 0x401882
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401886
add eax, 4
add ecx, 4
test dx, dx
jne 0x401860
xor eax, eax
jmp 0x40188b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov eax, esi
je 0x4018c5
mov edx, edi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x401895
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4018b0
sub eax, edx
sar eax, 1
lea edi, [edi + eax*2 + 2]
jmp 0x4018fc
lea edx, [eax + 2]
jmp 0x4018d0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4018d0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
cmp eax, dword [esp + 0x10]
jle 0x4018ef
sub dword [esp + 0x10], eax
jmp 0x4018f7
mov dword [esp + 0x10], 0
mov ebx, 1
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401901
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 + 2], cx
lea esi, [esi + eax*2 + 2]
jne 0x401850
test ebx, ebx
je 0x401944
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
push 0
push str.Sources
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
pop esi
pop ebp
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [esp + 0x214]
pop ebx
xor ecx, esp
call fcn.00408f97
add esp, 0x214
ret