Function at 0x402ce0
Capabilities:
Check if file exists
Delete file
Delete service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41047b
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
mov eax, dword [0x415040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2a4], ecx
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x294], esi
push 0
push 0
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
xor edi, edi
mov dword [ebp - 0x298], ebx
test ebx, ebx
jne 0x402d62
push 0xd
push str.OpenSCManager
lea ecx, [ebp - 0x294]
call fcn.00401900
jmp 0x402f9f
push 0
mov edx, str.WSServiceCrk
mov ecx, ebx
call section..text
add esp, 4
test eax, eax
je 0x402dc7
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
mov eax, dword [ebp - 0x2a4]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x402e00
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x402e00
mov eax, dword [ebp - 0x2a4]
push dword [eax + 0x10]
lea eax, [ebp - 0x294]
push str.DeleteFile__s
push eax
call fcn.00401ca0
mov ebx, dword [ebp - 0x298]
jmp 0x402f9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x424
je 0x402d84
cmp ebx, 0x426
je 0x402d84
push str.WSServiceCrk
lea eax, [ebp - 0x294]
push str.Attempt_to_stop_service__s
push eax
call fcn.00401ca0
mov ebx, dword [ebp - 0x298]
jmp 0x402f9c
cmp ebx, 0x424
je 0x402fe6
lea eax, [ebp - 0x29c]
push eax
push 3
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion_svchost
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x402e53
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion_svchost
lea eax, [ebp - 0x294]
push str.OpenKey__s
push eax
call fcn.00401ca0
mov ebx, dword [ebp - 0x298]
jmp 0x402f9c
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x290]
push eax
push 0
push 0
push str.LocalServiceAndNoImpersonation
push dword [ebp - 0x29c]
mov dword [ebp - 0x2a0], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
je 0x402ec2
push dword [ebp - 0x29c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.LocalServiceAndNoImpersonation
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion_svchost
lea eax, [ebp - 0x294]
push str.QueryValue__s_s
push eax
call fcn.00401ca0
mov ebx, dword [ebp - 0x298]
add esp, 0x10
jmp 0x402f9f
lea eax, [ebp - 0x2a8]
push eax
lea ecx, [ebp - 0x290]
call fcn.004020a0
add esp, 4
test eax, eax
je 0x402f46
mov ecx, dword [ebp - 0x2a8]
mov edi, ecx
lea edx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x402ee6
mov eax, dword [ebp - 0x2a0]
sub edi, edx
sar edi, 1
lea edi, [edi*2 + 2]
sub eax, edi
sub eax, ecx
lea eax, [ebp + eax - 0x290]
push eax
lea eax, [edi + ecx]
push eax
push ecx
call fcn.00405cb0
mov eax, dword [ebp - 0x2a0]
add esp, 0xc
sub eax, edi
push eax
mov dword [ebp - 0x2a0], eax
lea eax, [ebp - 0x290]
push eax
push 7
push 0
push str.LocalServiceAndNoImpersonation
push dword [ebp - 0x29c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x29c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x298]
push 0x10000
push str.WSServiceCrk
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x402f7b
push str.WSServiceCrk
push str.Open_service__s
jmp 0x402f90
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x402fdd
push str.WSServiceCrk
push str.Delete_service__s
lea eax, [ebp - 0x294]
push eax
call fcn.00401ca0
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ecx, dword [ebp - 0x2a4]
mov dword [ecx + 8], eax
call esi
mov esi, dword [ebp - 0x294]
mov edx, eax
mov ecx, esi
call fcn.00401fa0
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x402fd2
push edi
call eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x402fd9
push ebx
call eax
xor edi, edi
jmp 0x40301e
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x402fec
mov ebx, dword [ebp - 0x298]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x40
push str.Installer
push str.WSServiceCrk_was_successfully_removed__
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x2a4]
mov edi, 1
mov dword [eax + 8], 0
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40303f
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004037fe
mov esp, ebp
pop ebp
ret