Function at 0x4039b0
Capabilities:
Delete file
Get common file path
Persist via windows service
Query or enumerate registry value
Set registry value
Shutdown system

Disassembly:
sub esp, 0x22c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x23c]
push edi
xor edi, edi
cmp esi, edi
push edi
mov dword [esp + 0x20], ecx
push edi
je 0x4039d5
mov eax, dword [0x4288cc]
push eax
jmp 0x4039dc
mov ecx, dword [0x4288d0]
push ecx
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, edi
je 0x403a0f
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea edx, [esp + 0x10]
push edx
push 0x426594
push connect
call esi
jmp 0x403a2a
lea eax, [esp + 0x10]
push eax
push str.systemcurrentcontrolset_servicesFGuarder
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
jne 0x403aa0
cmp dword [esp + 0x240], edi
je 0x403a5d
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 4
push ecx
push 4
push edi
push 0x426528
push edx
mov dword [esp + 0x2c], edi
call ebx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 4
push eax
push 4
push edi
push 0x42651c
push ecx
mov dword [esp + 0x2c], 4
call ebx
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push 4
push edx
push 4
push edi
push 0x426504
push eax
mov dword [esp + 0x2c], 1
call ebx
mov ecx, dword [esp + 0x10]
push ecx
call ebp
cmp dword [esp + 0x240], edi
je 0x403ab5
lea edx, [esp + 0x10]
push edx
push 0x4264b0
jmp 0x403abf
lea eax, [esp + 0x10]
push eax
push str.systemcurrentcontrolset_servicesUbqDisk
push connect
call esi
cmp eax, edi
jne 0x403b0d
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 4
push ecx
push 4
push edi
push 0x42651c
push edx
mov dword [esp + 0x2c], 4
call ebx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 4
push eax
push 4
push edi
push 0x426504
push ecx
mov dword [esp + 0x2c], 1
call ebx
mov edx, dword [esp + 0x10]
push edx
call ebp
push 0x2000
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], edi
call sub.MFC42u.DLL_operatornew
mov esi, eax
add esp, 4
cmp esi, edi
je 0x403be0
lea eax, [esp + 0x10]
push eax
push 0x4263ec
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x403bd7
mov dword [esp + 0x20], edi
mov ecx, 0x800
mov edi, esi
mov dword [esp + 0x18], 0x2000
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
push esi
push edx
push eax
mov eax, dword [esp + 0x20]
push 0x4263d0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403bd0
mov ecx, dword [esp + 0x18]
shr ecx, 1
mov word [esi + ecx*2], ax
mov eax, dword [esp + 0x240]
test eax, eax
je 0x403b9a
push 0x4263c0
jmp 0x403b9f
push 0x4263b0
mov ecx, dword [esp + 0x20]
push esi
call fcn.00403920
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
mov edx, dword [esp + 0x24]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
push edx
push 0
push 0x4263d0
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
call ebp
push esi
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov dx, word [0x428280]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x36]
mov word [esp + 0x34], dx
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x34]
push 0x104
push eax
call esi
mov ebx, dword [sym.imp.MSVCRT.dll_wcscat]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 3
jbe 0x403c5c
cmp word [esp + eax*2 + 0x32], 0x5c
lea eax, [esp + eax*2 + 0x32]
jne 0x403c2f
mov word [eax], 0
mov eax, dword [esp + 0x240]
test eax, eax
je 0x403c46
lea ecx, [esp + 0x34]
push str.DriversFGVDisk.sys
push ecx
jmp 0x403c50
lea edx, [esp + 0x34]
push str.DriversUbqDisk.sys
push edx
call ebx
add esp, 8
lea eax, [esp + 0x34]
push eax
call ebp
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x34]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x38]
push ecx
call esi
cmp eax, 3
jbe 0x403cb8
cmp word [esp + eax*2 + 0x32], 0x5c
lea eax, [esp + eax*2 + 0x32]
jne 0x403c8b
mov word [eax], 0
mov eax, dword [esp + 0x240]
test eax, eax
je 0x403ca2
lea edx, [esp + 0x34]
push str.DriversFGAgent.sys
push edx
jmp 0x403cac
lea eax, [esp + 0x34]
push str.DriversFGuarder.sys
push eax
call ebx
add esp, 8
lea ecx, [esp + 0x34]
push ecx
call ebp
mov eax, dword [esp + 0x244]
pop edi
pop esi
pop ebp
test eax, eax
pop ebx
jne 0x403ce0
push 0xffffffffffffffff
push 4
push 0x7d
call sub.MFC42u.DLL_AfxMessageBox_1
cmp eax, 6
je 0x403ceb
add esp, 0x22c
ret 0xc
mov eax, dword [esp + 0x238]
test eax, eax
je 0x403d43
lea edx, [esp + 0xc]
push edx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [esp + 0x18]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov edx, dword [esp + 0xc]
push 0
push 0
lea ecx, [esp + 0x1c]
push 0x10
push ecx
push 0
push edx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x22c
ret 0xc