Function at 0x401fb0
Capabilities:
Delete file
Delete registry key
Delete registry value
Get common file path
Persist via windows service
Query or enumerate registry value
Set current directory
Set file attributes
Set registry value

Disassembly:
sub esp, 0x210
push ebx
push edi
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x18], bl
mov ecx, 0x7f
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp byte [esp + 0x21c], bl
jne 0x401feb
call fcn.00401ef0
cmp eax, 0xf0
jge 0x401feb
test al, 0x48
jne case.default.0x402006
call fcn.00401930
movzx eax, ax
dec eax
cmp eax, 0xa
ja case.default.0x402006
movzx eax, byte [eax + 0x402618]
push ebp
push esi
jmp dword [eax*4 + 0x40260c]
push 0x104
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + 0x20]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x402022
mov edx, dword [str.iosubsys]
mov eax, dword [0x40b6f4]
mov cx, word [0x40b6f8]
mov dword [edi], edx
lea edx, [esp + 0x20]
mov dword [edi + 4], eax
push edx
mov word [edi + 8], cx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x20
push str.hdsafer.vxd
call esi
push 0x20
push str.hdmcvsd.vxd
call esi
push str.hdmcvsd.vxd
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x210
ret
push 0x104
lea eax, [esp + 0x24]
push eax
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + 0x20]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x402098
mov ecx, dword [str.drivers]
mov edx, dword [0x40b6d0]
mov al, byte [0x40b6d4]
mov dword [edi], ecx
lea ecx, [esp + 0x20]
mov dword [edi + 4], edx
push ecx
mov byte [edi + 8], al
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x20
push str.DiskPwr.SYS
call esi
push 0x20
push str.DiskPws.SYS
call esi
push str.DiskPws.SYS
jmp 0x402149
push 0x104
lea edx, [esp + 0x24]
push edx
mov ebp, 2
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + 0x20]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x402100
mov eax, dword [str.drivers]
mov ecx, dword [0x40b6d0]
mov dl, byte [0x40b6d4]
mov dword [edi], eax
lea eax, [esp + 0x20]
mov dword [edi + 4], ecx
push eax
mov byte [edi + 8], dl
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x20
push str.DiskPwr.SYS
call esi
push 0x20
push str.DiskPws.SYS
call esi
push str.DiskPwr.SYS
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetServicesNetlogonParameters
push 0x80000002
mov dword [esp + 0x24], ebx
call edi
test eax, eax
jne 0x40219d
mov eax, dword [esp + 0x10]
push 4
lea edx, [esp + 0x1c]
push edx
push 4
push ebx
push str.DisablePasswordChange
push eax
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
push edx
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetServices
push 0x80000002
call edi
test eax, eax
jne 0x402228
lea eax, [esp + 0x18]
push eax
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetServicesDiskPwr
push 0x80000002
mov dword [esp + 0x2c], ebx
call edi
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jne 0x4021e9
mov ecx, dword [esp + 0x18]
push str.Enum
push ecx
call esi
lea edx, [esp + 0x18]
push edx
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetServicesDiskPws
push 0x80000002
call edi
test eax, eax
jne 0x402210
mov eax, dword [esp + 0x18]
push str.Enum
push eax
call esi
mov ecx, dword [esp + 0x10]
push str.DiskPwr
push ecx
call esi
mov edx, dword [esp + 0x10]
push str.DiskPws
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp bp, 2
jne 0x402601
push ebx
call fcn.004017b0
add esp, 4
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E967_E325_11CE_BFC1_08002BE10318
push 0x80000002
call edi
test eax, eax
jne 0x402387
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
push ecx
push ebx
push str.UpperFilters
push edx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402376
lea esi, [esp + 0x20]
mov dword [esp + 0x14], ebx
lea ecx, [ecx]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4022a5
sub eax, edx
push str.DiskPws
push esi
lea edi, [eax + esi + 1]
call fcn.00404fe0
add esp, 8
test eax, eax
je 0x4022f7
push pe_nt_image_headers32
push edi
push esi
call fcn.00404eb0
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4022d8
sub eax, edx
