Function at 0x402230
Capabilities:
Create service
Disable system features via registry on windows
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40bbf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c4
push ebx
push esi
push edi
lea eax, [ebp - 0x1d]
mov dword [ebp - 0x10], esp
push eax
lea ecx, [ebp - 0x50]
call fcn.00402fb0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 0x30]
call fcn.00402fb0
lea edx, [ebp - 0x1a]
lea ecx, [ebp - 0x64]
push edx
mov byte [ebp - 4], 1
call fcn.00402fb0
lea eax, [ebp - 0x1b]
lea ecx, [ebp - 0x40]
push eax
mov byte [ebp - 4], 2
call fcn.00402fb0
lea ecx, [ebp - 0x19]
mov byte [ebp - 4], 3
push ecx
lea ecx, [ebp - 0x78]
call fcn.00402fb0
push str.MXBIN
mov byte [ebp - 4], 5
call fcn.0040525e
mov esi, eax
add esp, 4
test esi, esi
jne 0x4022f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.MXBIN_environment_variable_undefined
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov ecx, 0x14
mov esi, eax
lea edi, [ebp - 0x500]
lea edx, [ebp - 0x500]
push 0x40cbb0
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.00404ff7
push esi
lea ecx, [ebp - 0x50]
call fcn.00402fe0
push 0x40f5b4
lea ecx, [ebp - 0x50]
call fcn.00403000
push str.FireDaemon
lea ecx, [ebp - 0x50]
call fcn.00403000
push str..EXE
lea ecx, [ebp - 0x50]
call fcn.00403000
mov edx, dword [ebp + 8]
test edx, edx
je 0x402c0e
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x402c0e
push edx
mov ecx, 0x4123c8
call fcn.00402fe0
push str.FireDaemon
lea ecx, [ebp - 0x78]
call fcn.00402fe0
push str._Service:
lea ecx, [ebp - 0x78]
call fcn.00403000
push 0x4123c8
lea ecx, [ebp - 0x78]
call fcn.00402ff0
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x402bdc
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x402bdc
lea eax, [ebp - 0xf0]
push eax
push edx
call fcn.0040abce
add esp, 8
test eax, eax
je 0x4023d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Invalid_Application_Directory_specified
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov ecx, 0x14
mov esi, eax
lea edi, [ebp - 0x7d0]
push 0x40cbb0
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x7d0]
push ecx
call fcn.00404ff7
mov eax, dword [ebp - 0xea]
test ah, 0x40
jne 0x402415
push 0
push str.Application_Directory_must_be_a_directory
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov ecx, 0x14
mov esi, eax
lea edi, [ebp - 0x1e0]
lea edx, [ebp - 0x1e0]
push 0x40cbb0
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.00404ff7
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x40245b
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40245b
push edx
lea ecx, [ebp - 0x30]
call fcn.00402fe0
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x402448
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40244d
mov edx, 0x4123dc
push edx
lea ecx, [ebp - 0x64]
call fcn.00402fe0
jmp 0x4024eb
push esi
lea ecx, [ebp - 0x30]
call fcn.00402fe0
push str._fire.exe
lea ecx, [ebp - 0x30]
call fcn.00403000
push str._root
lea ecx, [ebp - 0x64]
call fcn.00402fe0
push str.MXHOME
call fcn.0040525e
mov esi, eax
add esp, 4
test esi, esi
jne 0x4024c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.MXHOME_environment_variable_undefined
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov esi, eax
mov ecx, 0x14
lea edi, [ebp - 0x140]
lea eax, [ebp - 0x140]
push 0x40cbb0
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00404ff7
push 0x40f504
lea ecx, [ebp - 0x64]
call fcn.00403000
push esi
lea ecx, [ebp - 0x64]
call fcn.00403000
push 0x40f504
lea ecx, [ebp - 0x64]
call fcn.00403000
lea ecx, [ebp - 0x30]
call fcn.00403010
lea ecx, [ebp - 0xf0]
push ecx
push eax
call fcn.0040abce
add esp, 8
test eax, eax
je 0x40253e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Invalid_Application_binary_specified
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov ecx, 0x14
mov esi, eax
lea edi, [ebp - 0x280]
lea edx, [ebp - 0x280]
push 0x40cbb0
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.00404ff7
mov eax, dword [ebp - 0xea]
test ah, 0x80
jne 0x40257b
push 0
push str.Application_binary_must_be_a_regular_file
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov esi, eax
mov ecx, 0x14
lea edi, [ebp - 0x780]
lea eax, [ebp - 0x780]
push 0x40cbb0
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00404ff7
test al, 0x40
jne 0x4025b1
push 0
push str.Application_binary_must_be_an_executable
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov ecx, 0x14
mov esi, eax
lea edi, [ebp - 0x320]
push 0x40cbb0
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x320]
push ecx
call fcn.00404ff7
push 0x40e2a8
lea ecx, [ebp - 0x30]
call fcn.00403000
lea edx, [ebp - 0x64]
