Function at 0x4134a0
Capabilities:
Check if file exists
Create process on windows
Delete file
Delete registry value
Get common file path
Get graphical window text
Persist via windows service
Query or enumerate registry value
Set registry value
Stop service

Disassembly:
push 0xffffffffffffffff
push 0x483d7b
mov eax, dword fs:[0]
push eax
sub esp, 0x200
mov eax, dword [0x4a55d0]
xor eax, esp
mov dword [esp + 0x1f8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a55d0]
xor eax, esp
push eax
lea eax, [esp + 0x214]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x224]
push 0xffffffffffffffff
lea esi, [ebp + 0x210]
xor edi, edi
push edi
mov ecx, esi
call fcn.00418c1c
mov eax, dword [esi + 8]
push str.RepairAll
push eax
mov ecx, esi
call fcn.00418e9d
mov eax, dword [esi + 8]
push str.TITLE_CS
push eax
mov ecx, esi
call fcn.00418e9d
mov eax, dword [esi + 8]
push 0x496f3c
push eax
mov ecx, esi
call fcn.00418e9d
mov eax, dword [ebp + 0x20]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push edi
push edi
push 0xbba
push eax
call ebx
lea ecx, [esp + 0x24]
push ecx
push 2
push edi
push str.SYSTEMCurrentControlSetServicesMETrsptSvr
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], edi
mov dword [esp + 0x70], 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x413584
mov eax, dword [esp + 0x24]
push 4
lea edx, [esp + 0x60]
push edx
push 4
push edi
push str.Start
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push 0x20000000
push edi
push edi
mov dword [esp + 0x74], edi
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [esp + 0x18], eax
cmp eax, edi
je 0x413608
push 0x34
push str.METrsptSvr
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [esp + 0x1c], eax
cmp eax, edi
je 0x4135fd
lea edx, [esp + 0x68]
push edx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp eax, 1
je 0x4135f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.00418c1c
mov eax, dword [esi + 8]
push str.RepairAll
push eax
mov ecx, esi
call fcn.00418e9d
mov eax, dword [esi + 8]
push str.REPAIRING
push eax
mov ecx, esi
call fcn.00418e9d
mov eax, dword [esi + 8]
push 0x496f3c
push eax
mov ecx, esi
call fcn.00418e9d
mov edx, dword [ebp + 0x20]
push edi
push edi
push 0xbba
push edx
call ebx
lea eax, [esp + 0x28]
push eax
push 2
push edi
push str.SYSTEMCurrentControlSetServicesDGPNPSEV
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x3c], edi
mov dword [esp + 0x6c], 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x41369c
mov edx, dword [esp + 0x28]
push 4
lea ecx, [esp + 0x5c]
push ecx
push 4
push edi
push str.Start
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x20000000
push edi
push edi
mov dword [esp + 0xac], edi
mov dword [esp + 0xb0], edi
mov dword [esp + 0xb4], edi
mov dword [esp + 0xb8], edi
mov dword [esp + 0xbc], edi
mov dword [esp + 0xc0], edi
mov dword [esp + 0xc4], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [esp + 0x18], eax
cmp eax, edi
je 0x41372a
push 0x34
push str.DGPNPSEV
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [esp + 0x1c], eax
cmp eax, edi
je 0x41371f
lea ecx, [esp + 0xa0]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp eax, 1
je 0x413714
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.00418c1c
mov eax, dword [esi + 8]
push str.RepairAll
push eax
mov ecx, esi
call fcn.00418e9d
mov eax, dword [esi + 8]
push str.REPAIRING
push eax
mov ecx, esi
call fcn.00418e9d
mov eax, dword [esi + 8]
push 0x496f3c
push eax
mov ecx, esi
call fcn.00418e9d
mov ecx, dword [ebp + 0x20]
push edi
push edi
push 0xbba
push ecx
call ebx
lea edx, [esp + 0x2c]
push edx
push 2
push edi
push str.SYSTEMCurrentControlSetServicesXLServicePlatform
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x40], edi
mov dword [esp + 0x78], 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x4137be
mov ecx, dword [esp + 0x2c]
push 4
lea eax, [esp + 0x68]
push eax
push 4
push edi
push str.Start
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x20000000
push edi
push edi
mov dword [esp + 0x90], edi
mov dword [esp + 0x94], edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x9c], edi
mov dword [esp + 0xa0], edi
mov dword [esp + 0xa4], edi
mov dword [esp + 0xa8], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [esp + 0x18], eax
cmp eax, edi
je 0x41384c
push 0x34
push str.XLServicePlatform
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [esp + 0x1c], eax
cmp eax, edi
je 0x413841
lea ecx, [esp + 0x84]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp eax, 1
je 0x413836
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.00418c1c
mov eax, dword [esi + 8]
push str.RepairAll
push eax
mov ecx, esi
call fcn.00418e9d
mov eax, dword [esi + 8]
push str.REPAIRING
push eax
mov ecx, esi
call fcn.00418e9d
mov eax, dword [esi + 8]
push 0x496f3c
push eax
mov ecx, esi
call fcn.00418e9d
mov ecx, dword [ebp + 0x20]
push edi
push edi
push 0xbba
push ecx
call ebx
lea edx, [esp + 0x20]
push edx
push 2
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsZones2
push SysReAllocString
mov dword [esp + 0x34], edi
