Function at 0x405090
Capabilities:
Check os version
Create service
Delete registry value
Delete service
Initialize winsock library
Persist via run registry key
Persist via windows service
Set registry value
Start service

Disassembly:
sub esp, 0x1a8
push ebx
push ebp
push esi
lea eax, [esp + 0x24]
push edi
xor ebx, ebx
push eax
push 0x101
mov dword [esp + 0x18], ebx
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x42aca0
mov dword [0x42aca0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ebp, dword [esp + 0x1bc]
mov edi, dword [esp + 0x1c0]
cmp ebp, 2
mov dword [0x42a800], 0x426fa0
je 0x4050eb
cmp ebp, 3
jne 0x40538f
mov eax, dword [edi + 4]
mov esi, str.__install
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x405117
cmp cl, bl
je 0x405113
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x405117
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4050f3
xor eax, eax
jmp 0x40511c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x40538f
mov eax, dword [str.3proxy_tiny_proxy_server]
mov ecx, dword [str.3proxy]
push eax
push ecx
push str._s_will_be_installed_and_started._nBy_clicking_Yes_you_confirm_you_read_and_accepted_License_Agreement._nYou_can_use_Administration_Services_to_control__s_service.
push 0x42ad80
call fcn.00415314
mov edx, dword [0x42a800]
add esp, 0x10
mov eax, dword [edx + 8]
push 0x44
push eax
push 0x42ad80
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x4055ec
lea ecx, [esp + 0x14]
mov byte [0x42ad80], 0x22
mov edx, dword [edi]
push ecx
push 0x42ad81
push 0x100
push str..exe
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathA]
mov edx, eax
cmp edx, ebx
jne 0x4051a9
push str.Failed_to_find_executable_filename
call fcn.00414dbe
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov edi, 0x421c48
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, 0x42ad80
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
cmp ebp, 3
rep movsb byte es:[edi], byte [esi]
jne 0x4051e7
mov eax, dword [esp + 0x1c0]
mov eax, dword [eax + 8]
jmp 0x4051f0
mov ecx, dword [0x42a800]
mov eax, dword [ecx + 0x50]
lea ecx, [esp + 0x14]
lea edx, [edx + 0x42ad84]
push ecx
push edx
push 0x100
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x405226
push str.Failed_to_find_config_filename
call fcn.00414dbe
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov edi, 0x4212d4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x42ad80
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x42acb0]
mov ecx, edx
and ecx, 3
cmp eax, 2
rep movsb byte es:[edi], byte [esi]
jne 0x405308
push 0x40000010
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
jne 0x40528e
push str.Failed_to_open_Service_Manager
call fcn.00414dbe
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov ecx, dword [0x42a800]
push 0
push 0
push 0
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 4]
push 0
push 0
push 0x42ad80
push 0
push 2
push 0x10
push 0x20000000
push edx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x4052db
push str.Failed_to_create_service
call fcn.00414dbe
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x4055a1
push str.Failed_to_start_service
call fcn.00414dbe
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
lea edx, [esp + 0x10]
push edx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x405342
push str.Failed_to_open_registry
call fcn.00414dbe
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov edi, 0x42ad80
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
push ecx
push 0x42ad80
push 2
push eax
mov eax, dword [0x42a800]
mov ecx, dword [eax + 4]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4055a1
push str.Failed_to_set_registry_value
call fcn.00414dbe
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
cmp ebp, 2
je 0x40539d
cmp ebp, 3
jne 0x4054db
mov eax, dword [edi + 4]
mov esi, str.__remove
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4053c9
cmp cl, bl
je 0x4053c5
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4053c9
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4053a5
xor eax, eax
jmp 0x4053ce
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4054db
cmp dword [0x42acb0], 2
jne 0x40546b
push 0x40000000
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
jne 0x40540e
push str.Failed_to_open_Service_Manager_n
call fcn.00414dbe
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov ecx, dword [0x42a800]
push 0x10000
mov edx, dword [ecx + 4]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp eax, ebx
jne 0x405442
push str.Failed_to_open_service
call fcn.00414dbe
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4055a1
push str.Failed_to_delete_service
call fcn.00414dbe
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
lea eax, [esp + 0x10]
push eax
push 0xf003f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4054a4
push str.Failed_to_open_registry
call fcn.00414dbe
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov ecx, dword [0x42a800]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx + 4]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4055a1
push str.Failed_to_clear_registry
call fcn.00414dbe
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
cmp ebp, 2
jne 0x4054e5
mov eax, dword [edi + 4]
jmp 0x4054ea
mov eax, dword [str.3proxy.cfg]
push eax
call fcn.0041f827
add esp, 4
cmp eax, ebx
mov dword [0x42a7a0], eax
je 0x40550a
cmp byte [eax], 0x2d
je 0x40550a
call fcn.00401000
mov dword [esp + 0x10], eax
cmp ebp, 2
jg 0x4055ae
cmp dword [esp + 0x10], ebx
je 0x4055ae
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x42ac80
call esi
push 0x42ad60
call esi
push 0x42ac20
call esi
push 0x42ac40
call esi
push 0x42ad40
call esi
mov esi, dword [esp + 0x10]
push esi
call fcn.00402220
add esp, 4
test eax, eax
jne 0x4055a1
cmp dword [0x42ac58], ebx
jne 0x405568
push esi
call fcn.00414d41
add esp, 4
cmp dword [0x42a7b4], ebx
je 0x40559c
mov ecx, dword [0x42a800]
lea eax, [esp + 0x18]
push eax
mov edx, dword [ecx + 4]
mov dword [esp + 0x20], 0x401510
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x4055a1
call fcn.00401c00
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a8
ret
mov ecx, dword [edi]
push ecx
push str.Usage:__s__conffile__n
push 0x427730
call fcn.00415178
mov eax, dword [edi]
push eax
push eax
push str._n_t_s___install_n_tto_install_as_service_n_n_t_s___remove_n_tto_remove_service_n
push 0x427730
call fcn.00415178
mov edx, dword [str._c_2000_2006_3APA3A__Vladimir_Dubrovin__Security.Nnov_nDocumentation_and_sources:_http:__www.security.nnov.ru_soft_3proxy__nPlease_read_license_agreement_in_copying_file._nYou_may_not_use_this_program_without_accepting_license_agreement]
push edx
push 0x421a84
push 0x427730
call fcn.00415178
add esp, 0x28
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1a8
ret