Function at 0x1002543a
Capabilities:
Delete directory
Delete registry value
Get geographical location
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
mov dword [ebp - 0xd4], 0xffffffff
mov dword [ebp - 0xdc], 0xedcad208
mov dword [ebp - 0x94], 0xc9e53e58
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x128], 0xfffffff9
mov dword [ebp - 0x1c], 0xc8ddac0f
mov dword [ebp - 0x48], 0xa1434a93
mov dword [ebp - 0xd0], 7
mov dword [ebp - 4], 0
jmp 0x1002549d
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x100254b3
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe8], 0x7d2703d9
jmp 0x10025496
mov dword [ebp - 4], 0
jmp 0x100254c3
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x100254d9
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x134], 0xab72b21a
jmp 0x100254bc
mov dword [ebp - 4], 0
jmp 0x100254e9
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x100254ff
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x174], 0xfffffff6
jmp 0x100254e2
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x1c], ecx
test eax, eax
je 0x1002552e
mov eax, 0x9e22401d
test eax, eax
je 0x1002552e
mov dword [ebp - 0xa0], 1
jmp 0x10025535
and dword [ebp - 0xa0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe8]
cmp dword [ebp - 0xa0], eax
jne 0x10025553
mov dword [ebp - 0x5c], 1
jmp 0x10025557
and dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 6
je 0x1002556c
mov dword [ebp - 0x7c], 1
jmp 0x10025570
and dword [ebp - 0x7c], 0
cmp dword [ebp - 0x7c], 0x52a2
jle 0x10025585
mov dword [ebp - 0x9c], 1
jmp 0x1002558c
and dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x9c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x134]
jge 0x100255ad
mov dword [ebp - 0x64], 1
jmp 0x100255b1
and dword [ebp - 0x64], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe8]
cmp dword [ebp - 0x64], eax
jge 0x100255cf
mov dword [ebp - 0x84], 1
jmp 0x100255d6
and dword [ebp - 0x84], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x1c], 0
jmp 0x100255f2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x21
jl 0x10025750
mov dword [ebp - 0x38], 8
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp - 0x44], 0
jmp 0x10025624
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x1002563a
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x184], 0x9cbadbef
jmp 0x1002561d
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jl 0x1002564b
mov dword [ebp - 0x6c], 1
jmp 0x1002564f
and dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x6c], eax
jne 0x10025663
mov dword [ebp - 0x54], 1
jmp 0x10025667
and dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0xd0], eax
jge 0x1002567e
mov dword [ebp - 0x74], 1
jmp 0x10025682
and dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 1
jne 0x10025694
mov dword [ebp - 0x8c], 1
jmp 0x1002569b
and dword [ebp - 0x8c], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x8c]
mov dword [ebp - 0x58], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x58]
mov dword [ebp + eax - 0x184], ecx
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x58]
test eax, eax
jle 0x10025742
mov dword [ebp - 0xf4], 1
mov dword [ebp - 0x12c], 2
mov dword [ebp - 0xfc], 0xffffffff
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x104], 0xe85dc32c
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x10c], 8
mov dword [ebp - 0xec], 0x7655
mov dword [ebp - 0x40], 0
jmp 0x10025723
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x10025739
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x114], 0xc0f4fd1a
jmp 0x1002571c
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
jmp 0x1002574b
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc0], eax
jmp 0x100255eb
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100258c0
mov dword [ebp - 0x148], 0xffffffff
mov dword [ebp - 0x11c], 0xa8e97eed
mov dword [ebp - 0x144], 0xffffffff
mov dword [ebp - 8], 0
jmp 0x1002578a
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x100257a0
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x190], 0xdd03248c
jmp 0x10025783
mov dword [ebp - 8], 0
jmp 0x100257b0
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x100257c6
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x160], 8
jmp 0x100257a9
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x160]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x160], eax
mov byte [ebp - 0x16], 0
movzx eax, byte [ebp - 0x16]
test eax, eax
je 0x100258bb
mov dword [ebp - 0x2c], 0x3ae35568
mov dword [ebp - 0x2c], 0xa
jmp 0x10025808
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 7
jne 0x100258b3
mov dword [ebp - 0x68], 1
mov dword [ebp - 0xe0], 0xffffffff
mov dword [ebp - 0x30], 0
jmp 0x10025833
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x10025849
