Function at 0x8cd180
Capabilities:
Create thread
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1adc
call fcn.00a91950
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x1ad8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
push 0xb6c
lea ecx, [esp + 0x68]
push ebx
push ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
mov esi, edx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x6c], ebx
call fcn.00a7ffb0
add esp, 0xc
cmp dword [ebp + 0xc], 1
mov dword [esp + 0xbcc], esi
mov dword [esp + 0x64], ebx
mov dword [esp + 0x890], ebx
mov dword [esp + 0x888], ebx
mov dword [esp + 0x8a4], ebx
jne 0x8cd887
cmp edi, 4
jbe 0x8cd887
push edi
push 0x20410
call fcn.0097af50
add esp, 8
mov dword [esp + 0xc], eax
cmp eax, ebx
je 0x8cd841
push 0x103
lea edx, [esp + 0xddd]
push ebx
push edx
mov byte [esp + 0xde4], bl
call fcn.00a7ffb0
add esp, 0xc
mov dword [esp + 0x20], 0x104
cmp byte [0xbf3710], bl
jne 0x8cd336
mov edi, 0xbf3710
call fcn.00988be0
push 0x103
lea eax, [esp + 0xbd5]
push ebx
push eax
mov dword [esp + 0x24], ebx
mov byte [esp + 0xbdc], bl
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
push str.S_1_15_19
call fcn.00988b90
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
add esp, 8
test eax, eax
je 0x8cd2cf
mov eax, dword [esp + 0x18]
lea edx, [esp + 0xbd0]
push edx
push str.Local_Service
push eax
call fcn.00964a60
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0xc
test eax, eax
jne 0x8cd2c2
push 0xacc59c
push str.Local_Service
call edi
mov ecx, dword [esp + 0x18]
push ecx
call esi
mov dword [esp + 0x18], ebx
jmp 0x8cd2e1
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0xacc59c
push str.Local_Service
call edi
lea edx, [esp + 0x18]
push edx
push str.S_1_1_20
call fcn.00988b90
add esp, 8
test eax, eax
je 0x8cd32a
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xbd0]
push eax
push str.Network_Service
push ecx
call fcn.00964a60
add esp, 0xc
test eax, eax
jne 0x8cd321
push 0xacc5b8
push str.Network_Service
call edi
mov edx, dword [esp + 0x18]
push edx
call esi
jmp 0x8cd336
push 0xacc5b8
push str.Network_Service
call edi
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0xddc]
call fcn.0097d260
cmp byte [esp + 0xdd8], bl
je 0x8cd407
cmp dword [0xbc27fc], ebx
je 0x8cd3a3
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xdd8]
push ecx
push edx
push str._PROC___u__ProcUserContext:__s_
push 0xffffffffffffffff
lea eax, [esp + 0xef0]
push 0x208
push eax
call fcn.00a78fcb
mov ecx, dword [0xbc27fc]
push ebx
push ecx
lea edx, [esp + 0xf00]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
lea eax, [esp + 0xdd8]
mov ecx, 0xbf3710
call fcn.0094c330
test eax, eax
jne 0x8cd3c5
mov dword [esp + 0x8a0], 1
jmp 0x8cd407
lea eax, [esp + 0xdd8]
mov ecx, str.Local_Service
call fcn.0094c330
test eax, eax
jne 0x8cd3e7
mov dword [esp + 0x8a0], 2
jmp 0x8cd407
lea eax, [esp + 0xdd8]
mov ecx, str.Network_Service
call fcn.0094c330
test eax, eax
jne 0x8cd407
mov dword [esp + 0x8a0], 4
mov edi, dword [esp + 0x10]
xor ecx, ecx
mov edx, edi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call fcn.0097ceb0
mov esi, eax
