Function at 0x4134e0
Capabilities:
Check if file exists
Create process on windows
Delete file
Delete registry value
Get common file path
Get graphical window text
Persist via windows service
Query or enumerate registry value
Set registry value
Stop service

Disassembly:
push 0xffffffffffffffff
push 0x483d9b
mov eax, dword fs:[0]
push eax
sub esp, 0x200
mov eax, dword [0x4a55d0]
xor eax, esp
mov dword [esp + 0x1f8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a55d0]
xor eax, esp
push eax
lea eax, [esp + 0x214]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x224]
push 0xffffffffffffffff
lea esi, [ebp + 0x210]
xor edi, edi
push edi
mov ecx, esi
call fcn.00418c48
mov eax, dword [esi + 8]
push str.RepairAll
push eax
mov ecx, esi
call fcn.00418ec9
mov eax, dword [esi + 8]
push str.TITLE_CS
push eax
mov ecx, esi
call fcn.00418ec9
mov eax, dword [esi + 8]
push 0x496ed4
push eax
mov ecx, esi
call fcn.00418ec9
mov eax, dword [ebp + 0x20]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push edi
push edi
push 0xbba
push eax
call ebx
lea ecx, [esp + 0x24]
push ecx
push 2
push edi
push str.SYSTEMCurrentControlSetServicesMETrsptSvr
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], edi
mov dword [esp + 0x70], 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x4135c4
mov eax, dword [esp + 0x24]
push 4
lea edx, [esp + 0x60]
push edx
push 4
push edi
push str.Start
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push 0x20000000
push edi
push edi
mov dword [esp + 0x74], edi
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [esp + 0x18], eax
cmp eax, edi
je 0x413648
push 0x34
push str.METrsptSvr
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [esp + 0x1c], eax
cmp eax, edi
je 0x41363d
lea edx, [esp + 0x68]
push edx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp eax, 1
je 0x413632
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.00418c48
mov eax, dword [esi + 8]
push str.RepairAll
push eax
mov ecx, esi
call fcn.00418ec9
mov eax, dword [esi + 8]
push str.REPAIRING
push eax
mov ecx, esi
call fcn.00418ec9
mov eax, dword [esi + 8]
push 0x496ed4
push eax
mov ecx, esi
call fcn.00418ec9
mov edx, dword [ebp + 0x20]
push edi
push edi
push 0xbba
push edx
call ebx
lea eax, [esp + 0x28]
push eax
push 2
push edi
push str.SYSTEMCurrentControlSetServicesDGPNPSEV
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x3c], edi
mov dword [esp + 0x6c], 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x4136dc
mov edx, dword [esp + 0x28]
push 4
lea ecx, [esp + 0x5c]
push ecx
push 4
push edi
push str.Start
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x20000000
push edi
push edi
mov dword [esp + 0xac], edi
mov dword [esp + 0xb0], edi
mov dword [esp + 0xb4], edi
mov dword [esp + 0xb8], edi
mov dword [esp + 0xbc], edi
mov dword [esp + 0xc0], edi
mov dword [esp + 0xc4], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [esp + 0x18], eax
cmp eax, edi
je 0x41376a
push 0x34
push str.DGPNPSEV
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [esp + 0x1c], eax
cmp eax, edi
je 0x41375f
lea ecx, [esp + 0xa0]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp eax, 1
je 0x413754
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.00418c48
mov eax, dword [esi + 8]
push str.RepairAll
push eax
mov ecx, esi
call fcn.00418ec9
mov eax, dword [esi + 8]
push str.REPAIRING
push eax
mov ecx, esi
call fcn.00418ec9
mov eax, dword [esi + 8]
push 0x496ed4
push eax
mov ecx, esi
call fcn.00418ec9
mov ecx, dword [ebp + 0x20]
push edi
push edi
push 0xbba
push ecx
call ebx
lea edx, [esp + 0x2c]
push edx
push 2
push edi
push str.SYSTEMCurrentControlSetServicesXLServicePlatform
