Function at 0x403490
Capabilities:
Delete directory
Delete registry key
Delete registry value
Delete service
Get common file path
Persist via run registry key
Stop service

Disassembly:
push 0xffffffffffffffff
push 0x408085
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0x40d4ac
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString_1
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x48]
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x4c]
push 0x17
push eax
push 0
mov dword [esp + 0x164], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x48]
lea edx, [esp + 0x28]
push ecx
push 0x40c154
push edx
mov byte [esp + 0x160], 1
call sub.MFC42.DLL_CString::Format
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x54]
add esp, 0xc
rep stosd dword es:[edi], eax
lea eax, [esp + 0x48]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x48]
lea edx, [esp + 0x14]
push ecx
mov bl, 2
push 0x40c154
push edx
mov byte [esp + 0x160], bl
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esi + 0xa0]
push str.Kill_Process_..._Luncher_Process
call sub.MFC42.DLL_CWnd::SetWindowTextA
call fcn.00406ca0
test eax, eax
je 0x40360e
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
je 0x40360e
push 0xf01ff
push str.Logon_Session_Monitor
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x4035c9
lea eax, [esp + 0x2c]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0xf01ff
push str.efinderservice
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x403607
lea ecx, [esp + 0x2c]
push ecx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, 5
push str.ntmcli.exe
mov ecx, esi
call fcn.00402ab0
push str.ntmACC.exe
mov ecx, esi
call fcn.00402ab0
push str.ntmGuard.exe
mov ecx, esi
call fcn.00402ab0
push str.ntmSCMon.exe
mov ecx, esi
call fcn.00402ab0
push str.nnlogon.exe
mov ecx, esi
call fcn.00402ab0
dec edi
jne 0x403613
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
lea eax, [esp + 0x18]
mov edx, esp
mov dword [esp + 0x14], esp
push str.netimoc.ini
push eax
push edx
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x14], esp
push str.wall.chm
push edx
push ecx
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea ecx, [esp + 0x18]
mov eax, esp
mov dword [esp + 0x14], esp
push str.ntm.info
push ecx
push eax
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea eax, [esp + 0x18]
mov edx, esp
mov dword [esp + 0x14], esp
push str.ntmBanner.exe
push eax
push edx
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x14], esp
push str.ntmCLang.dll
push edx
push ecx
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea ecx, [esp + 0x18]
mov eax, esp
mov dword [esp + 0x14], esp
push str.ntmConts.exe
push ecx
push eax
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea eax, [esp + 0x18]
mov edx, esp
mov dword [esp + 0x14], esp
push str.ntmConts.exe.manifest
push eax
push edx
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x14], esp
push str.ntmGuard.exe
push edx
push ecx
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea ecx, [esp + 0x18]
mov eax, esp
mov dword [esp + 0x14], esp
push str.ntmIconReg.exe
push ecx
push eax
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea eax, [esp + 0x18]
mov edx, esp
mov dword [esp + 0x14], esp
push str.ntmList.xml
push eax
push edx
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x14], esp
push str.ntmPOP.exe
push edx
push ecx
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea ecx, [esp + 0x18]
mov eax, esp
mov dword [esp + 0x14], esp
push str.ntmrun.dll
push ecx
push eax
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea eax, [esp + 0x18]
mov edx, esp
mov dword [esp + 0x14], esp
push str.ntmsetvo.dll
push eax
push edx
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x14], esp
push str.ntmss.jgp
push edx
push ecx
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea ecx, [esp + 0x18]
mov eax, esp
mov dword [esp + 0x14], esp
push str.ntmSubCl.dll
push ecx
push eax
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea eax, [esp + 0x18]
mov edx, esp
mov dword [esp + 0x14], esp
push str.ntmUDPsk.dll
push eax
push edx
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x14], esp
push str.ntmUDPsk.log
push edx
push ecx
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea ecx, [esp + 0x18]
mov eax, esp
mov dword [esp + 0x14], esp
push str.ntm_info.html
push ecx
push eax
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea eax, [esp + 0x18]
mov edx, esp
mov dword [esp + 0x14], esp
push str.ntmsapi.dll
push eax
push edx
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x14], esp
push str.ntmsdba.dll
push edx
push ecx
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea ecx, [esp + 0x18]
mov eax, esp
mov dword [esp + 0x14], esp
push str.ntmsevt.dll
push ecx
push eax
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea eax, [esp + 0x18]
mov edx, esp
mov dword [esp + 0x14], esp
push str.ntmsmgr.msc
push eax
push edx
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x14], esp
push str.ntmsmgr.dll
push edx
push ecx
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea ecx, [esp + 0x18]
mov eax, esp
mov dword [esp + 0x14], esp
push str.ntmsoprq.msc
push ecx
push eax
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
mov edx, esp
mov dword [esp + 0x14], esp
lea eax, [esp + 0x18]
push str.ntmssvc.dll
push eax
push edx
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x14], esp
push str.ntmcli.exe
push edx
push ecx
call sub.MFC42.DLL_operator
mov ecx, esi
call fcn.00404300
lea eax, [esp + 0x10]
push eax
call fcn.00404f20
add esp, 4
push str.Netimo
lea ecx, [esp + 0x28]
push eax
push ecx
mov byte [esp + 0x160], 3
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x158], 4
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x24]
mov byte [esp + 0x154], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x154], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.004078f6
mov ecx, esi
call fcn.00402ef0
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x4039ea
mov eax, dword [esp + 0x1c]
push eax
call edi
lea ecx, [esp + 0x24]
push ecx
call fcn.00404f20
add esp, 4
push str.GuruSystem
