Function at 0x402660
Capabilities:
Create service
Delete registry value
Delete service
Persist via run registry key
Persist via windows service
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414d90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x140
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
push ebx
mov dword [ebp - 0x1c], edi
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, ebx
jl 0x402b0d
xor esi, esi
call fcn.00413dd0
cmp eax, 3
jne 0x402730
mov dword [ebp - 0x10], ebx
push ebx
push ebx
push 0xf003f
push ebx
push ebx
push str.softwaremicrosoftwindowscurrentversion_runservices
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.00411560
test eax, eax
jne 0x4026da
mov ecx, dword [ebp - 0x10]
lea eax, [edi + 0x70]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x24], ebx
push ebx
push ebx
push 0xf003f
push ebx
push ebx
push str.softwaremicrosoftwindowscurrentversion_run
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.00411560
test eax, eax
jne 0x40270e
mov eax, dword [ebp - 0x24]
lea edx, [edi + 0x70]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [ebp - 0x24]
mov esi, 1
mov byte [ebp - 4], 0
call fcn.00411540
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.00411540
jmp 0x402789
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x402787
add edi, 0x70
push 0x10020
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x402778
lea ecx, [ebp - 0x48]
push ecx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40277d
mov esi, 1
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [ebp - 0x1c]
xor ebx, ebx
cmp esi, ebx
jne 0x4027e7
lea edx, [ebp - 0x10]
mov ecx, edi
push edx
push 0xfa4
call fcn.00401940
cmp eax, ebx
jne 0x4027e7
mov eax, dword [ebp - 0x10]
cmp eax, ebx
jne 0x4027ac
xor eax, eax
jmp 0x4027d0
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and al, 0xfc
call fcn.00414820
mov ecx, dword [ebp - 0x10]
mov eax, esp
push esi
push ecx
push eax
call fcn.0040f850
lea edx, [edi + 0x70]
push ebx
push edx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push ebx
push 1
push 0x64
push edi
call fcn.00410e20
mov dword [ebp - 0x18], ebx
push 0xf003f
push str.AppID
push SysReAllocStringLen
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 2
call fcn.004115c0
mov esi, eax
cmp esi, ebx
jne 0x402afc
lea ecx, [ebp - 0x20]
push ecx
push 0x417e60
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov esi, eax
cmp esi, ebx
jne 0x402afc
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x20]
mov byte [ebp - 4], 3
cmp eax, ebx
jne 0x402848
xor eax, eax
jmp 0x40286c
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and al, 0xfc
call fcn.00414820
mov edx, dword [ebp - 0x20]
mov eax, esp
push esi
push edx
push eax
call fcn.0040f850
push 0xf003f
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
call fcn.004115c0
mov esi, eax
cmp esi, ebx
jne 0x402af0
mov ecx, dword [ebp - 0x14]
push str.LocalService
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x4028c1
lea edx, [edi + 0x70]
push str.LocalService
push edx
lea ecx, [ebp - 0x14]
call fcn.004117b0
push str.ServiceParameters
push str._Service
lea ecx, [ebp - 0x14]
call fcn.004117b0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, edi
call fcn.00401ab0
lea edx, [ebp - 0x28]
mov dword [ebp - 0x28], ebx
push edx
push str.SOFTWAREMicrosoftJava_VMMSDEBUG
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x4028fb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
call fcn.0040d720
add esp, 4
push 1
call fcn.0040d7a0
add esp, 4
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
push 0x20006
push str.NeverTerminate
call fcn.00401140
cmp eax, ebx
jne 0x4029a0
mov ecx, dword [ebp - 0x2c]
push str.devenv.exe
mov dword [ebp + 0xc], ecx
push ebx
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 4
call fcn.00411790
push str.msdev.exe
push ebx
lea ecx, [ebp + 0xc]
call fcn.00411790
push str.vb5.exe
push ebx
lea ecx, [ebp + 0xc]
call fcn.00411790
push str.winword.exe
push ebx
lea ecx, [ebp + 0xc]
call fcn.00411790
push str.excel.exe
push ebx
lea ecx, [ebp + 0xc]
call fcn.00411790
push str.msaccess.exe
push ebx
lea ecx, [ebp + 0xc]
call fcn.00411790
push str.outlook.exe
push ebx
lea ecx, [ebp + 0xc]
call fcn.00411790
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 3
call fcn.00411540
lea edx, [ebp - 0x14c]
xor edi, edi
push 0x104
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.00413dd0
cmp eax, 3
jne 0x402a10
mov dword [ebp + 0xc], edi
push edi
push edi
push 0xf003f
push edi
push edi
push str.softwaremicrosoftwindowscurrentversion_runservices
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 5
call fcn.00411560
test eax, eax
jne 0x402a02
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14c]
add eax, 0x70
push eax
push ecx
lea ecx, [ebp + 0xc]
call fcn.004117b0
mov edi, eax
neg edi
sbb edi, edi
inc edi
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 3
call fcn.00411540
jmp 0x402a78
test esi, esi
je 0x402a73
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x402a78
mov edx, dword [ebp - 0x1c]
push 0
push 0
push str.RPCSS
push 0
lea ecx, [ebp - 0x14c]
push 0
push ecx
push 1
push 2
lea eax, [edx + 0x70]
push 0x110
push 0xf01ff
push eax
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
je 0x402a6a
push eax
mov edi, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x402a78
mov edi, 1
test edi, edi
jne 0x402ad9
mov edi, dword [ebp - 0x1c]
lea edx, [ebp + 0xc]
push edx
push 0xfa3
mov ecx, edi
call fcn.00401940
test eax, eax
jne 0x402adc
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x402abe
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and al, 0xfc
call fcn.00414820
mov ecx, dword [ebp + 0xc]
mov eax, esp
push esi
push ecx
push eax
call fcn.0040f850
lea edx, [edi + 0x70]
push 0
push edx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x402adc
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
push 0
push ecx
push edi
call fcn.00413450
mov esi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00411540
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.00411540
mov eax, esi
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x158]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8