mov dword [esp + 0x8bc], esi
cmp esi, 4
jbe 0x8cd4c3
push 0x3ff
lea eax, [esp + 0xee5]
push ebx
push eax
mov byte [esp + 0xeec], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x7ff
lea ecx, [esp + 0x12e5]
push ebx
push ecx
mov byte [esp + 0x12ec], bl
call fcn.00a7ffb0
add esp, 0xc
push esi
lea ecx, [esp + 0x12e4]
lea ebx, [esp + 0xee4]
call fcn.0097b130
cmp byte [esp + 0xee0], 0
je 0x8cd4c1
mov edx, ebx
push edx
push 0xaa1544
push 0xffffffffffffffff
lea eax, [esp + 0xad4]
push 0x104
push eax
call fcn.00a78fcb
add esp, 0x14
xor ebx, ebx
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x54]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x48]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x8cd7ec
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x40]
mov ecx, dword [esp + 0x4c]
xor eax, eax
mov word [esp + 0x24], ax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov word [esp + 0x32], ax
mov eax, dword [esp + 0x48]
push ebx
sub eax, edx
push 0x989680
sbb ecx, esi
push ecx
mov dword [esp + 0x28], ebx
push eax
mov dword [esp + 0x2c], ebx
call fcn.00a888d0
mov esi, eax
mov dword [esp + 0x8b8], esi
cmp esi, 2
jb 0x8cd728
mov edi, dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x40]
push edx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetDateFormatA]
cmp eax, 1
jne 0x8cd635
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
cmp eax, 1
jne 0x8cd635
push 0x103
lea edx, [esp + 0xbd5]
push ebx
push edx
mov byte [esp + 0xbdc], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [esp + 0xee5]
push ebx
push eax
mov byte [esp + 0xeec], bl
call fcn.00a7ffb0
add esp, 0xc
call fcn.009675f0
push 0x104
test eax, eax
jne 0x8cd5d3
lea ecx, [esp + 0xbd4]
push ecx
push 0xaaaea4
lea edx, [esp + 0x30]
push edx
jmp 0x8cd5e5
lea eax, [esp + 0xbd4]
push eax
push 0xab7cb0
lea ecx, [esp + 0x30]
push ecx
push ebx
push 0x409
call esi
push 0x104
lea edx, [esp + 0xee4]
push edx
push str.HH:mm:ss
lea eax, [esp + 0x30]
push eax
push ebx
push 0x409
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
lea ecx, [esp + 0xee0]
push ecx
lea edx, [esp + 0xbd4]
push edx
lea eax, [esp + 0x8c8]
push 0xab7fc4
push eax
call fcn.00a78f30
add esp, 0x10
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x4c]
push edx
call edi
cmp eax, 1
jne 0x8cd721
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
cmp eax, 1
jne 0x8cd721
push 0x103
lea edx, [esp + 0xbd5]
push ebx
push edx
mov byte [esp + 0xbdc], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [esp + 0xee5]
push ebx
push eax
mov byte [esp + 0xeec], bl
call fcn.00a7ffb0
add esp, 0xc
call fcn.009675f0
push 0x104
test eax, eax
jne 0x8cd6bf
lea ecx, [esp + 0xbd4]
push ecx
push 0xaaaea4
lea edx, [esp + 0x30]
push edx
jmp 0x8cd6d1
lea eax, [esp + 0xbd4]
push eax
push 0xab7cb0
lea ecx, [esp + 0x30]
push ecx
push ebx
push 0x409
call esi
push 0x104
lea edx, [esp + 0xee4]
push edx
push str.HH:mm:ss
lea eax, [esp + 0x30]
push eax
push ebx
push 0x409
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
lea ecx, [esp + 0xee0]
push ecx
lea edx, [esp + 0xbd4]
push edx
lea eax, [esp + 0x9cc]
