Function at 0x409630
Capabilities:
Persist via run registry key
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54c
mov eax, dword [str._q_]
xor eax, ebp
mov dword [esp + 0x548], eax
push ebx
mov edx, ecx
xor ebx, ebx
xor eax, eax
push esi
push edi
mov byte [esp + 0x138], bl
mov ecx, 0x40
lea edi, [esp + 0x139]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x240], bl
mov ecx, 0x40
lea edi, [esp + 0x241]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [edx]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
cmp dword [eax + 0x40], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
je 0x4097fe
cmp dword [eax + 8], ebx
je 0x4097fe
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
push str.SystemCurrentControlSetServicesVxDKaseya
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4097fe
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x13c]
push edx
push ebx
push ebx
push 0x41c584
mov edi, 0x104
push eax
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4097c3
cmp byte [esp + 0x138], bl
je 0x4097c3
push ebx
lea ecx, [esp + 0x20]
push ecx
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SOFTWAREKaseyaAgent
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4097c3
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
mov edx, dword [eax + 0x1c]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x409742
mov ecx, dword [esp + 0x1c]
sub eax, esi
inc eax
push eax
push edx
push 1
push ebx
push str.KES_Owned_By
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40976d
mov dword [esp + 0x24], 1
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x24], ebx
je 0x4097c3
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x244]
push ecx
push ebx
push ebx
push str.avServiceConfigFile
push edx
mov dword [esp + 0x30], edi
call esi
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push ecx
push ebx
push ebx
push str.AVServiceEnabled
push edx
mov dword [esp + 0x30], 4
call esi
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebx
push ebx
push str.EnableRemoteControl
push edx
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4097f3
mov dword [esp + 0x20], 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x14]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x1c]
push edx
push str.SOFTWAREKaseyaAgent
lea eax, [esp + 0x38]
push str._s_s
push eax
call fcn.0040f6f9
add esp, 0x10
push ebx
lea ecx, [esp + 0x14]
push ecx
push ebx
push 0x20006
push ebx
push ebx
push ebx
lea edx, [esp + 0x4c]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
cmp esi, ebx
jne 0x409d68
mov eax, dword [edi]
mov ecx, dword [eax + 0x44]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x409852
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, esi
inc eax
push eax
push ecx
mov ecx, dword [esp + 0x18]
push 1
push ebx
push str.Title
push ecx
call edi
mov esi, eax
cmp esi, ebx
jne 0x409bcf
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
mov eax, ecx
lea esi, [eax + 1]
jmp 0x409890
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x409890
sub eax, esi
inc eax
push eax
push ecx
mov ecx, dword [esp + 0x18]
push 1
push ebx
push str.Path
push ecx
call edi
mov esi, eax
cmp esi, ebx
jne 0x409bcf
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
mov ecx, dword [eax + 0x20]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4098c3
sub eax, esi
inc eax
push eax
push ecx
mov ecx, dword [esp + 0x18]
push 1
push ebx
push str.Provider
push ecx
call edi
mov esi, eax
cmp esi, ebx
jne 0x409bcf
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
push str.KasAgent.log
push ecx
lea edx, [esp + 0x38]
push str._s_s
push edx
call fcn.0040f6f9
lea eax, [esp + 0x40]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x409910
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x34]
push eax
push 1
push ebx
push 0x41c524
push ecx
call edi
mov esi, eax
cmp esi, ebx
jne 0x409bcf
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
push str.KaseyaD.ini
push ecx
lea edx, [esp + 0x38]
push str._s_s
push edx
call fcn.0040f6f9
lea eax, [esp + 0x40]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x409961
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x34]
push eax
push 1
push ebx
push str.ConfigurationFile
push ecx
call edi
mov esi, eax
cmp esi, ebx
jne 0x409bcf
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
push str.KasError.log
push ecx
lea edx, [esp + 0x38]
push str._s_s
push edx
call fcn.0040f6f9
lea eax, [esp + 0x40]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4099b2
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x34]
push eax
push 1
push ebx
push 0x41c500
push ecx
call edi
mov esi, eax
cmp esi, ebx
jne 0x409bcf
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
push str.KasFirewall.log
push ecx
lea edx, [esp + 0x38]
push str._s_s
push edx
call fcn.0040f6f9
lea eax, [esp + 0x40]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x409a03
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x34]
