Function at 0x405040
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x59c
mov ecx, dword [esp + 0x5a4]
mov edx, dword [esp + 0x5a0]
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 0xf003f
push 0
mov esi, 0x378
push ecx
push edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x405091
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x59c
ret
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x30]
push eax
push ecx
push 0
push 0
push str.PackedCatalogItem
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4054c7
cmp dword [esp + 0x14], esi
jne 0x4054c7
mov eax, dword [esp + 0x15c]
mov ebp, 1
cmp eax, ebp
jne 0x405262
cmp dword [esp + 0x180], 2
jne 0x405262
mov eax, dword [esp + 0x158]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea ecx, [esp + 0x1c]
push 0x413f28
push ecx
call esi
mov edx, dword [esp + 0x163]
mov eax, dword [esp + 0x162]
mov ecx, dword [esp + 0x161]
and edx, 0xff
and eax, 0xff
push edx
mov edx, dword [esp + 0x164]
push eax
mov eax, dword [esp + 0x167]
and ecx, 0xff
and edx, 0xff
push ecx
mov ecx, dword [esp + 0x16a]
and eax, 0xff
push edx
mov edx, dword [esp + 0x16d]
push eax
mov eax, dword [esp + 0x170]
and ecx, 0xff
and edx, 0xff
push ecx
and eax, 0xff
push edx
push eax
lea ecx, [esp + 0x3d4]
push str._02X_02X__02X_02X_02X_02X_02X_02X
push ecx
xor edi, edi
call esi
mov eax, dword [esp + 0x1c4]
add esp, 0x34
cmp eax, 0x11
je 0x405195
cmp eax, 6
je 0x405195
test eax, eax
je 0x405195
mov edi, ebp
cmp dword [0x41bca0], ebp
jne 0x40527a
test edi, edi
jne 0x405262
mov esi, str.BD88_0000C082E69A
lea eax, [esp + 0x3a8]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4051dd
test cl, cl
je 0x4051d9
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4051dd
add eax, 2
add esi, 2
test cl, cl
jne 0x4051b5
xor eax, eax
jmp 0x4051e2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x405222
mov esi, 0x417658
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x405217
test cl, cl
je 0x405213
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x405217
add eax, 2
add esi, 2
test cl, cl
jne 0x4051ef
xor eax, eax
jmp 0x40521c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x405262
jmp 0x40525c
mov esi, 0x417770
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x405253
test cl, cl
je 0x40524f
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x405253
add eax, 2
add esi, 2
test cl, cl
jne 0x40522b
xor eax, eax
jmp 0x405258
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x405262
mov dword [0x41bca4], ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x59c
ret
mov al, byte [esp + 0x5b8]
test al, al
jne 0x4053ec
cmp edi, ebp
je 0x405262
mov esi, str.BD88_0000C082E69A
lea eax, [esp + 0x3a8]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4052c1
test cl, cl
je 0x4052bd
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4052c1
add eax, 2
add esi, 2
test cl, cl
jne 0x405299
xor eax, eax
jmp 0x4052c6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4052d9
mov edi, 0x417888
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x405262
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
push ebp
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2DrcomPacketCapture
dec ecx
push reloc.WSOCK32.dll_bind
push ecx
lea eax, [esp + 0x40]
lea ecx, [esp + 0x28]
push eax
push ecx
call fcn.00404fc0
add esp, 0x18
test eax, eax
jne 0x405324
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffa
pop ebx
add esp, 0x59c
ret
mov edi, 0x4179a0
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x3a8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, str.BD88_0000C082E69A
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40537e
test cl, cl
je 0x40537a
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40537e
add eax, 2
add esi, 2
test cl, cl
jne 0x405356
xor eax, eax
jmp 0x405383
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4053ab
mov edi, 0x417888
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x30]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x30]
push ecx
push edx
push 3
push 0
push str.PackedCatalogItem
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x405262
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 0xfffffff9
pop ebx
add esp, 0x59c
ret
push ebp
push str.SYSTEMCurrentControlSetServicesWinSock2DrcomPacketCapture
push reloc.WSOCK32.dll_bind
lea edx, [esp + 0x4b4]
push 0x104
lea eax, [esp + 0x28]
push edx
push eax
call fcn.00404f50
add esp, 0x18
test al, al
jne 0x40542d
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x59c
ret
lea edi, [esp + 0x4a8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [esp + 0x30], 0x25
je 0x405486
push 0
push 0
push 3
push 0
push 3
lea ecx, [esp + 0x44]
push bind
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x405262
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x30]
push edx
push eax
push 3
push 0
push str.PackedCatalogItem
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x405262
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 0xfffffff9
pop ebx
add esp, 0x59c
ret
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffb
pop ebx
add esp, 0x59c
ret