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x40], edi
mov dword [esp + 0x78], 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x4137fe
mov ecx, dword [esp + 0x2c]
push 4
lea eax, [esp + 0x68]
push eax
push 4
push edi
push str.Start
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x20000000
push edi
push edi
mov dword [esp + 0x90], edi
mov dword [esp + 0x94], edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x9c], edi
mov dword [esp + 0xa0], edi
mov dword [esp + 0xa4], edi
mov dword [esp + 0xa8], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [esp + 0x18], eax
cmp eax, edi
je 0x41388c
push 0x34
push str.XLServicePlatform
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [esp + 0x1c], eax
cmp eax, edi
je 0x413881
lea ecx, [esp + 0x84]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp eax, 1
je 0x413876
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.00418c48
mov eax, dword [esi + 8]
push str.RepairAll
push eax
mov ecx, esi
call fcn.00418ec9
mov eax, dword [esi + 8]
push str.REPAIRING
push eax
mov ecx, esi
call fcn.00418ec9
mov eax, dword [esi + 8]
push 0x496ed4
push eax
mov ecx, esi
call fcn.00418ec9
mov ecx, dword [ebp + 0x20]
push edi
push edi
push 0xbba
push ecx
call ebx
lea edx, [esp + 0x20]
push edx
push 2
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsZones2
push SysReAllocString
mov dword [esp + 0x34], edi
mov dword [esp + 0x74], 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x413920
mov ecx, dword [esp + 0x20]
push 4
lea eax, [esp + 0x64]
push eax
push 4
push edi
push str.2500
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x34], vtable.CArray_class_ATL::CStringT_char__class_StrTraitMFC_char__class_ATL::ChTraitsCRT_char_____class_ATL::CStringT_char__class_StrTraitMFC_char__class_ATL::ChTraitsCRT_char____.0
mov dword [esp + 0x38], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x21c], edi
mov ecx, dword [0x4c6bcc]
mov eax, dword [0x4c6bd0]
mov edi, dword [0x4c6bc8]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x1c], eax
call fcn.00405760
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0x34]
call fcn.00405760
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x34]
call fcn.00405760
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.00418c48
mov edx, dword [esi + 8]
push str.RepairAll
push edx
mov ecx, esi
call fcn.00418ec9
mov eax, dword [esi + 8]
push str.REPAIRING
push eax
mov ecx, esi
call fcn.00418ec9
mov ecx, dword [esi + 8]
push 0x496ed4
push ecx
mov ecx, esi
call fcn.00418ec9
mov edx, dword [ebp + 0x20]
push 0
push 0
push 0xbba
push edx
call ebx
cmp dword [0x4aff98], 1
jne 0x413a66
lea eax, [esp + 0x18]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetControlClass4D36E965_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x413a5b
mov edx, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x1c]
push ecx
push eax
push eax
push eax
push str.upperfilters
push edx
call edi
test eax, eax
jne 0x413a30
mov eax, dword [esp + 0x18]
push str.upperfilters
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
push str.loweverfilters
push edx
call edi
test eax, eax
jne 0x413a5b
mov eax, dword [esp + 0x18]
push str.loweverfilters
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
xor edi, edi
push edi
mov ecx, esi
call fcn.00418c48
mov edx, dword [esi + 8]
push str.RepairAll
push edx
mov ecx, esi
call fcn.00418ec9
mov eax, dword [esi + 8]
push str.REPAIRING
push eax
mov ecx, esi
call fcn.00418ec9
mov ecx, dword [esi + 8]
push 0x496ed4
push ecx
mov ecx, esi
call fcn.00418ec9
mov edx, dword [ebp + 0x20]
push edi
push edi
push 0xbba
push edx
call ebx
push 0x44
lea eax, [esp + 0xc0]
push edi
push eax
mov dword [esp + 0x3c], edi