push eax
push 1
push ebx
push 0x41c4f0
push ecx
call edi
mov esi, eax
cmp esi, ebx
jne 0x409bcf
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
push str.KaseyaFW.ini
push ecx
lea edx, [esp + 0x38]
push str._s_s
push edx
call fcn.0040f6f9
lea eax, [esp + 0x40]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x409a54
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x34]
push eax
push 1
push ebx
push str.FirewallSettingsFile
push ecx
call edi
mov esi, eax
cmp esi, ebx
jne 0x409bcf
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
push str.KasStats.log
push ecx
lea edx, [esp + 0x38]
push str._s_s
push edx
call fcn.0040f6f9
lea eax, [esp + 0x40]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x409aa5
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x34]
push eax
push 1
push ebx
push 0x41c4c8
push ecx
call edi
mov esi, eax
cmp esi, ebx
jne 0x409bcf
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
mov ecx, dword [eax + 0x3c]
cmp ecx, ebx
je 0x409b09
cmp byte [ecx], bl
je 0x409b09
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x409ae4
sub eax, esi
inc eax
push eax
push ecx
mov ecx, dword [esp + 0x18]
push 1
push ebx
push str.PartitionId
push ecx
call edi
mov esi, eax
cmp esi, ebx
jne 0x409bcf
cmp dword [esp + 0x24], ebx
je 0x409b88
lea eax, [esp + 0x138]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x409b20
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x13c]
push edx
push 1
push ebx
push 0x41c584
push eax
call edi
lea eax, [esp + 0x240]
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x409b50
mov edx, dword [esp + 0x10]
sub eax, ecx
inc eax
push eax
lea ecx, [esp + 0x244]
push ecx
push 1
push ebx
push str.avServiceConfigFile
push edx
call edi
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x2c]
push eax
push 1
push ebx
push str.AVServiceEnabled
push ecx
call edi
cmp dword [esp + 0x20], ebx
je 0x409ba4
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x30]
push edx
push 4
push ebx
push str.EnableRemoteControl
push eax
call edi
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [edx + 0x40]
mov edx, dword [esp + 0x10]
xor eax, eax
push 4
cmp ecx, ebx
lea ecx, [esp + 0x20]
push ecx
setne al
push 4
push ebx
push str.NewAgent
push edx
inc eax
mov dword [esp + 0x34], eax
call edi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x409d68
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
cmp dword [edx + 0x54], ebx
jne 0x409d68
push ebx
lea eax, [esp + 0x14]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
cmp esi, ebx
jne 0x409d68
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
cmp dword [eax + 0x40], ebx
je 0x409cd0
cmp dword [eax + 8], ebx
je 0x409c46
mov ecx, 7
mov esi, str.Kaseya_Agent_Service_Helper
lea edi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x409c5c
mov edx, dword [eax + 0x1c]
push edx
lea eax, [esp + 0x34]
push str.KASH_s
push eax
call fcn.0040f6f9
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34c]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x24]
push eax
push ebx
lea ecx, [esp + 0x40]
push ecx
push edx
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409cd0
lea eax, [esp + 0x348]
push str.KaUsrTsk.exe
push eax
call fcn.00410061
add esp, 8
cmp eax, ebx
je 0x409cd0
mov cl, byte [eax + 0xc]
add eax, 0xc
cmp cl, bl
je 0x409cd0
cmp cl, 0x20
je 0x409d94
cmp cl, 9
je 0x409d94
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x409cb6
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
push str.KaUsrTsk.exe
push ecx
lea edx, [esp + 0x350]
push str.__s_s_
push edx
call fcn.0040f6f9
add esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push edx
lea eax, [esp + 0x34]
push str.KASH_s
push eax
call fcn.0040f6f9
lea eax, [esp + 0x354]
add esp, 0xc
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x409d20
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x34c]
push ecx
push 1
push ebx
lea edx, [esp + 0x40]
push edx
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x409d5d
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push esi
push str.Failed_to_create_the_link_for_Agent_Service_Helper._Code:__d.
push edx
call fcn.00404120
add esp, 0xc
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push esi
push str.Create_registry_function_returns__d.
push edx
call fcn.00404120
mov ecx, dword [esp + 0x560]
add esp, 0xc
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f175
mov esp, ebp
pop ebp
ret
mov cl, byte [eax]
cmp cl, bl
je 0x409cd0
mov edi, edi
cmp cl, 0x20
je 0x409daa
cmp cl, 9
jne 0x409db7
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x409da0
jmp 0x409cd0
cmp byte [eax], bl
je 0x409cd0
push eax
call fcn.00410113
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x409cd0
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
push esi
push str.KaUsrTsk.exe
push eax
lea ecx, [esp + 0x354]
push str.__s_s___s
push ecx
call fcn.0040f6f9
push esi
call fcn.0040f5cf
add esp, 0x18
jmp 0x409cf4