Function at 0x403770
Capabilities:
Persist via windows service
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8ec
mov eax, dword [0x43b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x8d4], 0
push edi
push str.SYSTEMCurrentControlSetServices
xor eax, eax
mov dword [ebp - 0x8dc], 0
push 0x80000002
mov dword [ebp - 0x8cc], 0
mov dword [ebp - 0x898], 0xea502723
mov dword [ebp - 0x894], 0x11d1a23d
mov dword [ebp - 0x890], 0xd3a7
mov dword [ebp - 0x88c], 0xe37175f8
mov dword [ebp - 0x8a8], 0xea502722
mov dword [ebp - 0x8a4], 0x11d1a23d
mov dword [ebp - 0x8a0], 0xd3a7
mov dword [ebp - 0x89c], 0xe37175f8
mov dword [ebp - 0x8c8], 0x35378eac
mov dword [ebp - 0x8c4], 0x11d2683f
mov dword [ebp - 0x8c0], 0xc0009aa8
mov dword [ebp - 0x8bc], 0xa2cfbb4f
mov dword [ebp - 0x8b8], 0x3d271cfc
mov dword [ebp - 0x8b4], 0x4ac22bc6
mov dword [ebp - 0x8b0], 0xdf3b33b6
mov dword [ebp - 0x8ac], 0x2aabbdf5
mov dword [ebp - 0x8ec], 0
mov dword [ebp - 0x8e8], eax
call fcn.00413e50
mov esi, eax
test esi, esi
je 0x403cf6
push edi
push str.K7PSSrvc
push esi
call fcn.00413e50
test eax, eax
je 0x40388e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 1
test edi, edi
je 0x403cf6
cmp dword [0x43c4f4], 3
je 0x403cf6
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
je 0x4038ba
cmp eax, 1
jne 0x403cf6
lea eax, [ebp - 0x8d4]
mov dword [ebp - 0x8ec], 1
push eax
lea eax, [ebp - 0x898]
push eax
push 1
push 0
lea eax, [ebp - 0x8a8]
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x403cf6
mov edx, dword [ebp - 0x8d4]
test edx, edx
je 0x403cfc
mov eax, dword [edx]
push 1
push edx
call dword [eax + 0x14]
test eax, eax
jne 0x403cf6
mov eax, dword [ebp - 0x8d4]
lea edx, [ebp - 0x8dc]
push edx
push 2
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
jne 0x403cf6
push eax
lea eax, [ebp - 0x8cc]
mov dword [ebp - 0x8d8], 3
push eax
push 0
push 3
push 0
push 0
push 0
push str.SoftwarePoliciesGoogleChromeExtensionInstallForcelist
push dword [ebp - 0x8dc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x403cf6
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, dword [sym.imp.USER32.dll_CharLowerW]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x8d0]
mov dword [ebp - 0x8d0], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x8cc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [ebp - 0x8d0]
xor esi, esi
test eax, eax
je 0x403a25
nop dword [eax + eax]
lea eax, [ebp - 0x8e0]
mov dword [ebp - 0x8e0], 0x800
push eax
lea eax, [ebp - 0x888]
mov dword [ebp - 0x8e4], 0x40
push eax
push 0
push 0
lea eax, [ebp - 0x8e4]
push eax
lea eax, [ebp - 0x88]
push eax
push esi
push dword [ebp - 0x8cc]
call edi
test eax, eax
jne 0x403a12
lea eax, [ebp - 0x888]
push eax
call ebx
lea eax, [ebp - 0x888]
push 0x4366e8
push eax
call fcn.00416777
add esp, 8
test eax, eax
jne 0x403a1f
mov eax, dword [ebp - 0x8d0]
inc esi
cmp esi, eax
jb 0x4039b0
jmp 0x403a25
mov eax, dword [ebp - 0x8d0]
cmp esi, eax
jne 0x403aab
inc eax
push eax
lea eax, [ebp - 0x88]
push 0x43672c
push eax
call fcn.00402210
mov ecx, 0x28
lea edi, [ebp - 0x888]
mov esi, str.dlpfamleaodfgmfnggonbfljhjggbdbe_http:__localhost:7080_k7sr_scripts_k7chrome.xml
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x888]
lea edx, [ecx + 2]
movsw word es:[edi], word [esi]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403a60
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
