Function at 0x413650
Capabilities:
Check if file exists
Create process on windows
Delete file
Delete registry value
Get common file path
Persist via windows service
Query or enumerate registry value
Set registry value
Stop service

Disassembly:
push 0xffffffffffffffff
push 0x483deb
mov eax, dword fs:[0]
push eax
sub esp, 0x200
mov eax, dword [0x4a55d0]
xor eax, esp
mov dword [esp + 0x1f8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a55d0]
xor eax, esp
push eax
lea eax, [esp + 0x214]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x224]
push 0xffffffffffffffff
lea esi, [ebp + 0x210]
xor ebx, ebx
push ebx
mov ecx, esi
call fcn.00418c5c
mov eax, dword [esi + 8]
push str.RepairAll
push eax
mov ecx, esi
call fcn.00418edd
mov eax, dword [esi + 8]
push str.TITLE_CS
push eax
mov ecx, esi
call fcn.00418edd
mov eax, dword [esi + 8]
push 0x496fa0
push eax
mov ecx, esi
call fcn.00418edd
mov eax, dword [ebp + 0x20]
push ebx
push ebx
push 0xbba
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x24]
push ecx
push 2
push ebx
push str.SYSTEMCurrentControlSetServicesMETrsptSvr
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], ebx
mov dword [esp + 0x70], 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x413732
mov eax, dword [esp + 0x24]
push 4
lea edx, [esp + 0x60]
push edx
push 4
push ebx
push str.Start
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push 0x20000000
push ebx
push ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebx
je 0x4137b0
push 0x34
push str.METrsptSvr
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [esp + 0x1c], eax
cmp eax, ebx
je 0x4137a9
lea edx, [esp + 0x68]
push edx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp eax, 1
je 0x41379e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [esp + 0x28]
push ecx
push 2
push ebx
push str.SYSTEMCurrentControlSetServicesDGPNPSEV
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x6c], 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4137fd
mov eax, dword [esp + 0x28]
push 4
lea edx, [esp + 0x5c]
push edx
push 4
push ebx
push str.Start
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x20000000
push ebx
push ebx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [esp + 0x1c], eax
cmp eax, ebx
je 0x413885
push 0x34
push str.DGPNPSEV
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
cmp edi, ebx
je 0x41387a
lea edx, [esp + 0xa0]
push edx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp eax, 1
je 0x413873
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.00418c5c
mov eax, dword [esi + 8]
push str.RepairAll
push eax
mov ecx, esi
call fcn.00418edd
mov eax, dword [esi + 8]
push str.REPAIRING
push eax
mov ecx, esi
call fcn.00418edd
mov eax, dword [esi + 8]
push 0x496fa0
push eax
mov ecx, esi
call fcn.00418edd
mov ecx, dword [ebp + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0xbba
push ecx
call edi
lea edx, [esp + 0x2c]
push edx
push 2
push ebx
push str.SYSTEMCurrentControlSetServicesXLServicePlatform
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x40], ebx
mov dword [esp + 0x78], 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x41391f
mov ecx, dword [esp + 0x2c]
push 4
lea eax, [esp + 0x68]
push eax
push 4
push ebx
push str.Start
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x20000000
push ebx
push ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [esp + 0x18], eax
cmp eax, ebx
je 0x4139ad
push 0x34
push str.XLServicePlatform
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [esp + 0x1c], eax
cmp eax, ebx
je 0x4139a2
lea ecx, [esp + 0x84]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp eax, 1
je 0x413997
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.00418c5c
mov eax, dword [esi + 8]
push str.RepairAll
push eax
mov ecx, esi
call fcn.00418edd
mov eax, dword [esi + 8]
push str.REPAIRING
push eax
mov ecx, esi
call fcn.00418edd
mov eax, dword [esi + 8]
push 0x496fa0
push eax
mov ecx, esi
call fcn.00418edd
mov ecx, dword [ebp + 0x20]
push ebx
push ebx
push 0xbba
push ecx
call edi
lea edx, [esp + 0x20]
push edx
push 2
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsZones2
push SysReAllocString
mov dword [esp + 0x34], ebx
mov dword [esp + 0x74], 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x413a41
mov ecx, dword [esp + 0x20]
push 4
lea eax, [esp + 0x64]
push eax
push 4
push ebx
push str.2500
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x34], vtable.CArray_class_ATL::CStringT_char__class_StrTraitMFC_char__class_ATL::ChTraitsCRT_char_____class_ATL::CStringT_char__class_StrTraitMFC_char__class_ATL::ChTraitsCRT_char____.0
mov dword [esp + 0x38], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x21c], ebx
mov ecx, dword [0x4c86ac]
mov eax, dword [0x4c86b0]
mov edi, dword [0x4c86a8]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x1c], eax
call fcn.00405840
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0x34]
call fcn.00405840
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x34]
call fcn.00405840
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.00418c5c
mov edx, dword [esi + 8]
push str.RepairAll
push edx
mov ecx, esi
call fcn.00418edd
mov eax, dword [esi + 8]
push str.REPAIRING
push eax
mov ecx, esi
call fcn.00418edd
mov ecx, dword [esi + 8]
push 0x496fa0
push ecx
mov ecx, esi
call fcn.00418edd
