Function at 0x41c8d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bd3ac
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x268], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x270], eax
xor eax, eax
mov dword [ebp - 0x278], edi
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp word [edx], ax
jne 0x41c94b
xor ecx, ecx
jmp 0x41c95f
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41c950
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x230]
call fcn.00402510
lea eax, [ebp - 0x264]
mov dword [ebp - 4], 0
push eax
push 3
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x264], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41ca58
mov edx, edi
xlatb
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41c9a5
sub edx, ecx
lea ecx, [ebp - 0x230]
sar edx, 1
cmp dword [ebp - 0x21c], 8
cmovae ecx, dword [ebp - 0x230]
lea eax, [edx*2 + 2]
push eax
push edi
push 7
push 0
push ecx
push dword [ebp - 0x264]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x41ca58
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0046068d
test al, al
je 0x41ca11
sbb dword [esi - 0x1a], edi
mov ebp, 0x59de02eb
jl 0x41c9a1
movsd dword es:[edi], dword [esi]
jb 0x41c9b0
dec esp
mov ah, 8
shr dword [ebp + 0x6bfd87b5], cl
call fcn.0046023d
test al, al
je 0x41ca33
retf 0xa4d1
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x280], ebx
test ebx, ebx
jne 0x41ca98
push 0x7a
call fcn.00465785
add esp, 4
xor esi, esi
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x41ca78
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.00402610
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret 0x14
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00486960
add esp, 0xc
lea ecx, [ebp - 0x248]
push 0x625f30
call fcn.004023b0
lea ecx, [ebp - 0x2a4]
mov byte [ebp - 4], 1
call fcn.0045fd5c
lea ecx, [ebp - 0x2a4]
mov byte [ebp - 4], 2
call fcn.0045fdfc
test eax, eax
lea eax, [ebp - 0x218]
push 0x104
push eax
je 0x41caf4
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x41cafa
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.004024c0
push str._svchost.exe__k
lea ecx, [ebp - 0x248]
call fcn.00403ea0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x248]
call fcn.004042c0
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push 0
cmovae eax, dword [ebp - 0x248]
push 0
push 0
push 0
push 0
push eax
push 1
push 2
push 0x20
push 0xf01ff
push dword [ebp - 0x268]
push edi
push ebx
call dword [edi + 0x53]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x268], eax
test eax, eax
jne 0x41cb85
push 0x7b
call fcn.00465785
add esp, 4
xor esi, esi
jmp 0x41ce0e
call fcn.004606d2
test al, al
je 0x41cba9
out 0x7b, al
xor ebx, dword [eax - 0x5349b569]
test eax, 0x884ff520
xor eax, 0x2e3debd4
loope 0x41cbe8
loope 0x41cb61
mov edi, 0x13435f77
call fcn.004604aa
test al, al
je 0x41cbc3
adc al, 0xe
out dx, al
sbb ebp, edi
adc edi, dword [eax - 0x5de1b09a]
cmp esp, dword [esi - 0x7c916a73]
call fcn.004607a1
test al, al
je 0x41cbdc
pop ss
push es
mov esi, 0xfae49269
je 0x41cb90
mov al, 0x48
iretd
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x274]
push eax
push 1
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
call fcn.004604ef
test al, al
je 0x41cc1b
fst qword [0xce56b1d8]
stosb byte es:[edi], al
sbb dword [bp + di + 0x79], 0xffffffd8
adc al, 0x26
inc ecx
fimul dword [ecx + 0x23762f28]
call fcn.00460465
test al, al
je 0x41cc42
invalid
call fcn.00460717
test al, al
je 0x41cc6b
insb byte es:[edi], dx
wait
les edi, [edi + 0x2a0f0b1d]
fdiv qword [ebx + 0x66b1cb02]
scasd eax, dword es:[edi]
mov byte [0xca3f1be6], bl
enter 0xffffffffffffaf8b, 0x20
jp 0x41ccce
xchg dword [ebx], ebp
pushfd
inc eax
cli
push str.SYSTEMCurrentControlSetServices_
lea ecx, [ebp - 0x260]
call fcn.004023b0
push dword [ebp - 0x278]
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 3
call fcn.00403ea0
cmp dword [ebp - 0x24c], 8
lea ecx, [ebp - 0x264]
push ecx
push 0xf003f
lea eax, [ebp - 0x260]
cmovae eax, dword [ebp - 0x260]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41ce01
call fcn.00460420
aaa
add al, 0
test al, al
je 0x41ccdf
adc byte [edi - 0x25], cl
adc dword [0x3b53e4f], 0x3f
dec edi
fild dword [ebx - 0x4ac1b0eb]
add edi, dword [edi]
or dword [esi], eax
aam 0x11
movsb byte es:[edi], byte [esi]
into
je 0x41ccc8
call fcn.004603db
div dword [esi]
add al, 0
test al, al
je 0x41ccff
mov edx, 0xa823a853
lds esi, [eax]
push cs
inc edx
mov dh, 0x66
push cs
dec edx
pop ebp
sub byte [ebp + 0x76cae835], cl
leave
fsubr st(0)
into
cmp dword [eax + eax], eax
call fcn.004606d2
test al, al
je 0x41cd1e
jnp 0x41ccb8
aaa
invalid
call fcn.00460465
test al, al
je 0x41cd40
out 0x8e, al
pop ebx
jnp 0x41cd5d
invalid
call fcn.00460282
test al, al
je 0x41cd5d
test al, 0xc2
pop esi
sub ch, byte [ecx]
fimul dword [bx + si]
movsd dword es:[edi], dword [esi]
cmp esp, dword [ecx]
test eax, 0x52df20fe
mov ah, 0x1e
lea eax, [ebp - 0x26c]
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0
push eax
push str.Parameters
push dword [ebp - 0x264]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x41ce01
mov ecx, dword [ebp - 0x27c]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x41cd94
mov ecx, dword [ecx]
lea eax, [eax*2 + 2]
push eax
push ecx
push 2
push 0
push str.ServiceDll
push dword [ebp - 0x26c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x41ce01
mov ebx, dword [ebp - 0x268]
push eax
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x41cdd3
push 0x7c
call fcn.00465785
add esp, 4
push dword [ebp - 0x264]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x26c]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
push dword [ebp - 0x280]
call esi
mov esi, 1
jmp 0x41ce03
xor esi, esi
lea ecx, [ebp - 0x260]
call fcn.00402370
lea ecx, [ebp - 0x2a4]
call fcn.0045fd6f
lea ecx, [ebp - 0x248]
call fcn.00402370
jmp 0x41ca5a