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x16c], 0xffffffff
jmp 0x1002582c
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x70], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x70]
mov dword [ebp + eax - 0x16c], ecx
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x70], eax
je 0x10025870
mov dword [ebp - 0x78], 1
jmp 0x10025874
and dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xe0], eax
mov byte [ebp - 0x14], 0
movzx eax, byte [ebp - 0x14]
test eax, eax
je 0x100258ae
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x24d7
push 0x1735
push 0x95c
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x10025801
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x10025c35
mov dword [ebp - 0x34], 0
jmp 0x100258d0
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x100258e6
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xb8], 0x841b3c69
jmp 0x100258c9
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xb8], 0
jmp 0x10025911
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb8]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xb8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb8], 0xffffffe4
je 0x10025965
mov dword [ebp - 0xc8], 0x43046b6e
mov dword [ebp - 0xd8], 0x464f16ef
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb8]
sub eax, dword [ebp - 0xc8]
cmp eax, 0xb9dd952e
jne 0x10025956
mov dword [ebp - 0x80], 1
jmp 0x1002595a
and dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xd8], eax
jmp 0x100258f8
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb8], 0
je 0x10025987
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x10025987
mov dword [ebp - 0x88], 1
jmp 0x1002598e
and dword [ebp - 0x88], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x88]
mov dword [ebp + eax - 0xb8], ecx
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0xc4], 0x89afca86
mov dword [ebp - 0x124], 4
mov dword [ebp - 0x3c], 0
jmp 0x100259cc
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x100259df
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x50], 0xaf11
jmp 0x100259c5
mov dword [ebp - 0xc], 0
jmp 0x100259ef
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x10025c10
mov dword [ebp - 0x10], 0xe0091df8
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x4c], 0x2e6c0b33
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x28], 1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x150], eax
push 0xfffffffffffffff6
pop eax
add eax, 0x7cdedfc4
je 0x10025a41
mov eax, 0xfc2e
test eax, eax
je 0x10025a41
and dword [ebp - 0x90], 0
jmp 0x10025a4b
mov dword [ebp - 0x90], 1
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xc], eax
jge 0x10025a62
mov dword [ebp - 0xa8], 1
jmp 0x10025a69
and dword [ebp - 0xa8], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x20], 0xffffffff
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jle 0x10025aab
mov dword [ebp - 0x98], 1
jmp 0x10025ab2
and dword [ebp - 0x98], 0
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x98]
je 0x10025acd
mov dword [ebp - 0xbc], 1
jmp 0x10025ad4
and dword [ebp - 0xbc], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x110], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0xc4], 0xf47f28a9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x120], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 1
je 0x10025bc9
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xa4], 0x10b42b8f
mov dword [ebp - 0x24], 0
jmp 0x10025b35
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jg 0x10025b49
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xa4], eax
jmp 0x10025b2e
mov dword [ebp - 0x10], 0
jmp 0x10025b59
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x10025bc7
mov dword [ebp - 0x20], 0
jmp 0x10025b6f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jg 0x10025bc5
mov byte [ebp - 0x12], 0
movzx eax, byte [ebp - 0x12]
test eax, eax
je 0x10025b92
push 0x386
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov byte [ebp - 0x13], 0
movzx eax, byte [ebp - 0x13]
test eax, eax
je 0x10025bc3
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x24d7
push 0x1735
push 0x95c
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x10025b68
jmp 0x10025b52
jmp 0x10025bdf
mov byte [ebp - 0x15], 0
movzx eax, byte [ebp - 0x15]
test eax, eax
je 0x10025bdf
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x28], 0
jmp 0x10025bef
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jg 0x10025c0b
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10025c09
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x10025be8
jmp 0x100259e8
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x24d7
push 0x1735
push 0x95c
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esp, ebp
pop ebp
ret