Function at 0x401fdb
Capabilities:
Persist via windows service
Query service status
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, str.SYSTEMCurrentControlSetServicesW32TimeConfig
push edi
call fcn.00401d3d
push str.SOFTWAREMicrosoftWindowsCurrentVersionDateTimeServers
call fcn.00401d3d
push str.SYSTEMCurrentControlSetServicesW32TimeParameters
call fcn.00401d3d
push str.SYSTEMCurrentControlSetServicesW32TimeTimeProvidersNtpClient
call fcn.00401d3d
lea eax, [esp + 0xc]
push eax
push 0x2001f
xor esi, esi
push esi
push edi
mov edi, dword [0x430018]
mov ebx, 0x80000002
push ebx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], vtable.CRegKeyHepler.0
mov dword [esp + 0x20], esi
call edi
cmp eax, esi
jne 0x40209f
mov eax, dword [esp + 0xc]
or dword [esp + 0x10], 0xffffffff
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push esi
push str.MaxNegPhaseCorrection
push eax
mov dword [esp + 0x30], eax
call dword [0x430014]
or dword [esp + 0x10], 0xffffffff
push 4
lea eax, [esp + 0x14]
push eax
push 4
push esi
push str.MaxPosPhaseCorrection
push dword [esp + 0x20]
call dword [0x430014]
or dword [esp + 0x10], 0xffffffff
push 4
lea eax, [esp + 0x14]
push eax
push 4
push esi
push str.AnnounceFlags
push dword [esp + 0x20]
call dword [0x430014]
lea eax, [esp + 0xc]
push eax
push 0x2001f
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionDateTimeServers
push ebx
mov dword [esp + 0x20], esi
call edi
cmp eax, esi
jne 0x402100
xor eax, eax
cmp dword [esp + 0x18], esi
je 0x4020cc
push dword [esp + 0x18]
call dword [0x43001c]
cmp eax, esi
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
jne 0x402100
push str.time.windows.com
push 0x4325f4
lea eax, [esp + 0x20]
push eax
call fcn.00402505
push 0x4325f4
push 0x432734
lea eax, [esp + 0x20]
push eax
call fcn.00402505
lea eax, [esp + 0xc]
push eax
push 0x2001f
push esi
push str.SYSTEMCurrentControlSetServicesW32TimeParameters
push ebx
mov dword [esp + 0x20], esi
call edi
cmp eax, esi
jne 0x40218b
xor eax, eax
cmp dword [esp + 0x18], esi
je 0x40212d
push dword [esp + 0x18]
call dword [0x43001c]
cmp eax, esi
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
jne 0x40218b
push 0x4325f8
push 0x432600
lea eax, [esp + 0x20]
push eax
call fcn.00402505
push 4
lea eax, [esp + 0x14]
push eax
push 4
push esi
push str.GetDcBackoffMinutes
push dword [esp + 0x20]
mov dword [esp + 0x28], 1
call dword [0x430014]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push esi
push str.GetDcBackoffMaxTimes
push dword [esp + 0x20]
mov dword [esp + 0x28], esi
call dword [0x430014]
lea eax, [esp + 0xc]
push eax
push 0x2001f
push esi
push str.SYSTEMCurrentControlSetServicesW32TimeTimeProvidersNtpClient
push ebx
mov dword [esp + 0x20], esi
call edi
cmp eax, esi
jne 0x4021e2
xor eax, eax
cmp dword [esp + 0x18], esi
je 0x4021b8
push dword [esp + 0x18]
call dword [0x43001c]
cmp eax, esi
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
jne 0x4021e2
push 4
lea eax, [esp + 0x14]
push eax
push 4
push esi
push str.SpecialPollInterval
push ecx
mov dword [esp + 0x28], 0x1e
call dword [0x430014]
push 0xf003f
push esi
push esi
xor ebx, ebx
call dword [0x430048]
cmp eax, esi
mov edi, dword [0x430030]
mov dword [esp + 0xc], eax
je 0x40223a
push 0x10036
push str.W32Time
push eax
call dword [0x430040]
mov ebx, eax
cmp ebx, esi
je 0x40223a
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [0x430038]
test eax, eax
jne 0x402253
push str.Query_Services_Status_Fail__r_n
call dword [0x4302e0]
push ebx
call edi
push dword [esp + 0xc]
call edi
push ebx
call edi
push dword [esp + 0xc]
call edi
lea ecx, [esp + 0x14]
call fcn.00401e7c
mov eax, 0x80004005
jmp 0x402281
cmp dword [esp + 0x20], 4
jne 0x402260
push esi
call fcn.00401eb5
push 1
call fcn.00401eb5
mov esi, dword [0x430030]
push ebx
call esi
push dword [esp + 0xc]
call esi
lea ecx, [esp + 0x14]
call fcn.00401e7c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret