Function at 0x443f08
Capabilities:
Delete registry value
Delete service
Persist via run registry key
Query service status
Stop service

Disassembly:
push esi
push ebx
sub esp, 0x28
mov eax, dword [0x493618]
cmp eax, 1
jne 0x443ff0
lea eax, [esp + 0x20]
push eax
push 0x4a2f3c
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x443fa6
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x443f51
push 0x30
push dword [0x47e4cc]
push 0x494700
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.004441dc
test eax, eax
jne 0x443f80
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x4441be
push 0x30
push dword [0x47e4cc]
push 0x494680
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4441be
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x4441be
push 0x40
push dword [0x47e4cc]
push 0x4938c0
call fcn.00445fbc
add esp, 0xc
jmp 0x4441be
push dword [0x47e4cc]
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x443fe1
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x443fe1
push 0x30
push dword [0x47e4cc]
push 0x4946c0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4441be
cmp eax, 2
jne 0x4441be
lea eax, [esp + 0x1c]
push eax
push 0x4a2f80
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x44404d
push dword [0x47e4cc]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x444043
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x444043
push 0x30
push dword [0x47e4cc]
push 0x494600
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push 0xf003f
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x4441a1
push 0xf01ff
push 0x4a2d80
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
je 0x44417b
lea edx, [esp]
push edx
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4440ff
lea edx, [esp]
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4441d3
mov edx, dword [esp + 4]
cmp edx, 3
jne 0x4440dd
mov dword [esp + 0x24], ebp
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp]
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4441c6
mov edx, dword [esp + 4]
cmp edx, 3
je 0x4440b2
mov ebp, dword [esp + 0x24]
cmp edx, 1
je 0x4440ff
mov edx, dword [esp + 0x34]
test edx, edx
jne 0x4440ff
push 0x30
push dword [0x47e4cc]
push 0x4945c0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x444129
mov edx, dword [esp + 0x34]
test edx, edx
jne 0x444172
push 0x40
push dword [0x47e4cc]
push 0x4938c0
call fcn.00445fbc
add esp, 0xc
jmp 0x444172
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
jne 0x444155
mov edx, dword [esp + 0x34]
test edx, edx
jne 0x444172
push 0x30
push dword [0x47e4cc]
push 0x494580
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x444172
mov edx, dword [esp + 0x34]
test edx, edx
jne 0x444172
push 0x30
push dword [0x47e4cc]
push 0x4946c0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x444198
mov edx, dword [esp + 0x34]
test edx, edx
jne 0x444198
push 0x30
push dword [0x47e4cc]
push 0x494540
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4441be
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x4441be
push 0x30
push dword [0x47e4cc]
push 0x494700
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add esp, 0x28
pop ebx
pop esi
ret
mov ebp, dword [esp + 0x24]
mov edx, dword [esp + 4]
jmp 0x4440dd
mov edx, dword [esp + 4]
jmp 0x4440dd