push str.DiskPws
push esi
lea edi, [esi + eax + 1]
call fcn.00404fe0
add esp, 8
test eax, eax
jne 0x4022c4
mov edx, dword [esp + 0x14]
cmp edx, ebx
je 0x402318
mov eax, esi
lea ebp, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402304
sub eax, ebp
mov dword [esp + 0x1c], eax
je 0x402318
inc edx
mov dword [esp + 0x14], edx
lea ecx, [esi + 1]
jmp 0x402320
mov al, byte [esi]
inc esi
cmp al, bl
jne 0x402320
sub esi, ecx
add edx, esi
mov dword [esp + 0x14], edx
cmp byte [edi], bl
je 0x40233a
mov esi, edi
jmp 0x4022a0
cmp edx, ebx
je 0x402366
mov ecx, dword [esp + 0x18]
inc edx
mov dword [esp + 0x14], edx
mov byte [esp + edx + 0x20], bl
inc edx
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
push ecx
push ebx
push str.UpperFilters
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x402376
mov eax, dword [esp + 0x10]
push str.UpperFilters
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x10]
push edx
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E96A_E325_11CE_BFC1_08002BE10318
push 0x80000002
call edi
test eax, eax
jne 0x4024c7
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
push ebx
push str.UpperFilters
push eax
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4024b6
lea esi, [esp + 0x20]
mov dword [esp + 0x14], ebx
mov edi, edi
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4023e5
sub eax, edx
push str.DiskPws
push esi
lea edi, [eax + esi + 1]
call fcn.00404fe0
add esp, 8
test eax, eax
je 0x402437
push pe_nt_image_headers32
push edi
push esi
call fcn.00404eb0
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402418
sub eax, edx
push str.DiskPws
push esi
lea edi, [esi + eax + 1]
call fcn.00404fe0
add esp, 8
test eax, eax
jne 0x402404
mov edx, dword [esp + 0x14]
cmp edx, ebx
je 0x402458
mov eax, esi
lea ebp, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402444
sub eax, ebp
mov dword [esp + 0x1c], eax
je 0x402458
inc edx
mov dword [esp + 0x14], edx
lea ecx, [esi + 1]
jmp 0x402460
mov al, byte [esi]
inc esi
cmp al, bl
jne 0x402460
sub esi, ecx
add edx, esi
mov dword [esp + 0x14], edx
cmp byte [edi], bl
je 0x40247a
mov esi, edi
jmp 0x4023e0
cmp edx, ebx
je 0x4024a6
mov eax, dword [esp + 0x10]
inc edx
mov dword [esp + 0x14], edx
mov byte [esp + edx + 0x20], bl
inc edx
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push ecx
push edx
push ebx
push str.UpperFilters
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4024b6
mov ecx, dword [esp + 0x10]
push str.UpperFilters
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E97B_E325_11CE_BFC1_08002BE10318
push 0x80000002
call edi
test eax, eax
jne 0x402601
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x20]
push eax
push ebx
push str.UpperFilters
push ecx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4025f6
lea esi, [esp + 0x20]
mov dword [esp + 0x14], ebx
mov edi, edi
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402525
sub eax, edx
push str.DiskPws
push esi
lea edi, [eax + esi + 1]
call fcn.00404fe0
add esp, 8
test eax, eax
je 0x402577
push pe_nt_image_headers32
push edi
push esi
call fcn.00404eb0
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402558
sub eax, edx
push str.DiskPws
push esi
lea edi, [esi + eax + 1]
call fcn.00404fe0
add esp, 8
test eax, eax
jne 0x402544
mov edx, dword [esp + 0x14]
cmp edx, ebx
je 0x402598
mov eax, esi
lea ebp, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402584
sub eax, ebp
mov dword [esp + 0x1c], eax
je 0x402598
inc edx
mov dword [esp + 0x14], edx
lea ecx, [esi + 1]
jmp 0x4025a0
mov al, byte [esi]
inc esi
cmp al, bl
jne 0x4025a0
sub esi, ecx
add edx, esi
mov dword [esp + 0x14], edx
cmp byte [edi], bl
je 0x4025ba
mov esi, edi
jmp 0x402520
cmp edx, ebx
je 0x4025e6
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
inc edx
mov dword [esp + 0x14], edx
mov byte [esp + edx + 0x20], bl
inc edx
push edx
lea edx, [esp + 0x24]
push edx
push eax
push ebx
push str.UpperFilters
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4025f6
mov edx, dword [esp + 0x10]
push str.UpperFilters
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x210
ret