mov dword [ebp - 0x8d0], eax
lea eax, [ebp - 0x888]
push eax
push 1
push 0
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x8cc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x8e8], 1
push dword [ebp - 0x8cc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea eax, [ebp - 0x8cc]
mov dword [ebp - 0x8cc], 0
push eax
push 0
push dword [ebp - 0x8d8]
push 0
push 0
push 0
push str.SoftwarePoliciesGoogleChromeExtensionInstallWhitelist
push dword [ebp - 0x8dc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x403cf6
push eax
push eax
push eax
push eax
mov dword [ebp - 0x8d0], eax
lea eax, [ebp - 0x8d0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x8cc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [ebp - 0x8d0]
xor esi, esi
test eax, eax
je 0x403ba5
nop word [eax + eax]
lea eax, [ebp - 0x8e0]
mov dword [ebp - 0x8e0], 0x800
push eax
lea eax, [ebp - 0x888]
mov dword [ebp - 0x8e4], 0x40
push eax
push 0
push 0
lea eax, [ebp - 0x8e4]
push eax
lea eax, [ebp - 0x88]
push eax
push esi
push dword [ebp - 0x8cc]
call edi
test eax, eax
jne 0x403b92
lea eax, [ebp - 0x888]
push eax
call ebx
lea eax, [ebp - 0x888]
push 0x4366e8
push eax
call fcn.00416777
add esp, 8
test eax, eax
jne 0x403b9f
mov eax, dword [ebp - 0x8d0]
inc esi
cmp esi, eax
jb 0x403b30
jmp 0x403ba5
mov eax, dword [ebp - 0x8d0]
cmp esi, eax
jne 0x403c56
inc eax
push eax
lea eax, [ebp - 0x88]
push 0x43672c
push eax
call fcn.00402210
movups xmm0, xmmword [0x4366e8]
mov ax, word [0x436728]
lea ecx, [ebp - 0x888]
add esp, 0xc
mov word [ebp - 0x848], ax
movups xmmword [ebp - 0x888], xmm0
lea edx, [ecx + 2]
movups xmm0, xmmword [0x4366f8]
movups xmmword [ebp - 0x878], xmm0
movups xmm0, xmmword [0x436708]
movups xmmword [ebp - 0x868], xmm0
movups xmm0, xmmword [0x436718]
movups xmmword [ebp - 0x858], xmm0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403c11
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
mov dword [ebp - 0x8d0], eax
lea eax, [ebp - 0x888]
push eax
push 1
push 0
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x8cc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x8e8], 1
push dword [ebp - 0x8cc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x8d8], 3
mov dword [ebp - 0x8cc], 0
jne 0x403d41
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x8d8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x403cb0
lea eax, [ebp - 0x8d8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x8d8], 0
je 0x403d41
push 0
lea eax, [ebp - 0x8cc]
mov dword [ebp - 0x8d8], 0x103
push eax
push 0
push 0x103
push 0
push 0
push 0
push str.SoftwarePoliciesGoogleChromeExtensionInstallForcelist
push dword [ebp - 0x8dc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x403967
mov edx, dword [ebp - 0x8d4]
xor ebx, ebx
mov eax, dword [ebp - 0x8dc]
test eax, eax
je 0x403d15
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x8d4]
test edx, edx
je 0x403d1f
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
cmp dword [ebp - 0x8ec], 0
je 0x403d2e
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041559f
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x8e8], 0
je 0x403cf6
mov eax, dword [ebp - 0x8d4]
lea edx, [ebp - 0x8b8]
push edx
lea edx, [ebp - 0x8c8]
push edx
mov ecx, dword [eax]
push 1
push 1
push eax
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x8d4]
xor ebx, ebx
test eax, eax
mov ecx, 1
cmove ebx, ecx
jmp 0x403cfe