Function at 0x464d18
Capabilities:
Delete registry value
Delete service
Persist via run registry key
Query service status
Stop service

Disassembly:
test dword [0x4b63ec], 0xffffff80
jne 0x464d40
test dword [0x4b63ec], 0xffffffff
jne 0x464fbc
call fcn.00490ee4
jmp fcn.00464d18
push edi
push esi
push ebp
sub esp, 0x24
mov edi, eax
mov edx, dword [0x4b4ab0]
cmp edx, 1
jne 0x464df6
lea edx, [esp + 0x1c]
push edx
push 0x4c631c
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x464db0
test edi, edi
jne 0x464d89
push 0x30
push dword [0x4a0328]
push 0x4b4ea0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.00465238
test edi, edi
jne 0x464fa0
push 0x40
push dword [0x4a0328]
push 0x4b5d20
call fcn.0046768c
add esp, 0xc
jmp 0x464fa0
push dword [0x4a0328]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x464de7
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x464de7
push 0x30
push dword [0x4a0328]
push 0x4b4f20
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x464fa0
cmp edx, 2
jne 0x464fa0
lea edx, [esp + 0x20]
push edx
push 0x4c6360
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x464e4f
push dword [0x4a0328]
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x464e45
test edi, edi
jne 0x464e45
push 0x30
push dword [0x4a0328]
push 0x4b4fa0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xf003f
xor edx, edx
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x464f87
push 0xf01ff
push 0x4c6160
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, eax
test ebp, ebp
je 0x464f65
lea edx, [esp]
push edx
push 1
push ebp
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x464ef5
lea edx, [esp]
push edx
push ebp
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x464fb2
mov edx, dword [esp + 4]
cmp edx, 3
jne 0x464ed7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp]
push edx
push ebp
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x464fa9
mov edx, dword [esp + 4]
cmp edx, 3
je 0x464eb0
cmp edx, 1
je 0x464ef5
test edi, edi
jne 0x464ef5
push 0x30
push dword [0x4a0328]
push 0x4b5020
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebp
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x464f1b
test edi, edi
jne 0x464f5c
push 0x40
push dword [0x4a0328]
push 0x4b5d20
call fcn.0046768c
add esp, 0xc
jmp 0x464f5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
jne 0x464f43
test edi, edi
jne 0x464f5c
push 0x30
push dword [0x4a0328]
push 0x4b5060
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x464f5c
test edi, edi
jne 0x464f5c
push 0x30
push dword [0x4a0328]
push 0x4b4f20
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x464f7e
test edi, edi
jne 0x464f7e
push 0x30
push dword [0x4a0328]
push 0x4b50a0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x464fa0
test edi, edi
jne 0x464fa0
push 0x30
push dword [0x4a0328]
push 0x4b4ea0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add esp, 0x24
pop ebp
pop esi
pop edi
ret
mov edx, dword [esp + 4]
jmp 0x464ed7
mov edx, dword [esp + 4]
jmp 0x464ed7
push edi
push esi
push ebp
sub esp, 0x24
mov edi, eax
mov edx, dword [0x4b4ab0]
cmp edx, 1
jne 0x465072
lea edx, [esp + 0x1c]
push edx
push 0x4c631c
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x46502c
test edi, edi
jne 0x465005
push 0x30
push dword [0x4a0328]
push 0x4b4ea0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.00465238
test edi, edi
jne 0x46521c
push 0x40
push dword [0x4a0328]
push 0x4b5d20
call fcn.0046768c
add esp, 0xc
jmp 0x46521c
push dword [0x4a0328]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x465063
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x465063
push 0x30
push dword [0x4a0328]
push 0x4b4f20
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46521c
cmp edx, 2
jne 0x46521c
lea edx, [esp + 0x20]
push edx
push 0x4c6360
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4650cb
push dword [0x4a0328]
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4650c1
test edi, edi
jne 0x4650c1
push 0x30
push dword [0x4a0328]
push 0x4b4fa0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
push 0xf003f
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x465203
push 0xf01ff
push 0x4c6160
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, eax
test ebp, ebp
je 0x4651e1
lea edx, [esp]
push edx
push 1
push ebp
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x465171
lea edx, [esp]
push edx
push ebp
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x46522e
mov edx, dword [esp + 4]
cmp edx, 3
jne 0x465153
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp]
push edx
push ebp
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x465225
mov edx, dword [esp + 4]
cmp edx, 3
je 0x46512c
cmp edx, 1
je 0x465171
test edi, edi
jne 0x465171
push 0x30
push dword [0x4a0328]
push 0x4b5020
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebp
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x465197
test edi, edi
jne 0x4651d8
push 0x40
push dword [0x4a0328]
push 0x4b5d20
call fcn.0046768c
add esp, 0xc
jmp 0x4651d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
jne 0x4651bf
test edi, edi
jne 0x4651d8
push 0x30
push dword [0x4a0328]
push 0x4b5060
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4651d8
test edi, edi
jne 0x4651d8
push 0x30
push dword [0x4a0328]
push 0x4b4f20
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4651fa
test edi, edi
jne 0x4651fa
push 0x30
push dword [0x4a0328]
push 0x4b50a0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x46521c
test edi, edi
jne 0x46521c
push 0x30
push dword [0x4a0328]
push 0x4b4ea0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add esp, 0x24
pop ebp
pop esi
pop edi
ret
mov edx, dword [esp + 4]
jmp 0x465153
mov edx, dword [esp + 4]
jmp 0x465153