Function at 0x401c00
Capabilities:
Delete file
Delete registry key
Move file
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x43d180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push 0
push 0
push 0x402
push dword [0x440974]
call ebx
lea eax, [ebp - 0x210]
push eax
push str.SystemCurrentControlSetControlClass4D36E96B_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x401c61
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
call esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416230
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.UpperFilters
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x401cbd
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416230
mov esp, ebp
pop ebp
ret
push edi
push 0
push 0x1e
push 0x402
push dword [0x440974]
call ebx
mov esi, dword [ebp - 0x214]
cmp esi, 5
jb 0x401d1e
add esi, 0xfffffffb
lea edi, [ebp - 0x20c]
lea edi, [edi + esi*2]
jmp 0x401cf0
push str.GIDv2
push edi
call fcn.004162c7
add esp, 8
test eax, eax
jne 0x401d14
test esi, esi
je 0x401da7
cmp word [edi - 2], ax
je 0x401da7
mov eax, esi
sub edi, 2
dec esi
test eax, eax
jne 0x401cf0
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x32
push 0x402
push dword [0x440974]
call ebx
lea eax, [ebp - 0x210]
push eax
push str.SystemCurrentControlSetServicesGIDv2
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x401e41
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.SystemCurrentControlSetServicesGIDv2Security
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SystemCurrentControlSetServicesGIDv2Enum
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SystemCurrentControlSetServicesGIDv2
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x401e41
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416230
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x20c]
lea edx, [edx + esi*2]
test edx, edx
je 0x401d1e
mov ecx, edx
lea eax, [ebp - 0x20c]
sub ecx, eax
mov eax, dword [ebp - 0x214]
sar ecx, 1
sub eax, ecx
sub eax, 0xc
push eax
lea eax, [edx + 0xc]
push eax
push 0x104
push edx
call fcn.00416a6c
mov eax, dword [ebp - 0x214]
add esp, 0x10
sub eax, 0xc
mov dword [ebp - 0x214], eax
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x218]
push 0
push str.UpperFilters
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x401d1e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416230
mov esp, ebp
pop ebp
ret
push 0
push 0x46
push 0x402
push dword [0x440974]
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Wow64DisableWow64FsRedirection
push str.kernel32
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401e78
lea ecx, [ebp - 0x21c]
push ecx
call eax
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
push 0x440f90
push 0x440d88
call esi
test eax, eax
je 0x401e9b
push 4
push 0
push 0x440f90
call esi
mov esi, dword [ebp - 0x21c]
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401ebb
push esi
call eax
push 0
push 0x64
push 0x402
push dword [0x440974]
call ebx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416230
mov esp, ebp
pop ebp
ret