push 0xab7fc4
push eax
call fcn.00a78f30
add esp, 0x10
mov esi, dword [esp + 0x8b8]
cmp dword [0xbc27fc], ebx
je 0x8cd831
cmp esi, 0x3c
jbe 0x8cd79b
push 0x103
lea ecx, [esp + 0xee5]
push ebx
push ecx
mov byte [esp + 0xeec], bl
call fcn.00a7ffb0
lea edx, [esp + 0xeec]
add esp, 0xc
push edx
mov ecx, esi
call fcn.00988650
mov ecx, dword [esp + 0x8bc]
mov edx, dword [esp + 0x14]
add esp, 4
lea eax, [esp + 0xee0]
push eax
push ecx
push edx
push str._PROC___u__Process_Exited_after__u_secs___s_
push 0xffffffffffffffff
lea eax, [esp + 0xbe4]
push 0x208
push eax
call fcn.00a78fcb
add esp, 0x1c
jmp 0x8cd7bd
mov ecx, dword [esp + 0x10]
push esi
push ecx
push str._PROC___u__Process_Exited_after__u_secs
push 0xffffffffffffffff
lea edx, [esp + 0xbe0]
push 0x208
push edx
call fcn.00a78fcb
add esp, 0x18
mov eax, dword [0xbc27fc]
push ebx
push eax
lea ecx, [esp + 0xbd8]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea edx, [esp + 0xc]
push edx
call fcn.00985290
mov edi, dword [esp + 0x10]
jmp 0x8cd887
cmp dword [0xbc27fc], ebx
je 0x8cd831
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._PROC___u__GetProcessTimes_Fails__LE:_u__
push 0xffffffffffffffff
lea edx, [esp + 0xef0]
push 0x208
push edx
call fcn.00a78fcb
mov eax, dword [0xbc27fc]
push ebx
push eax
lea ecx, [esp + 0xf00]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
lea edx, [esp + 0xc]
push edx
call fcn.00985290
mov edi, dword [esp + 0x10]
jmp 0x8cd887
cmp dword [0xbc27fc], ebx
je 0x8cd887
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._PROC___u__OpenProcess_Fails__LE:_u__
push 0xffffffffffffffff
lea eax, [esp + 0xef0]
push 0x208
push eax
call fcn.00a78fcb
mov ecx, dword [0xbc27fc]
push ebx
push ecx
lea edx, [esp + 0xf00]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
cmp dword [0xbd050c], ebx
je 0x8cd8d9
lea eax, [esp + 0xc]
push eax
push str.ARetPoint
mov ecx, 0xaa21e4
mov edx, 0x80000002
mov dword [esp + 0x14], 1
call fcn.0094c0d0
test al, al
jne 0x8cd8ce
mov eax, dword [esp + 0xc]
mov esi, str.ARetPoint
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x890], ecx
cmp dword [esp + 0x890], 1
je 0x8cdc5b
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x8cdbf9
cmp word [eax], bx
je 0x8cdbf9
mov edx, eax
push 0x5c
push edx
mov dword [esp + 0x18], ebx
call fcn.00a7c507
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x8cd918
add esi, 2
jmp 0x8cd91c
mov esi, dword [esp + 0x14]
push 0xacc6a0
push esi
call fcn.00a97a87
add esp, 8
test eax, eax
je 0x8cdaca
push str.powershell.exe
push esi
call fcn.00a97a87
add esp, 8
test eax, eax
je 0x8cdaca
push 0xacc6d8
push esi
call fcn.00a97a87
add esp, 8
test eax, eax
je 0x8cdaca
push str.cmd.exe
push esi
call fcn.00a97a87
add esp, 8
test eax, eax
je 0x8cdaca
push 0xacc710
push esi
call fcn.00a97a87
add esp, 8
test eax, eax
je 0x8cdaca
push str.reg.exe
push esi
call fcn.00a97a87
add esp, 8
test eax, eax
je 0x8cdaca
push 0xacc730
push esi
call fcn.00a97a87
add esp, 8
test eax, eax
je 0x8cdaca
push 0xacc74c
push esi
call fcn.00a97a87
add esp, 8
test eax, eax
je 0x8cdaca
push str.schtasks.exe
push esi
call fcn.00a97a87
add esp, 8
