Function at 0x4041c0
Capabilities:
Create process on windows
Delete registry key
Enumerate processes
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x4b8
mov eax, dword [0x6877f0]
xor eax, esp
mov dword [esp + 0x4b4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x3b0]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4044be
lea eax, [esp + 0x3b0]
push eax
push str._scmd.exe
lea eax, [esp + 0x2b0]
push 0x104
push eax
call fcn.00402f90
push 0x124
lea eax, [esp + 0x90]
push 0
push eax
call fcn.0058db90
add esp, 0x1c
xor eax, eax
mov dword [esp + 0xc], eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4042f7
lea eax, [esp + 0x78]
mov dword [esp + 0x78], pe_nt_image_headers32
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x4042aa
nop dword [eax]
cmp dword [esp + 0x80], 0
je 0x40428d
push edi
lea eax, [esp + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40429f
lea eax, [esp + 0x78]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x404270
jmp 0x4042aa
mov eax, dword [esp + 0x80]
mov dword [esp + 0xc], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4042f7
push eax
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4044be
push 1
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x3e8
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4044be
mov esi, dword [esp + 0x2c]
xorps xmm0, xmm0
xor eax, eax
movaps xmmword [esp + 0x10], xmm0
push esi
push str._c_sc_stop__s
mov word [esp + 0x7a], ax
mov word [esp + 0x68], ax
lea eax, [esp + 0x1a8]
push 0x104
push eax
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x5c], xmm0
movlpd qword [esp + 0x64], xmm0
movlpd qword [esp + 0x72], xmm0
movlpd qword [esp + 0x7a], xmm0
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x6c], 1
call fcn.00402f90
add esp, 0x10
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c0]
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4044be
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
mov dword [esp + 0x30], 0x44
xor eax, eax
movaps xmmword [esp + 0x10], xmm0
push esi
push str._c_sc_delete__s
mov word [esp + 0x7a], ax
mov word [esp + 0x68], ax
lea eax, [esp + 0x1a8]
push 0x104
push eax
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x5c], xmm0
movlpd qword [esp + 0x64], xmm0
movlpd qword [esp + 0x72], xmm0
movlpd qword [esp + 0x7a], xmm0
mov dword [esp + 0x6c], 1
call fcn.00402f90
add esp, 0x10
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c0]
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4044be
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push str.SYSTEMCurrentControlSet_services_s
lea eax, [esp + 0x1a8]
push 0x104
push eax
call fcn.00402f90
add esp, 0x10
lea eax, [esp + 0x1a0]
push eax
push connect
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
test eax, eax
jne 0x4044be
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x4b4]
xor ecx, esp
call fcn.00574c7a
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esp + 0x4bc]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00574c7a
mov esp, ebp
pop ebp
ret 8