Function at 0x41553f
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
push edi
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x20c], eax
cmp dword [0x45e03c], 0
je 0x415589
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x20c]
push eax
push str._nOPEN_Service___x__if_0__err___S_
call fcn.00452380
add esp, 0xc
cmp dword [ebp - 0x20c], 0
jne 0x41559d
xor eax, eax
jmp 0x415d2f
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [ebp - 0x21c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x4156ba
cmp dword [0x45e03c], 0
je 0x4155e7
push str._n_rPausing_up_to_5_Minutes_to_allow_previous_kernel_driver_instance_to_complete_shutdown___is_currently_in_use
call fcn.00452380
add esp, 4
mov dword [ebp - 0x220], 0
cmp dword [ebp - 0x220], 0x64
jge 0x41567e
cmp dword [0x4622c8], 0
jne 0x41567e
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x220]
push 0
push 0
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x415679
cmp dword [0x45e03c], 0
je 0x41566f
push 0
call fcn.00452990
add esp, 4
push eax
mov eax, dword [ebp - 0x220]
lea eax, [eax + eax*2]
push eax
push str._n_rPause_break__d_seconds__Kernel_Driver_engaged___X_
call fcn.00452380
add esp, 0xc
mov dword [ebp - 0x220], 0x3e7
jmp 0x4155f1
cmp dword [ebp - 0x220], 0x384
jge 0x4156ba
cmp dword [0x45e03c], 0
je 0x4156ba
push 0
call fcn.00452990
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_nKernel_Driver_unable_to_start___d____X_
call fcn.00452380
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x241
jne 0x41579a
cmp dword [0x462284], 0
je 0x41579a
push 0x200
lea eax, [ebp - 0x204]
push eax
push 0x46f16c
call fcn.004280cc
add esp, 0xc
cmp dword [0x45e03c], 0
je 0x415712
lea eax, [ebp - 0x204]
push eax
push str._r_n577:64:__s_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push str.STLWA64c
push str.IDR_S64_7
push 0
lea eax, [ebp - 0x204]
push eax
call fcn.004153c5
add esp, 0x10
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x20c], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [ebp - 0x21c], eax
cmp dword [0x45e03c], 0
je 0x41579a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x21c]
push eax
push str._n_r577Restart___d____d_
call fcn.00452380
add esp, 0xc
cmp dword [ebp - 0x21c], 0
jne 0x415b91
cmp dword [0x45e03c], 0
je 0x4157c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x46f1dc
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [0x462284], 0
je 0x4157fb
push 0x200
lea eax, [ebp - 0x204]
push eax
push 0x46f1fc
call fcn.004280cc
add esp, 0xc
cmp dword [0x462280], 0
je 0x415826
push 0x200
lea eax, [ebp - 0x204]
push eax
push 0x46f228
call fcn.004280cc
add esp, 0xc
jmp 0x41583f
push 0x200
lea eax, [ebp - 0x204]
push eax
push 0x46f254
call fcn.004280cc
add esp, 0xc
cmp dword [0x462284], 0
je 0x41586d
lea eax, [ebp - 0x218]
push eax
push 0xf003f
push 0
push 0x46f280
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [0x462280], 0
je 0x4158a0
lea eax, [ebp - 0x218]
push eax
push 0xf003f
push 0
push 0x46f2ac
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
jmp 0x4158c1
lea eax, [ebp - 0x218]
push eax
push 0xf003f
push 0
push 0x46f2d8
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], 0x200
mov byte [ebp - 0x204], 0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0x46f304
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [0x45e03c], 0
je 0x415931
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x204]
push eax
push 0x46f310
call fcn.00452380
add esp, 0x14
cmp dword [0x462284], 0
je 0x415978
mov esi, str.System32DRIVERS_stlwa_64.sys
lea edi, [ebp - 0x204]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp dword [0x45e03c], 0
je 0x415973
lea eax, [ebp - 0x204]
push eax
push str._n_rResetting_STLWA_64.SYS_path___s_
call fcn.00452380
add esp, 8
jmp 0x4159f2
cmp dword [0x462280], 0
je 0x4159be
mov esi, str.System32DRIVERS_stvista.sys
lea edi, [ebp - 0x204]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp dword [0x45e03c], 0
je 0x4159b9
lea eax, [ebp - 0x204]
push eax
push str._n_rResetting_STVISTA.SYS_path___s_