mov edx, dword [ebp + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0xbba
push edx
call edi
cmp dword [0x4aff98], 1
jne 0x413b84
lea eax, [esp + 0x18]
push eax
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E965_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x413b79
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push ebx
push str.upperfilters
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x413b4d
mov eax, dword [esp + 0x18]
push str.upperfilters
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push ebx
push str.loweverfilters
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x413b79
mov eax, dword [esp + 0x18]
push str.loweverfilters
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.00418c5c
mov edx, dword [esi + 8]
push str.RepairAll
push edx
mov ecx, esi
call fcn.00418edd
mov eax, dword [esi + 8]
push str.REPAIRING
push eax
mov ecx, esi
call fcn.00418edd
mov ecx, dword [esi + 8]
push 0x496fa0
push ecx
mov ecx, esi
call fcn.00418edd
mov edx, dword [ebp + 0x20]
push ebx
push ebx
push 0xbba
push edx
call edi
push 0x44
lea eax, [esp + 0xc0]
push ebx
push eax
mov dword [esp + 0x3c], ebx
call fcn.0043abe0
add esp, 0xc
xor eax, eax
push 0x104
lea ecx, [esp + 0x108]
push ebx
push ecx
mov dword [esp + 0xc8], 0x44
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x24], ebx
call fcn.0043abe0
add esp, 0xc
lea edx, [esp + 0x104]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push ebp
call fcn.00413470
test eax, eax
jne 0x413c80
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.00418c5c
mov eax, dword [esi + 8]
push str.RepairAll
push eax
mov ecx, esi
call fcn.00418edd
mov ecx, dword [esi + 8]
push str.CONTROL6
push ecx
mov ecx, esi
call fcn.00418edd
mov edx, dword [esi + 8]
push 0x495984
push edx
mov ecx, esi
call fcn.00418edd
mov eax, dword [ebp + 0x20]
push ebx
push ebx
push 0xbba
push eax
jmp 0x413f17
mov eax, dword [0x4aff94]
cmp eax, 0xd
jne 0x413cc1
lea eax, [esp + 0x104]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x413c92
mov ecx, dword [str._repair.exe]
mov edx, dword [0x49774c]
mov dword [eax], ecx
mov ecx, dword [0x497750]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [esp + 0x18], 0xc4
jmp 0x413d5a
cmp eax, 0xc
jne 0x413ce2
lea eax, [esp + 0x104]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x413cd0
mov dword [esp + 0x18], 0xb5
jmp 0x413d40
cmp eax, 0xe
jne 0x413d1c
lea eax, [esp + 0x104]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x413cf0
mov ecx, dword [str._repair.exe]
mov edx, dword [0x49774c]
mov dword [eax], ecx
mov ecx, dword [0x497750]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [esp + 0x18], 0xf1
jmp 0x413d5a
cmp eax, 0xb
jne 0x413d5a
lea eax, [esp + 0x104]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x413d30
mov dword [esp + 0x18], 0xc6
mov edx, dword [str._repair.exe]
mov ecx, dword [0x49774c]
mov dword [eax], edx
mov edx, dword [0x497750]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
lea eax, [esp + 0x104]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x413d7a
lea ecx, [esp + 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x104]
push edx
push eax
call fcn.00417070
push 0xffffffffffffffff
mov ecx, esi
push ebx
test al, al
jne 0x413dda
call fcn.00418c5c
mov ecx, dword [esi + 8]
push str.RepairAll
push ecx
mov ecx, esi
call fcn.00418edd
mov edx, dword [esi + 8]
push str.REPAIR4
push edx
mov ecx, esi
call fcn.00418edd
mov eax, dword [esi + 8]
push 0x495984
push eax
mov ecx, esi
call fcn.00418edd
mov ecx, dword [ebp + 0x20]
push ebx
push ebx
push 0xbba
push ecx
jmp 0x413f17
call fcn.00418c5c
mov edx, dword [esi + 8]
push str.RepairAll
push edx
mov ecx, esi
call fcn.00418edd
mov eax, dword [esi + 8]
push str.REPAIRING
push eax
mov ecx, esi
call fcn.00418edd
mov ecx, dword [esi + 8]
push 0x496fa0
push ecx
mov ecx, esi
call fcn.00418edd
mov edx, dword [ebp + 0x20]
push ebx
push ebx
push 0xbba
push edx
call edi
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0xc0]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x124]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x413e7d
mov ecx, dword [esp + 0x48]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x48]
lea edx, [esp + 0x30]
push edx
push eax
mov dword [esp + 0x38], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x413ec4
mov ecx, dword [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.00418c5c
mov eax, dword [esi + 8]
push str.RepairAll
push eax
mov ecx, esi
call fcn.00418edd
mov ecx, dword [esi + 8]
push str.REPAIR2
push ecx
mov ecx, esi
call fcn.00418edd
mov edx, dword [esi + 8]
push 0x495984
push edx
mov ecx, esi
call fcn.00418edd
mov eax, dword [ebp + 0x20]
push ebx
push ebx
push 0xbba
push eax
jmp 0x413f17
lea ecx, [esp + 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.00418c5c
mov edx, dword [esi + 8]
push str.RepairAll
push edx
mov ecx, esi
call fcn.00418edd
mov eax, dword [esi + 8]
push str.REPAIR0
push eax
mov ecx, esi
call fcn.00418edd
mov ecx, dword [esi + 8]
push 0x495984
push ecx
mov ecx, esi
call fcn.00418edd
mov edx, dword [ebp + 0x20]
push ebx
push ebx
push 0xbba
push edx
call edi
lea edi, [esp + 0x34]
call fcn.00405b60
xor eax, eax
mov ecx, dword [esp + 0x214]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1f8]
xor ecx, esp
call fcn.0043675a
add esp, 0x20c
ret 4