Function at 0x415d34
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x20c], eax
cmp dword [0x45e03c], 0
je 0x415d7e
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x20c]
push eax
push str._nStart_Service___x__if_0__err___S_
call fcn.00452380
add esp, 0xc
cmp dword [ebp - 0x20c], 0
jne 0x415d92
xor eax, eax
jmp 0x4161c6
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x416081
cmp dword [0x45e03c], 0
je 0x415ddf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._n_rStart_1_incomplete__gle___d_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [0x462284], 0
je 0x415e38
push 0x200
lea eax, [ebp - 0x204]
push eax
push str.SystemRoot_system32drivers_stbw_k64.sys
call fcn.004280cc
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0xf003f
push 0
push 0x46f8e0
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
jmp 0x415e72
push 0x200
lea eax, [ebp - 0x204]
push eax
push 0x46f90c
call fcn.004280cc
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0xf003f
push 0
push 0x46f938
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], 0x200
mov byte [ebp - 0x204], 0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0x46f964
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [0x45e03c], 0
je 0x415ee2
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x204]
push eax
push str._n_rPrevious_path___s___d._d_type_d
call fcn.00452380
add esp, 0x14
cmp dword [0x462284], 0
je 0x415f29
mov esi, str.System32DRIVERS_stbw_k64.sys
lea edi, [ebp - 0x204]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp dword [0x45e03c], 0
je 0x415f24
lea eax, [ebp - 0x204]
push eax
push str._n_rResetting_STBW_K64.SYS_path___s_
call fcn.00452380
add esp, 8
jmp 0x415f5e
mov esi, str.System32DRIVERS_stbw_k32.sys
lea edi, [ebp - 0x204]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp dword [0x45e03c], 0
je 0x415f5e
lea eax, [ebp - 0x204]
push eax
push str._n_rResetting_STBW_K32.SYS_path___s_
call fcn.00452380
add esp, 8
lea edi, [ebp - 0x204]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov dword [ebp - 0x214], ecx
mov eax, dword [ebp - 0x214]
push eax
lea eax, [ebp - 0x204]
push eax
push 2
push 0
push 0x46fa1c
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [0x45e03c], 0
je 0x415fc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 4]
push eax
push str._n_rSet_to_RegExSz___d___d_
call fcn.00452380
add esp, 0xc
mov esi, str.SofTrack_Browser_Auditing_Agent_Driver
lea edi, [ebp - 0x204]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x204]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov dword [ebp - 0x214], ecx
mov eax, dword [ebp - 0x214]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push 0
push 0x46fa6c
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x20c], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [ebp - 0x21c], eax
cmp dword [0x45e03c], 0
je 0x416081
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x21c]
push eax
push str._n_rRestart___d____d_
call fcn.00452380
add esp, 0xc
cmp dword [ebp - 0x21c], 0
jne 0x416192
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x208], eax
cmp dword [0x45e03c], 0
je 0x416109
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x422
jne 0x4160e9
cmp dword [0x462284], 0
je 0x4160d7
push str._nWARNING:_STBW_K64_has_been_DISABLED__unable_to_start._n_nNOTE:_The_registry_has_been_updated__please_reboot_workstation_to_retry_loading_the_SofTrack_Local_Agent.
call fcn.00452380
add esp, 4
jmp 0x4160e4
push str._nWARNING:_STBW_K32_has_been_DISABLED__unable_to_start._n_nNOTE:_The_registry_has_been_updated__please_reboot_workstation_to_retry_loading_the_SofTrack_Local_Agent.
call fcn.00452380
add esp, 4
jmp 0x416109
push 0x420
mov eax, dword [ebp - 0x208]
push eax
mov eax, dword [ebp - 0x21c]
push eax
push str._nStart_SOFTRACK_Browser_Auditing_Agent_Service__x____d__already__x_
call fcn.00452380
add esp, 0x10
cmp dword [ebp - 0x208], 0x422
je 0x416146
cmp dword [ebp - 0x208], 0
je 0x41618d
cmp dword [ebp - 0x208], 0x1a4
je 0x41618d
cmp dword [ebp - 0x208], 0x3e5
je 0x41618d
cmp dword [0x45e03c], 0
je 0x41618d
cmp dword [0x462284], 0
je 0x416179
mov eax, dword [ebp - 0x208]
push eax
push str._n_rSHUTTING_DOWN_SofTrack_Browser_Auditing_Agent___unable_to_start_STBW_K64.SYS___d_
call fcn.00452380
add esp, 8
jmp 0x41618d
mov eax, dword [ebp - 0x208]
push eax
push str._n_rSHUTTING_DOWN_SofTrack_Browser_Auditing_Agent___unable_to_start_STBW_K32.SYS___d_
call fcn.00452380
add esp, 8
jmp 0x4161b2
push 0x420
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x21c]
push eax
push str._n_OK_Start_SOFTRACK_Browser_Auditing_Agent_Service__x____d__already__x_
call fcn.00452380
add esp, 0x10
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x4161c6
pop edi
pop esi
pop ebx
leave
ret