Function at 0x10001a20
Capabilities:
Delete registry key
Persist via windows service
Set registry value

Disassembly:
sub esp, 0xc
cmp dword [esp + 0x2c], 0
mov dword [esp], 1
mov dword [esp + 4], 3
jne 0x10001a4f
call fcn.10001620
test eax, eax
jne 0x10001a4f
call fcn.10001960
test eax, eax
jne 0x10001a4f
add esp, 0xc
ret
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push 0x80
push str..Efimon
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x10001aad
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x28]
push eax
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push esi
call fcn.10001740
add esp, 0x10
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push str.SYSTEMCurrentControlSetEfiMon
push 0x80000002
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [esp + 0x3c]
push eax
push str.SYSTEMCurrentControlSetEfiMon
push 0x80000002
call edi
test eax, eax
jne 0x10001b15
mov edx, dword [esp + 0x3c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push eax
push str.Type
push edx
call esi
test eax, eax
je 0x10001b1f
push str.SYSTEMCurrentControlSetEfiMon
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [esp + 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 0x3c]
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push 0
push str.Start
push edx
call esi
test eax, eax
jne 0x10001afa
mov ecx, dword [esp + 0x3c]
push eax
push eax
push 3
push eax
push str.ImagePath
push ecx
call esi
test eax, eax
je 0x10001b74
push str.SYSTEMCurrentControlSetEfiMon
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [esp + 0x3c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x3c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x3c]
push ecx
push str.SYSTEMCurrentControlSetServices
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x10001bb4
push str.SYSTEMCurrentControlSetEfiMon
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x18]
push edx
push 0x1000a430
push eax
call edi
test eax, eax
je 0x10001bea
push str.SYSTEMCurrentControlSetEfiMon
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp + 0x3c]
push ecx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 0x18]
push edx
call esi
mov eax, dword [esp + 0x38]
push eax
mov eax, str.RegistryMachineSystemCurrentControlSetEfiMon
call fcn.100010b0
mov ecx, dword [esp + 0x40]
add esp, 4
push 0x1000a430
push ecx
mov edi, eax
call ebx
push str.SYSTEMCurrentControlSetEfiMon
push 0x80000002
call ebx
mov edx, dword [esp + 0x3c]
push edx
call esi
test edi, edi
jl 0x10001b15
push 0
push 0
push 3
push 0
push 3
push 0x80
push str..Efimon
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x10001b15
push 0
push str.EfiMon
push 1
push esi
xor edi, edi
mov ebx, str.EfiSystemMon
mov ecx, str.System32DriversEfimon.sys
call fcn.10001740
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x30]
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x38]
push eax
push ecx
mov ecx, dword [esp + 0x3c]
push edx
push esi
call fcn.10001740
add esp, 0x20
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret