Function at 0x100441d
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 0xc]
push eax
xor edi, edi
lea eax, [ebp - 0x30]
push eax
push 0x10013fc
push ebx
mov byte [ebp - 4], 0
mov byte [ebp - 6], 0
mov byte [ebp - 5], 0
mov byte [ebp - 1], 0
mov byte [ebp - 2], 0
mov byte [ebp - 3], 0
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
call fcn.01003218
test al, al
je 0x100447f
push dword [ebp - 0xc]
push ebx
call fcn.01003267
jmp 0x1004482
mov dword [ebp - 0x30], edi
lea eax, [ebp - 0xc]
push eax
push edi
push 0x1001380
push ebx
call fcn.01003218
test al, al
je 0x10044a3
push dword [ebp - 0xc]
push ebx
call fcn.01003267
mov byte [ebp - 6], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x100169c
push ebx
call fcn.01003218
test al, al
je 0x1004510
push dword [ebp - 0xc]
push ebx
call fcn.01003267
mov eax, dword [ebp - 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x10044c9
sub eax, edx
sar eax, 1
lea esi, [eax + eax + 2]
push esi
push 0x40
mov dword [ebp - 0x3c], esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x28], eax
cmp eax, edi
jne 0x10044f8
mov esi, 0x8007000e
jmp 0x100492b
push dword [ebp - 0x10]
push esi
push eax
call fcn.01003fe8
mov esi, eax
cmp esi, edi
jl 0x100492b
mov byte [ebp - 4], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1001680
push ebx
call fcn.01003218
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
test al, al
je 0x10045c7
push dword [ebp - 0xc]
push ebx
call fcn.01003267
and dword [ebp - 0x14], 0
mov esi, dword [ebp - 0x10]
mov byte [ebp - 5], 0
push 0x2c
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x100455c
mov byte [ebp - 5], 1
jmp 0x1004563
xor eax, eax
mov word [ebx], ax
inc ebx
inc ebx
xor eax, eax
cmp ax, word [esi]
je 0x1004606
push esi
push 0x1001670
call edi
pop ecx
pop ecx
test eax, eax
jne 0x1004582
or dword [ebp - 0x14], 1
jmp 0x10045b8
push esi
push 0x1001660
call edi
pop ecx
pop ecx
test eax, eax
jne 0x1004596
or dword [ebp - 0x14], 2
jmp 0x10045b8
push esi
push 0x1001658
call edi
pop ecx
pop ecx
test eax, eax
jne 0x10045aa
or dword [ebp - 0x14], 3
jmp 0x10045b8
push esi
push 0x1001650
call edi
pop ecx
pop ecx
test eax, eax
jne 0x100462c
cmp byte [ebp - 5], 0
mov esi, ebx
je 0x1004545
mov ebx, dword [ebp + 8]
mov byte [ebp - 5], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov esi, 0x1001624
push esi
push ebx
call fcn.01003218
test al, al
je 0x1004648
push dword [ebp - 0xc]
push ebx
call fcn.01003267
lea eax, [ebp - 0x40]
push eax
push 0x10
push 0
push dword [ebp - 0x10]
call fcn.01003f50
test eax, eax
jge 0x1004644
push 0x10
push 0
push esi
jmp 0x10046e3
push 0x1001620
push 0x579
call fcn.0100ca2c
push 0x10015fc
push 0x57b
call fcn.0100ca2c
add esp, 0x10
jmp 0x1004745
push esi
push 0x10015ec
push 0x5de
call fcn.0100ca2c
add esp, 0xc
jmp 0x1004745
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x10015d8
push ebx
call fcn.01003218
test al, al
je 0x10046a6
push dword [ebp - 0x10]
and dword [ebp - 0x24], 0
push 0x10015d0
call edi
pop ecx
pop ecx
test eax, eax
jne 0x100467c
mov dword [ebp - 0x24], 5
jmp 0x1004699
push dword [ebp - 0x10]
push 0x10015c8
call edi
pop ecx
pop ecx
test eax, eax
jne 0x1004693
mov dword [ebp - 0x24], 0xa
cmp dword [ebp - 0x24], 0
je 0x10046a6
push dword [ebp - 0xc]
push ebx
call fcn.01003267
mov byte [ebp - 2], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov edi, 0x10015a4
push edi
push ebx
call fcn.01003218
test al, al
je 0x1004707
push dword [ebp - 0xc]
push ebx
call fcn.01003267
lea eax, [ebp - 0x2c]
push eax
mov esi, 0x1d4c0
push esi
push 0
push dword [ebp - 0x10]
call fcn.01003f50
test eax, eax
jge 0x10046f7
push esi
push 0
push edi
push 0x1f56
push 0x800
call fcn.0100c98f
add esp, 0x14
jmp 0x1004745
mov eax, dword [ebp - 0x2c]
imul eax, eax, 0x2710
mov dword [ebp - 0x2c], eax
mov byte [ebp - 3], 1
push ebx
call fcn.010032aa
mov esi, eax
test esi, esi
jl 0x100492b
cmp byte [ebp - 4], 0
jne 0x1004765
cmp byte [ebp - 5], 0
jne 0x1004765
cmp byte [ebp - 6], 0
jne 0x100474f
cmp byte [ebp - 1], 0
jne 0x1004765
cmp byte [ebp - 2], 0
jne 0x1004765
cmp byte [ebp - 3], 0
jne 0x1004765
push 0x640
call fcn.0100c967
mov esi, 0x80070057
jmp 0x100492b
cmp byte [ebp - 1], 0
jne 0x1004765
cmp byte [ebp - 2], 0
jne 0x1004765
cmp byte [ebp - 3], 0
je 0x10048c1
lea eax, [ebp - 0x20]
push eax
push 0x80000002
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
test eax, eax
je 0x1004786
jg 0x100491b
jmp 0x1004925
cmp byte [ebp - 4], 0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jne 0x10047a2
cmp byte [ebp - 5], 0
je 0x100483a
lea eax, [ebp - 0x1c]
push eax
push 0x1001538
push dword [ebp - 0x20]
call ebx
test eax, eax
jne 0x100477b
cmp byte [ebp - 4], al
je 0x10047d0
push dword [ebp - 0x3c]
push dword [ebp - 0x28]
push 1
push eax
push 0x1001524
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x100477b
cmp byte [ebp - 5], 0
je 0x100483a
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x1004806
dec eax
je 0x10047ff
dec eax
je 0x10047f8
dec eax
je 0x10047f1
mov esi, 0x80004001
jmp 0x100492b
mov edi, 0x1001514
jmp 0x100480b
mov edi, 0x1001508
jmp 0x100480b
mov edi, 0x1001500
jmp 0x100480b
mov edi, 0x10014f0
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1004810
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push 0x10014e4
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x100477b
cmp byte [ebp - 1], 0
jne 0x100484c
cmp byte [ebp - 2], 0
jne 0x100484c
cmp byte [ebp - 3], 0
je 0x10048c1
lea eax, [ebp - 0x18]
push eax
push 0x1001480
push dword [ebp - 0x20]
call ebx
xor ebx, ebx
cmp eax, ebx
jne 0x100477b
push 4
pop edi
cmp byte [ebp - 1], bl
je 0x1004885
push edi
lea eax, [ebp - 0x40]
push eax
push edi
push ebx
push 0x1001450
push dword [ebp - 0x18]
call esi
cmp eax, ebx
jne 0x100477b
cmp byte [ebp - 2], bl
je 0x10048a3
push edi
lea eax, [ebp - 0x24]
push eax
push edi
push ebx
push 0x1001434
push dword [ebp - 0x18]
call esi
cmp eax, ebx
jne 0x100477b
cmp byte [ebp - 3], bl
je 0x10048c1
push edi
lea eax, [ebp - 0x2c]
push eax
push edi
push ebx
push 0x1001410
push dword [ebp - 0x18]
call esi
cmp eax, ebx
jne 0x100477b
cmp byte [ebp - 6], 0
je 0x1004929
push 1
push 0x1001310
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x38], eax
test eax, eax
jne 0x10048eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jmp 0x100477b
push 0x40
push 0x1001300
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x10048de
lea ecx, [ebp - 0x5c]
push ecx
push 6
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1004929
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1004925
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x100492b
xor esi, esi
cmp dword [ebp - 0x28], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x100493c
push dword [ebp - 0x28]
call ebx
cmp dword [ebp - 0x18], 0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x100494d
push dword [ebp - 0x18]
call edi
cmp dword [ebp - 0x1c], 0
je 0x1004958
push dword [ebp - 0x1c]
call edi
cmp dword [ebp - 0x20], 0
je 0x1004963
push dword [ebp - 0x20]
call edi
cmp dword [ebp - 0x34], 0
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x1004974
push dword [ebp - 0x34]
call edi
cmp dword [ebp - 0x38], 0
je 0x100497f
push dword [ebp - 0x38]
call edi
test esi, esi
jge 0x10049b7
cmp esi, 0x80070057
je 0x10049b5
lea eax, [ebp + 8]
push eax
push esi
call fcn.0100d212
test eax, eax
jl 0x10049c3
push dword [ebp + 8]
push 0x1001330
push 0x579
call fcn.0100ca2c
add esp, 0xc
push dword [ebp + 8]
call ebx
jmp 0x10049c3
test esi, esi
jne 0x10049c3
push 0x578
call fcn.0100c967
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4