lea ecx, [ebp - 0x30]
push edx
call fcn.00402ff0
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x4025e9
movsx eax, byte [eax]
push eax
call fcn.00405192
add esp, 4
cmp eax, 0x59
mov dword [ebp + 0x10], 0x110
je 0x4025f0
mov dword [ebp + 0x10], 0x10
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x40260d
movsx ecx, byte [eax]
push ecx
call fcn.00405192
add esp, 4
cmp eax, 0x59
mov esi, 2
je 0x402612
mov esi, 3
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
mov dword [ebp + 0x14], eax
jne 0x40265f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_open_Service_Control_Manager_database
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov ecx, 0x14
mov esi, eax
lea edi, [ebp - 0x5a0]
lea edx, [ebp - 0x5a0]
push 0x40cbb0
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.00404ff7
lea ecx, [ebp - 0x50]
call fcn.00403010
lea ecx, [ebp - 0x78]
mov ebx, eax
call fcn.00403010
mov ecx, 0x4123c8
mov edi, eax
call fcn.00403010
mov ecx, dword [ebp + 0x10]
push 0
push 0
push 0
mov edx, dword [ebp + 0x14]
push 0
push 0
push ebx
push 1
push esi
push ecx
push 0xf01ff
push edi
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
mov dword [ebp + 0x10], eax
jne 0x4026de
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Service_creation_failed
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov esi, eax
mov ecx, 0x14
lea edi, [ebp - 0x3c0]
lea eax, [ebp - 0x3c0]
push 0x40cbb0
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00404ff7
push str.SYSTEMCurrentControlSetServices_
lea ecx, [ebp - 0x40]
call fcn.00402fe0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x40]
call fcn.00403000
push str.Parameters
lea ecx, [ebp - 0x40]
call fcn.00403000
lea ecx, [ebp - 0x40]
call fcn.00403010
lea edx, [ebp - 0x68]
lea ecx, [ebp - 0x18]
push edx
xor ebx, ebx
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x402766
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Attempt_to_create_registry_key_failed
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov ecx, 0x14
mov esi, eax
lea edi, [ebp - 0x6e0]
lea edx, [ebp - 0x6e0]
push 0x40cbb0
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.00404ff7
lea ecx, [ebp - 0x30]
call fcn.00403560
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.00403010
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
mov eax, dword [ebp - 0x18]
push 1
push ebx
push str.FireStarter
push eax
call esi
test eax, eax
je 0x4027c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_set_registry_value_FireStarter
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov ecx, 0x14
mov esi, eax
lea edi, [ebp - 0x460]
push 0x40cbb0
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x460]
push ecx
call fcn.00404ff7
mov edx, dword [ebp + 0xc]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov edx, dword [ebp - 0x18]
push 1
push ebx
push str.WorkingDir
push edx
call esi
test eax, eax
je 0x402823
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_set_registry_value_WorkingDir
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov esi, eax
mov ecx, 0x14
lea edi, [ebp - 0x640]
lea eax, [ebp - 0x640]
push 0x40cbb0
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00404ff7
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
push 4
push ecx
push 4
push ebx
push str.ProcessMonitorEnabled
push edx
mov dword [ebp - 0x14], 1
call esi
test eax, eax
je 0x402879
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_set_registry_value_ProcessMonitorEnabled
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov esi, eax
mov ecx, 0x14
lea edi, [ebp - 0x190]
lea eax, [ebp - 0x190]
push 0x40cbb0
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00404ff7
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
push 4
push ecx
push 4
push ebx
push str.ProcessMonitorFrequency
push edx
mov dword [ebp - 0x14], 0x1388
call esi
test eax, eax
je 0x4028cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_set_registry_value_ProcessMonitorFrequency
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov esi, eax
mov ecx, 0x14
lea edi, [ebp - 0x230]
lea eax, [ebp - 0x230]
push 0x40cbb0
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00404ff7
mov eax, dword [ebp + 0x18]
cmp eax, ebx
jne 0x4028db
mov dword [ebp - 0x14], ebx
jmp 0x4028f2
movsx ecx, byte [eax]
push ecx
call fcn.00405192
add esp, 4
xor edx, edx
cmp eax, 0x59
sete dl
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push ebx
push str.ProcessAutoRestart
push ecx
call esi
test eax, eax
je 0x402941
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_set_registry_value_ProcessAutoRestart
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov ecx, 0x14