test eax, eax
je 0x8cdaca
push 7
push str.notepad
push esi
call fcn.00a7c368
add esp, 0xc
test eax, eax
jne 0x8cda46
push 0x103
lea eax, [esp + 0xee5]
push ebx
push eax
mov dword [esp + 0x18], 0xffffffff
mov byte [esp + 0xeec], bl
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp + 0xee0]
push ecx
lea ecx, [esp + 0x10]
call fcn.009a4460
test eax, eax
je 0x8cdb64
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x8cdaca
cmp eax, 2
jmp 0x8cdac4
cmp dword [0xb3dc7c], ebx
je 0x8cda72
push 0xacc790
push esi
call fcn.00a97a87
add esp, 8
test eax, eax
je 0x8cdaca
push 0xacc7a0
push esi
call fcn.00a97a87
add esp, 8
test eax, eax
je 0x8cdaca
cmp dword [0xb3de98], ebx
je 0x8cdb64
push str.vssadmin.exe
push esi
call fcn.00a97a87
add esp, 8
test eax, eax
je 0x8cdaca
push str.wmic.exe
push esi
call fcn.00a97a87
add esp, 8
test eax, eax
je 0x8cdaca
push 0xacc7e4
push esi
call fcn.00a97a87
add esp, 8
test eax, eax
je 0x8cdaca
push 0xacc7fc
push esi
call fcn.00a97a87
add esp, 8
test eax, eax
jne 0x8cdb64
push edi
xor ecx, ecx
call fcn.0098c0a0
add esp, 4
test eax, eax
je 0x8cdb25
cmp dword [0xbc27fc], ebx
je 0x8cdb18
push edi
push esi
push str._PROC__SuspendProc:__S____TRUE___u_
push 0xffffffffffffffff
lea edx, [esp + 0xef0]
push 0x208
push edx
call fcn.00a78fcb
mov eax, dword [0xbc27fc]
push ebx
push eax
lea ecx, [esp + 0xf00]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov dword [esp + 0x888], 1
jmp 0x8cdb64
cmp dword [0xbc27fc], ebx
je 0x8cdb64
push edi
push esi
push str._PROC__SuspendProc:__S____FALSE___u_
push 0xffffffffffffffff
lea edx, [esp + 0xef0]
push 0x208
push edx
call fcn.00a78fcb
mov eax, dword [0xbc27fc]
push ebx
push eax
lea ecx, [esp + 0xf00]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x68]
sub edx, eax
mov edi, edi
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
cmp cx, bx
jne 0x8cdb70
mov edx, dword [esp + 0x14]
push edx
lea ebx, [esp + 0x14]
call fcn.00970520
mov ebx, dword [esp + 0x14]
add esp, 4
cmp eax, 1
jne 0x8cdbaf
test ebx, ebx
je 0x8cdbbc
cmp byte [ebx], 0
je 0x8cdbaf
lea eax, [esp + 0x60]
push eax
call fcn.008cccc0
add esp, 4
test ebx, ebx
je 0x8cdbbc
push ebx
call fcn.00a78fec
add esp, 4
xor ebx, ebx
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x88c], edx
mov dword [esp + 0x60], edi
cmp dword [esp + 0x8a8], ebx
je 0x8cdc02
lea eax, [esp + 0x60]
push eax
call fcn.008ccf90
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1ad8]
xor ecx, esp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov word [esp + 0x68], cx
jmp 0x8cdbbe
lea ecx, [esp + 0x44]
push ecx
push ebx
lea edx, [esp + 0x68]
push edx
push fcn.008ccf90
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esp + 0x20], eax
cmp eax, ebx
je 0x8cdc5b
mov ebx, dword [esp + 0x44]
push str.PRO_NOTIFY_4a
or esi, 0xffffffff
call fcn.0085df20
add esp, 4
cmp dword [esp + 0x64], 0
jne 0x8cdc51
lea ecx, [ecx]
mov esi, 5
call fcn.0094d160
cmp dword [esp + 0x64], 0
je 0x8cdc40
lea eax, [esp + 0x20]
push eax
call fcn.00985290
mov ecx, dword [esp + 0x1ae4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00a78f21
mov esp, ebp
pop ebp
ret