Function at 0x401c00
Capabilities:
Create service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x43fab8
push 0x41a270
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x1038
call fcn.0042cb70
mov eax, dword [0x441080]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x1048], 0
mov dword [ebp - 0x1044], 0
xor ebx, ebx
mov dword [ebp - 0x103c], ebx
xor edi, edi
mov dword [ebp - 0x1038], edi
mov dword [ebp - 0x1040], edi
mov dword [ebp - 0x1030], ebx
mov dword [ebp - 0x102c], ebx
mov dword [ebp - 4], ebx
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x1048], esi
test esi, esi
jne 0x401ca2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x1030], esi
jmp 0x401ee3
push 0
push 0
push str.tcpip
lea eax, [ebp - 0x1024]
push eax
push str.PNP_TDI
push str.system32drivers_sectdr.sys
push 1
push 1
push 1
push 0xf01ff
push str.Sectdr
push str.Sectdr
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
mov dword [ebp - 0x1044], edi
test edi, edi
je 0x401c8f
push 0xf01ff
push str.TCPIP
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
mov dword [ebp - 0x103c], ebx
test ebx, ebx
je 0x401c8f
lea eax, [ebp - 0x1020]
push eax
push 0x800
lea eax, [ebp - 0x81c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x401c8f
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x104c], eax
lea eax, [ebp - 0x102c]
push eax
push str.SYSTEMCurrentControlSetControlGroupOrderList
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
mov dword [ebp - 0x1030], esi
test esi, esi
jne 0x401ee3
mov dword [ebp - 0x1020], 0x7f8
lea eax, [ebp - 0x1020]
push eax
lea eax, [ebp - 0x101c]
push eax
lea eax, [ebp - 0x1028]
push eax
push esi
push str.PNP_TDI
push dword [ebp - 0x102c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov dword [ebp - 0x1030], esi
test esi, esi
jne 0x401ee3
mov edx, dword [ebp - 0x1020]
shr edx, 2
mov dword [ebp - 0x1020], edx
mov eax, 1
mov dword [ebp - 0x1034], eax
mov esi, dword [ebp - 0x1024]
cmp eax, edx
jae 0x401df9
lea ecx, [eax*4]
lea edi, [ebp - 0x101c]
add edi, ecx
cmp dword [edi], esi
jne 0x401e26
lea esi, [edx - 1]
cmp eax, esi
ja 0x401df1
sub edx, eax
lea eax, [edx*4 - 4]
push eax
lea eax, [ebp - 0x1018]
add eax, ecx
push eax
push edi
call fcn.00419b50
add esp, 0xc
mov edx, esi
mov dword [ebp - 0x1020], edx
mov ecx, 1
mov dword [ebp - 0x1034], ecx
mov edi, dword [ebp - 0x104c]
nop word [eax + eax]
cmp ecx, edx
jae 0x401e2f
cmp dword [ebp + ecx*4 - 0x101c], edi
je 0x401e38
inc ecx
mov dword [ebp - 0x1034], ecx
jmp 0x401e10
inc eax
mov dword [ebp - 0x1034], eax
jmp 0x401db7
cmp dword [ebp - 0x1028], 0
je 0x401e65
lea esi, [edx - 1]
mov dword [ebp - 0x1050], esi
cmp esi, ecx
jbe 0x401e56
mov eax, dword [ebp + esi*4 - 0x101c]
mov dword [ebp + esi*4 - 0x1018], eax
dec esi
jmp 0x401e3b
mov eax, dword [ebp - 0x1024]
mov dword [ebp + ecx*4 - 0x1018], eax
jmp 0x401e95
lea ecx, [edx - 1]
mov dword [ebp - 0x1034], ecx
test ecx, ecx
je 0x401e83
mov eax, dword [ebp + ecx*4 - 0x101c]
mov dword [ebp + ecx*4 - 0x1014], eax
dec ecx
jmp 0x401e68
mov dword [ebp - 0x1018], edi
mov eax, dword [ebp - 0x1024]
mov dword [ebp - 0x1014], eax
mov dword [ebp - 0x101c], edx
lea eax, [edx*4 + 4]
push eax
lea eax, [ebp - 0x101c]
push eax
push dword [ebp - 0x1028]
push 0
push str.PNP_TDI
push dword [ebp - 0x102c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov dword [ebp - 0x1030], esi
xor edi, edi
mov eax, 1
test esi, esi
cmove edi, eax
mov dword [ebp - 0x1038], edi
mov dword [ebp - 0x1040], edi
mov dword [ebp - 4], 0xfffffffe
call fcn.00401f3b
xor eax, eax
cmp esi, 0x431
cmove esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x1038]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0041908f
mov esp, ebp
pop ebp
ret