mov esi, eax
lea edi, [ebp - 0x2d0]
lea edx, [ebp - 0x2d0]
push 0x40cbb0
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.00404ff7
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
jne 0x40294d
mov dword [ebp - 0x14], ebx
jmp 0x402959
push eax
call fcn.00405187
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push ebx
push str.ProcessAffinityMask
push ecx
call esi
test eax, eax
je 0x4029a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_set_registry_value_ProcessAffinityMask
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov ecx, 0x14
mov esi, eax
lea edi, [ebp - 0x370]
lea edx, [ebp - 0x370]
push 0x40cbb0
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.00404ff7
mov eax, dword [ebp + 0x20]
cmp eax, ebx
jne 0x4029b4
mov dword [ebp - 0x14], ebx
jmp 0x4029c9
cmp dword [ebp - 0x14], 3
jbe 0x4029bd
mov dword [ebp - 0x14], ebx
push eax
call fcn.00405187
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push ebx
push str.ProcessPriority
push ecx
call esi
test eax, eax
je 0x402a18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_set_registry_value_ProcessPriority
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov ecx, 0x14
mov esi, eax
lea edi, [ebp - 0x410]
lea edx, [ebp - 0x410]
push 0x40cbb0
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.00404ff7
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SYSTEMCurrentControlSetServicesEventLogApplication_
lea ecx, [ebp - 0x40]
call fcn.00402fe0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x40]
call fcn.00403000
lea ecx, [ebp - 0x40]
call fcn.00403010
lea edx, [ebp - 0x68]
lea ecx, [ebp - 0x18]
push edx
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x402a9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Attempt_to_create_registry_key_failed
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov ecx, 0x14
mov esi, eax
lea edi, [ebp - 0x4b0]
lea edx, [ebp - 0x4b0]
push 0x40cbb0
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.00404ff7
lea ecx, [ebp - 0x50]
call fcn.00403560
lea ecx, [ebp - 0x50]
mov edi, eax
call fcn.00403010
push edi
push eax
mov eax, dword [ebp - 0x18]
push 1
push ebx
push str.EventMessageFile
push eax
call esi
test eax, eax
je 0x402af8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_set_registry_value_EventMessageFile
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov ecx, 0x14
mov esi, eax
lea edi, [ebp - 0x550]
push 0x40cbb0
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x550]
push ecx
call fcn.00404ff7
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x54]
push 4
push edx
push 4
push ebx
push str.TypesSupported
push eax
mov dword [ebp - 0x54], 7
call esi
test eax, eax
je 0x402b4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_set_registry_value_TypesSupported
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov ecx, 0x14
mov esi, eax
lea edi, [ebp - 0x5f0]
push 0x40cbb0
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x5f0]
push ecx
call fcn.00404ff7
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Service_successfully_installed_
mov ecx, 0x412430
call fcn.0040376d
push 0x402cd0
mov ecx, eax
call fcn.00402cb0
mov ecx, dword [ebp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ecx
mov dword [ebp - 4], 4
call esi
mov edx, dword [ebp + 0x14]
push edx
call esi
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 3
call fcn.00402fd0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00402fd0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.00402fd0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.00402fd0
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], 0xffffffff
call fcn.00402fd0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push str.No_Application_Directory_specified
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov esi, eax
mov ecx, 0x14
lea edi, [ebp - 0x690]
lea eax, [ebp - 0x690]
push 0x40cbb0
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00404ff7
push 0
push str.Service_Name_is_blank
lea ecx, [ebp - 0xc8]
call fcn.004033f0
mov ecx, 0x14
mov esi, eax
lea edi, [ebp - 0x730]
push 0x40cbb0
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x730]
push ecx
call fcn.00404ff7
mov esi, dword [ebp - 0xcc]
push 0x402cd0
push 0x40f0ec
mov ecx, esi
call fcn.00403570
mov edx, dword [eax + 4]
mov ecx, esi
push edx
push str.._Error_code:
call fcn.00403570
mov eax, dword [eax]
mov ecx, 0x4123e8
push eax
push str.Service_installation_failed:
call fcn.0040376d
mov ecx, eax
call fcn.0040376d
mov ecx, eax
call fcn.0040376d
mov ecx, eax
call fcn.0040376d
mov ecx, eax
call fcn.0040376d
mov ecx, eax
call fcn.00402cb0
mov eax, 0x402b73
ret