Function at 0x128da
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x61278]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor edi, edi
push 0x1fe
mov word [ebp - 0x40c], ax
lea eax, [ebp - 0x40a]
push edi
push eax
mov dword [ebp - 0x410], edi
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x444], edi
call sub.ntoskrnl.exe_memset
push 0x87c50
lea eax, [ebp - 0x40c]
push 0x156ce
push eax
call dword [sym.imp.ntoskrnl.exe_swprintf]
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
add esp, 0x18
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x440]
push eax
call esi
push 0x156c2
lea eax, [ebp - 0x418]
push eax
call esi
lea eax, [ebp - 0x440]
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x434]
push eax
mov ebx, 0xf003f
push ebx
lea eax, [ebp - 0x410]
push eax
mov dword [ebp - 0x434], 0x18
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x428], 0x40
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x420], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jge 0x129f1
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
push eax
push ebx
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, edi
jge 0x129f1
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
push eax
push ebx
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, edi
jl 0x130f3
mov ebx, dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
push 4
lea eax, [ebp - 0x41c]
push eax
push 4
push edi
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x410]
call ebx
push 0x156a2
lea eax, [ebp - 0x418]
push eax
call esi
mov eax, 0x15694
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x12a28
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push 0x15686
push 7
push edi
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x410]
call ebx
push 0x1566e
lea eax, [ebp - 0x418]
push eax
call esi
mov ecx, 0x87c50
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x438], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x12a70
sub eax, dword [ebp - 0x438]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x410]
call ebx
push 0x15662
lea eax, [ebp - 0x418]
push eax
call esi
mov ecx, 0x1562e
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x438], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x12ab8
sub eax, dword [ebp - 0x438]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x410]
call ebx
push 0x15614
lea eax, [ebp - 0x418]
push eax
call esi
push 4
lea eax, [ebp - 0x444]
push eax
push 4
push edi
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x410]
call ebx
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x87c50
push 0x25
call fcn.000141ac
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.ntoskrnl.exe_swprintf]
add esp, 0xc
push 0x15600
lea eax, [ebp - 0x418]
push eax
call esi
lea eax, [ebp - 0x20c]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x12b5d
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 2
push edi
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x410]
call ebx
push 0x155f6
lea eax, [ebp - 0x418]
push eax
mov dword [ebp - 0x41c], 2
call esi
push 4
lea eax, [ebp - 0x41c]
push eax
push 4
push edi
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x410]
call ebx
push dword [ebp - 0x410]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0x87c50
lea eax, [ebp - 0x40c]
push 0x1557e
push eax
call dword [sym.imp.ntoskrnl.exe_swprintf]
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x440]
push eax
call esi
lea eax, [ebp - 0x440]
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x434]
push eax
push 0xf003f
lea eax, [ebp - 0x410]
push eax
mov dword [ebp - 0x434], 0x18
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x428], 0x40
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x420], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jge 0x12c87
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
push eax
push 0xf003f
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, edi
jge 0x12c87
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
push eax
push 0xf003f
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, edi
jl 0x130f3
xor eax, eax
push 0x1fe
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push edi
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x1557a
lea eax, [ebp - 0x418]
push eax
call esi
push 0x87c50
lea eax, [ebp - 0x204]
push 0x15552
push eax
call dword [sym.imp.ntoskrnl.exe_swprintf]
lea eax, [ebp - 0x204]
add esp, 0xc
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x12cd6
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push edi
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x410]
call ebx
push 0x15546
lea eax, [ebp - 0x418]
push eax
mov dword [ebp - 0x41c], 1
call esi
push 4
lea eax, [ebp - 0x41c]
push eax
push 4
push edi
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x410]
call ebx
push 0x1552c
lea eax, [ebp - 0x418]
push eax
mov dword [ebp - 0x41c], 1
call esi
push 4
lea eax, [ebp - 0x41c]
push eax
push 4
push edi
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x410]
call ebx
push dword [ebp - 0x410]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0x87c50
lea eax, [ebp - 0x40c]
push 0x154ac
push eax
call dword [sym.imp.ntoskrnl.exe_swprintf]
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x440]
push eax
call esi
lea eax, [ebp - 0x440]
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x434]
push eax
push 0xf003f
lea eax, [ebp - 0x410]
push eax
mov dword [ebp - 0x434], 0x18
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x428], 0x40
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x420], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jge 0x12e33
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
push eax
push 0xf003f
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, edi
jge 0x12e33
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
push eax
push 0xf003f
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, edi
jl 0x130f3
push dword [ebp - 0x410]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0x87c50
lea eax, [ebp - 0x40c]
push 0x1542a
push eax
call dword [sym.imp.ntoskrnl.exe_swprintf]
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x440]
push eax
call esi
lea eax, [ebp - 0x440]
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x434]
push eax
push 0xf003f
lea eax, [ebp - 0x410]
push eax
mov dword [ebp - 0x434], 0x18
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x428], 0x40
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x420], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jge 0x12efe
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
push eax
push 0xf003f
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, edi
jge 0x12efe
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
push eax
push 0xf003f
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, edi
jl 0x130f3
xor eax, eax
push 0x1fe
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push edi
push eax
call sub.ntoskrnl.exe_memset
push 0x87c50
lea eax, [ebp - 0x204]
push 0x15412
push eax
call dword [sym.imp.ntoskrnl.exe_swprintf]
add esp, 0x18
push 0x153f2
lea eax, [ebp - 0x418]
push eax
call esi
lea eax, [ebp - 0x204]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x12f4a
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push edi
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x410]
call ebx
push dword [ebp - 0x410]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
push 0x1fe
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push edi
push eax
call sub.ntoskrnl.exe_memset
push 0x87c50
lea eax, [ebp - 0x204]
push 0x15412
push eax
call dword [sym.imp.ntoskrnl.exe_swprintf]
lea eax, [ebp - 0x204]
push eax
push 0x87c50
lea eax, [ebp - 0x40c]
push 0x1536a
push eax
call dword [sym.imp.ntoskrnl.exe_swprintf]
add esp, 0x28
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x440]
push eax
call esi
lea eax, [ebp - 0x440]
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x434]
push eax
push 0xf003f
lea eax, [ebp - 0x410]
push eax
mov dword [ebp - 0x434], 0x18
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x428], 0x40
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x420], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jge 0x13076
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
push eax
push 0xf003f
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, edi
jge 0x13076
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
push eax
push 0xf003f
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, edi
jl 0x130f3
push 0x15358
lea eax, [ebp - 0x418]
push eax
call esi
mov ecx, 0x1534a
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x438], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x13094
sub eax, dword [ebp - 0x438]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x410]
call ebx
push 0x1533e
lea eax, [ebp - 0x418]
push eax
call esi
push 4
lea eax, [ebp - 0x444]
push eax
push 4
push edi
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x410]
call ebx
push dword [ebp - 0x410]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0001512b
leave
ret