call fcn.00452380
add esp, 8
jmp 0x4159f2
mov esi, str.System32DRIVERS_stlwmon.sys
lea edi, [ebp - 0x204]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp dword [0x45e03c], 0
je 0x4159f2
lea eax, [ebp - 0x204]
push eax
push str._n_rResetting_STLWMON.SYS_path___s_
call fcn.00452380
add esp, 8
lea edi, [ebp - 0x204]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov dword [ebp - 0x214], ecx
mov eax, dword [ebp - 0x214]
push eax
lea eax, [ebp - 0x204]
push eax
push 2
push 0
push 0x46f400
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [0x45e03c], 0
je 0x415a55
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x46f40c
call fcn.00452380
add esp, 0xc
mov esi, str.SofTrack_Local_Workstation_Metering_Agent_KERNEL_Driver
lea edi, [ebp - 0x204]
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x204]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov dword [ebp - 0x214], ecx
mov eax, dword [ebp - 0x214]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push 0
push 0x46f460
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x218]
push eax
push 0xf003f
push 0
push 0x46f46c
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
mov esi, str.Provides_Application_Metering__Audit_and_Control
lea edi, [ebp - 0x204]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x204]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov dword [ebp - 0x214], ecx
mov eax, dword [ebp - 0x214]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push 0
push 0x46f4dc
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x20c], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [ebp - 0x21c], eax
cmp dword [0x45e03c], 0
je 0x415b91
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x21c]
push eax
push 0x46f4e8
call fcn.00452380
add esp, 0xc
cmp dword [ebp - 0x21c], 0
jne 0x415cfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x208], eax
cmp dword [0x45e03c], 0
je 0x415c38
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x422
jne 0x415c18
cmp dword [0x462284], 0
je 0x415be7
push str._nWARNING:_STLWA_64_has_been_DISABLED__unable_to_start._n_nNOTE:_The_registry_has_been_updated__please_reboot_workstation_to_retry_loading_the_SofTrack_Local_Agent.
call fcn.00452380
add esp, 4
jmp 0x415c13
cmp dword [0x462280], 0
je 0x415c06
push str._nWARNING:_STVISTA_has_been_DISABLED__unable_to_start._n_nNOTE:_The_registry_has_been_updated__please_reboot_workstation_to_retry_loading_the_SofTrack_Local_Agent.
call fcn.00452380
add esp, 4
jmp 0x415c13
push str._nWARNING:_STLWMON_has_been_DISABLED__unable_to_start._n_nNOTE:_The_registry_has_been_updated__please_reboot_workstation_to_retry_loading_the_SofTrack_Local_Agent.
call fcn.00452380
add esp, 4
jmp 0x415c38
push 0x420
mov eax, dword [ebp - 0x208]
push eax
mov eax, dword [ebp - 0x21c]
push eax
push str._nStart_SOFTRACK_Local_Metering_Agent_Service__x____d__already__x_
call fcn.00452380
add esp, 0x10
cmp dword [ebp - 0x208], 0x422
je 0x415c75
cmp dword [ebp - 0x208], 0
je 0x415cf6
cmp dword [ebp - 0x208], 0x1a4
je 0x415cf6
cmp dword [ebp - 0x208], 0x3e5
je 0x415cf6
mov dword [0x462164], 1
mov dword [0x4622c8], 1
cmp dword [0x45e03c], 0
je 0x415cf6
cmp dword [0x462284], 0
je 0x415cbc
mov eax, dword [ebp - 0x208]
push eax
push str._n_rSHUTTING_DOWN_SofTrack_Local_Metering_Agent___unable_to_start_STLWA_64.SYS___d_
call fcn.00452380
add esp, 8
jmp 0x415cf6
cmp dword [0x462280], 0
je 0x415ce2
mov eax, dword [ebp - 0x208]
push eax
push str._n_rSHUTTING_DOWN_SofTrack_Local_Metering_Agent___unable_to_start_STVISTA.SYS___d_
call fcn.00452380
add esp, 8
jmp 0x415cf6
mov eax, dword [ebp - 0x208]
push eax
push str._n_rSHUTTING_DOWN_SofTrack_Local_Metering_Agent___unable_to_start_STLWMON.SYS___d_
call fcn.00452380
add esp, 8
jmp 0x415d1b
push 0x420
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x21c]
push eax
push str._n_OK_Start_SOFTRACK_Local_Metering_Agent_Service__x____d__already__x_
call fcn.00452380
add esp, 0x10
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x415d2f
pop edi
pop esi
pop ebx
leave
ret