Function at 0x408cf0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x59c
mov ecx, dword [esp + 0x5a4]
mov edx, dword [esp + 0x5a0]
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 0xf003f
push 0
mov esi, 0x378
push ecx
push edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x408d41
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x59c
ret
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x30]
push eax
push ecx
push 0
push 0
push str.PackedCatalogItem
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40917a
cmp dword [esp + 0x14], esi
jne 0x40917a
mov eax, dword [esp + 0x15c]
mov ebp, 1
cmp eax, ebp
jne 0x408f15
cmp dword [esp + 0x180], 2
jne 0x408f15
mov eax, dword [esp + 0x158]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea ecx, [esp + 0x1c]
push 0x41e804
push ecx
call esi
mov edx, dword [esp + 0x163]
mov eax, dword [esp + 0x162]
mov ecx, dword [esp + 0x161]
add esp, 0xc
and edx, 0xff
and eax, 0xff
push edx
mov edx, dword [esp + 0x158]
push eax
mov eax, dword [esp + 0x15b]
and ecx, 0xff
and edx, 0xff
push ecx
mov ecx, dword [esp + 0x15e]
and eax, 0xff
push edx
mov edx, dword [esp + 0x161]
push eax
mov eax, dword [esp + 0x164]
and ecx, 0xff
and edx, 0xff
push ecx
and eax, 0xff
push edx
push eax
lea ecx, [esp + 0x3c8]
push str._02X_02X__02X_02X_02X_02X_02X_02X
push ecx
xor edi, edi
call esi
mov eax, dword [esp + 0x1b8]
add esp, 0x28
cmp eax, 0x11
je 0x408e48
cmp eax, 6
je 0x408e48
test eax, eax
je 0x408e48
mov edi, ebp
cmp dword [0x429504], ebp
jne 0x408f2d
test edi, edi
jne 0x408f15
mov esi, str.BD88_0000C082E69A
lea eax, [esp + 0x3a8]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x408e90
test cl, cl
je 0x408e8c
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x408e90
add eax, 2
add esi, 2
test cl, cl
jne 0x408e68
xor eax, eax
jmp 0x408e95
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x408ed5
mov esi, 0x4232c8
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x408eca
test cl, cl
je 0x408ec6
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x408eca
add eax, 2
add esi, 2
test cl, cl
jne 0x408ea2
xor eax, eax
jmp 0x408ecf
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x408f15
jmp 0x408f0f
mov esi, 0x4233e0
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x408f06
test cl, cl
je 0x408f02
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x408f06
add eax, 2
add esi, 2
test cl, cl
jne 0x408ede
xor eax, eax
jmp 0x408f0b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x408f15
mov dword [0x429508], ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x59c
ret
mov al, byte [esp + 0x5b8]
test al, al
jne 0x40909f
cmp edi, ebp
je 0x408f15
mov esi, str.BD88_0000C082E69A
lea eax, [esp + 0x3a8]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x408f74
test cl, cl
je 0x408f70
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x408f74
add eax, 2
add esi, 2
test cl, cl
jne 0x408f4c
xor eax, eax
jmp 0x408f79
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x408f8c
mov edi, 0x4234f8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x408f15
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
push ebp
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2DrcomPacketCapture
dec ecx
push reloc.OLEAUT32.dll_SysReAllocString
push ecx
lea eax, [esp + 0x40]
lea ecx, [esp + 0x28]
push eax
push ecx
call fcn.00408c70
add esp, 0x18
test eax, eax
jne 0x408fd7
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffa
pop ebx
add esp, 0x59c
ret
mov edi, 0x423610
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x3a8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, str.BD88_0000C082E69A
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x409031
test cl, cl
je 0x40902d
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x409031
add eax, 2
add esi, 2
test cl, cl
jne 0x409009
xor eax, eax
jmp 0x409036
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40905e
mov edi, 0x4234f8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x30]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x30]
push ecx
push edx
push 3
push 0
push str.PackedCatalogItem
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x408f15
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 0xfffffff9
pop ebx
add esp, 0x59c
ret
push ebp
push str.SYSTEMCurrentControlSetServicesWinSock2DrcomPacketCapture
push reloc.OLEAUT32.dll_SysReAllocString
lea edx, [esp + 0x4b4]
push 0x104
lea eax, [esp + 0x28]
push edx
push eax
call fcn.00408c00
add esp, 0x18
test al, al
jne 0x4090e0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x59c
ret
lea edi, [esp + 0x4a8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [esp + 0x30], 0x25
je 0x409139
push 0
push 0
push 3
push 0
push 3
lea ecx, [esp + 0x44]
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
je 0x408f15
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x30]
push edx
push eax
push 3
push 0
push str.PackedCatalogItem
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x408f15
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 0xfffffff9
pop ebx
add esp, 0x59c
ret
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffb
pop ebx
add esp, 0x59c
ret