lea edx, [esp + 0x14]
push eax
push edx
mov byte [esp + 0x160], 5
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x158], 6
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x154], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x154], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004078f6
mov ecx, esi
call fcn.00402ef0
test eax, eax
je 0x403a65
mov ecx, dword [esp + 0x1c]
push ecx
call edi
lea edx, [esp + 0x14]
push str.ntmInstallerC
lea eax, [esp + 0x14]
push edx
push eax
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x158], 7
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x154], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.004078f6
call fcn.00406530
add esp, 4
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push str.ntmRS
push eax
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x158], 8
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x154], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.004078f6
call fcn.00406530
add esp, 4
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push str.ntmUtils
push eax
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x158], 9
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x154], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.004078f6
call fcn.00406530
add esp, 4
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push str.ntmVPV
push eax
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x158], 0xa
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x154], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.004078f6
call fcn.00406530
add esp, 4
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push str.CSound
push eax
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x158], 0xb
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x154], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.004078f6
call fcn.00406530
add esp, 4
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push str.WALLHTM
push eax
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x158], 0xc
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x154], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.004078f6
call fcn.00406530
add esp, 4
lea eax, [esp + 0x28]
lea ecx, [esp + 0x10]
push 0x40bf70
push eax
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x158], 0xd
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x154], bl
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.004078f6
call fcn.00406530
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 4
lea eax, [esp + 0x18]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call esi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x403ce6
mov ecx, dword [esp + 0x18]
push str.ntmacc
push ecx
call ebp
mov edx, dword [esp + 0x18]
push str.MMService
push edx
call ebp
mov eax, dword [esp + 0x18]
push str.ntmgwtray
push eax
call ebp
mov ecx, dword [esp + 0x18]
push str.ntmSeacher
push ecx
call ebp
mov edx, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
lea eax, [esp + 0x18]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
call esi
test eax, eax
jne 0x403d1b
mov ecx, dword [esp + 0x18]
push str.MMService
push ecx
call ebp
mov edx, dword [esp + 0x18]
push edx
call edi
lea eax, [esp + 0x18]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call esi
test eax, eax
jne 0x403d56
mov ecx, dword [esp + 0x18]
push str.MMService
push ecx
call ebp
mov edx, dword [esp + 0x18]
push str.GS_Client
push edx
call ebp
mov eax, dword [esp + 0x18]
push eax
call edi
lea ecx, [esp + 0x18]
push ecx
push 0xf003f
push 0
push str.SoftwareMicrosoftwiziplewizi_plus_startFixHKLM_RUN
push 0x80000001
call esi
test eax, eax
jne 0x403d9d
mov edx, dword [esp + 0x18]
push str.MMService
push edx
call ebp
mov eax, dword [esp + 0x18]
push str.Greenware
push eax
call ebp
mov ecx, dword [esp + 0x18]
push str.ntmacc
push ecx
call ebp
mov edx, dword [esp + 0x18]
push edx
call edi
lea eax, [esp + 0x18]
push eax
push 0xf003f
push 0
push str.Windows_NTCurrentVersionImage_File_Execution_OptionsWarcraft_III.exe
push 0x80000002
call esi
test eax, eax
jne 0x403dcc
mov ecx, dword [esp + 0x18]
push str.Debugger
push ecx
call ebp
mov edx, dword [esp + 0x18]
push edx
call edi
lea eax, [esp + 0x18]
push eax
push 0xf003f
push 0
push str.Windows_NTCurrentVersionImage_File_Execution_OptionsFrozen_Throne.exe
push 0x80000002
call esi
test eax, eax
jne 0x403dfb
mov ecx, dword [esp + 0x18]
push str.Debugger
push ecx
call ebp
mov edx, dword [esp + 0x18]
push edx
call edi
lea eax, [esp + 0x18]
push eax
push 0xf003f
push 0
push str.Windows_NTCurrentVersionImage_File_Execution_OptionsDiablo_II.exe
push 0x80000002
call esi
test eax, eax
jne 0x403e2a
mov ecx, dword [esp + 0x18]
push str.Debugger
push ecx
call ebp
mov edx, dword [esp + 0x18]
push edx
call edi
lea eax, [esp + 0x18]
push eax
push 0xf003f
push 0
push str.Windows_NTCurrentVersionImage_File_Execution_OptionsStarCraft.exe
push 0x80000002
call esi
test eax, eax
jne 0x403e59
mov ecx, dword [esp + 0x18]
push str.Debugger
push ecx
call ebp
mov edx, dword [esp + 0x18]
push edx
call edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall9687FB78_0299_4E66_958B_9723B426806E
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [esp + 0x20]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push eax
push 0x80000002
mov byte [esp + 0x15c], 0xe
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallC29BF44F_70B6_4147_9B4D_42D7DD1F161B
lea ecx, [esp + 0x24]
call fcn.004078a2
mov ecx, dword [esp + 0x20]
push ecx
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallDE70FF80_6EC6_435F_9791_C1FCA03F4DAE
lea ecx, [esp + 0x24]
call fcn.004078a2
mov edx, dword [esp + 0x20]
push edx
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallGS_Client_is1
lea ecx, [esp + 0x24]
call fcn.004078a2
mov eax, dword [esp + 0x20]
push eax
push 0x80000002
call esi
lea ecx, [esp + 0x20]
mov byte [esp + 0x154], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x154], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x154], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
mov dword [esp + 0x154], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x148
ret