call fcn.0043abc0
xor eax, eax
push 0x104
push eax
lea ecx, [esp + 0x118]
push ecx
mov dword [esp + 0xd4], 0x44
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
call fcn.0043abc0
add esp, 0x18
lea edx, [esp + 0x104]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [0x4aff94]
cmp eax, 0xd
jne 0x413b4c
lea eax, [esp + 0x104]
dec eax
jmp 0x413b20
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x413b20
mov ecx, dword [str._repair.exe]
mov edx, dword [0x4976b0]
mov dword [eax], ecx
mov ecx, dword [0x4976b4]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov edi, 0xc4
jmp 0x413bdd
cmp eax, 0xc
jne 0x413b6f
lea eax, [esp + 0x104]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x413b60
mov edi, 0xb5
jmp 0x413bc3
cmp eax, 0xe
jne 0x413ba9
lea eax, [esp + 0x104]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x413b80
mov ecx, dword [str._repair.exe]
mov edx, dword [0x4976b0]
mov dword [eax], ecx
mov ecx, dword [0x4976b4]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov edi, 0xf3
jmp 0x413bdd
cmp eax, 0xb
jne 0x413bdd
lea eax, [esp + 0x104]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x413bb6
mov edi, 0xc6
mov edx, dword [str._repair.exe]
mov ecx, dword [0x4976b0]
mov dword [eax], edx
mov edx, dword [0x4976b4]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
lea eax, [esp + 0x104]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x413bfd
lea ecx, [esp + 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x104]
push edx
push edi
call fcn.00417060
push 0xffffffffffffffff
mov ecx, esi
push 0
test al, al
jne 0x413c5c
call fcn.00418c48
mov eax, dword [esi + 8]
push str.RepairAll
push eax
mov ecx, esi
call fcn.00418ec9
mov ecx, dword [esi + 8]
push str.REPAIR4
push ecx
mov ecx, esi
call fcn.00418ec9
mov edx, dword [esi + 8]
push 0x49598c
push edx
mov ecx, esi
call fcn.00418ec9
mov eax, dword [ebp + 0x20]
push 0
push 0
push 0xbba
push eax
jmp 0x413daa
call fcn.00418c48
mov ecx, dword [esi + 8]
push str.RepairAll
push ecx
mov ecx, esi
call fcn.00418ec9
mov edx, dword [esi + 8]
push str.REPAIRING
push edx
mov ecx, esi
call fcn.00418ec9
mov eax, dword [esi + 8]
push 0x496ed4
push eax
mov ecx, esi
call fcn.00418ec9
mov ecx, dword [ebp + 0x20]
push 0
push 0
push 0xbba
push ecx
call ebx
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0xc0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x124]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x413d0a
mov eax, dword [esp + 0x48]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x30]
push ecx
push edx
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x413d54
mov eax, dword [esp + 0x48]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0x4c]
push ecx
call edi
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.00418c48
mov edx, dword [esi + 8]
push str.RepairAll
push edx
mov ecx, esi
call fcn.00418ec9
mov eax, dword [esi + 8]
push str.REPAIR2
push eax
mov ecx, esi
call fcn.00418ec9
mov ecx, dword [esi + 8]
push 0x49598c
push ecx
mov ecx, esi
call fcn.00418ec9
mov edx, dword [ebp + 0x20]
push 0
push 0
push 0xbba
push edx
jmp 0x413daa
lea eax, [esp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.00418c48
mov ecx, dword [esi + 8]
push str.RepairAll
push ecx
mov ecx, esi
call fcn.00418ec9
mov edx, dword [esi + 8]
push str.REPAIR0
push edx
mov ecx, esi
call fcn.00418ec9
mov eax, dword [esi + 8]
push 0x49598c
push eax
mov ecx, esi
call fcn.00418ec9
mov ecx, dword [ebp + 0x20]
push 0
push 0
push 0xbba
push ecx
call ebx
lea edi, [esp + 0x34]
call fcn.00405a80
xor eax, eax
mov ecx, dword [esp + 0x214]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1f8]
xor ecx, esp
call fcn.00436738
add esp, 0x20c
ret 4