mov dword [esp + 0x74], 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x4138e0
mov ecx, dword [esp + 0x20]
push 4
lea eax, [esp + 0x64]
push eax
push 4
push edi
push str.2500
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x34], vtable.CArray_class_ATL::CStringT_char__class_StrTraitMFC_char__class_ATL::ChTraitsCRT_char_____class_ATL::CStringT_char__class_StrTraitMFC_char__class_ATL::ChTraitsCRT_char____.0
mov dword [esp + 0x38], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x21c], edi
mov ecx, dword [0x4c6bcc]
mov eax, dword [0x4c6bd0]
mov edi, dword [0x4c6bc8]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x1c], eax
call fcn.00405710
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0x34]
call fcn.00405710
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x34]
call fcn.00405710
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.00418c1c
mov edx, dword [esi + 8]
push str.RepairAll
push edx
mov ecx, esi
call fcn.00418e9d
mov eax, dword [esi + 8]
push str.REPAIRING
push eax
mov ecx, esi
call fcn.00418e9d
mov ecx, dword [esi + 8]
push 0x496f3c
push ecx
mov ecx, esi
call fcn.00418e9d
mov edx, dword [ebp + 0x20]
push 0
push 0
push 0xbba
push edx
call ebx
cmp dword [0x4aff98], 1
jne 0x413a26
lea eax, [esp + 0x18]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetControlClass4D36E965_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x413a1b
mov edx, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x1c]
push ecx
push eax
push eax
push eax
push str.upperfilters
push edx
call edi
test eax, eax
jne 0x4139f0
mov eax, dword [esp + 0x18]
push str.upperfilters
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
push str.loweverfilters
push edx
call edi
test eax, eax
jne 0x413a1b
mov eax, dword [esp + 0x18]
push str.loweverfilters
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
xor edi, edi
push edi
mov ecx, esi
call fcn.00418c1c
mov edx, dword [esi + 8]
push str.RepairAll
push edx
mov ecx, esi
call fcn.00418e9d
mov eax, dword [esi + 8]
push str.REPAIRING
push eax
mov ecx, esi
call fcn.00418e9d
mov ecx, dword [esi + 8]
push 0x496f3c
push ecx
mov ecx, esi
call fcn.00418e9d
mov edx, dword [ebp + 0x20]
push edi
push edi
push 0xbba
push edx
call ebx
push 0x44
lea eax, [esp + 0xc0]
push edi
push eax
mov dword [esp + 0x3c], edi
call fcn.0043aba0
xor eax, eax
push 0x104
push eax
lea ecx, [esp + 0x118]
push ecx
mov dword [esp + 0xd4], 0x44
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
call fcn.0043aba0
add esp, 0x18
lea edx, [esp + 0x104]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [0x4aff94]
cmp eax, 0xd
jne 0x413b0c
lea eax, [esp + 0x104]
dec eax
jmp 0x413ae0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x413ae0
mov ecx, dword [str._repair.exe]
mov edx, dword [0x497718]
mov dword [eax], ecx
mov ecx, dword [0x49771c]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov edi, 0xc4
jmp 0x413b9d
cmp eax, 0xc
jne 0x413b2f
lea eax, [esp + 0x104]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x413b20
mov edi, 0xb5
jmp 0x413b83
cmp eax, 0xe
jne 0x413b69
lea eax, [esp + 0x104]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x413b40
mov ecx, dword [str._repair.exe]
mov edx, dword [0x497718]
mov dword [eax], ecx
mov ecx, dword [0x49771c]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov edi, 0xf3
jmp 0x413b9d
cmp eax, 0xb
jne 0x413b9d
lea eax, [esp + 0x104]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x413b76
mov edi, 0xc6
mov edx, dword [str._repair.exe]
mov ecx, dword [0x497718]
mov dword [eax], edx
mov edx, dword [0x49771c]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
lea eax, [esp + 0x104]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x413bbd
lea ecx, [esp + 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x104]
push edx
push edi
call fcn.00417040
push 0xffffffffffffffff
mov ecx, esi
push 0
test al, al
jne 0x413c1c
call fcn.00418c1c
mov eax, dword [esi + 8]
push str.RepairAll
push eax
mov ecx, esi
call fcn.00418e9d
mov ecx, dword [esi + 8]
push str.REPAIR4
push ecx
mov ecx, esi
call fcn.00418e9d
mov edx, dword [esi + 8]
push 0x49596c
push edx
mov ecx, esi
call fcn.00418e9d
mov eax, dword [ebp + 0x20]
push 0
push 0
push 0xbba
push eax
jmp 0x413d6a
call fcn.00418c1c
mov ecx, dword [esi + 8]
push str.RepairAll
push ecx
mov ecx, esi
call fcn.00418e9d
mov edx, dword [esi + 8]
push str.REPAIRING
push edx
mov ecx, esi
call fcn.00418e9d
mov eax, dword [esi + 8]
push 0x496f3c
push eax
mov ecx, esi
call fcn.00418e9d
mov ecx, dword [ebp + 0x20]
push 0
push 0
push 0xbba
push ecx
call ebx
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0xc0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x124]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x413cca
mov eax, dword [esp + 0x48]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x30]
push ecx
push edx
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x413d14
mov eax, dword [esp + 0x48]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0x4c]
push ecx
call edi
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.00418c1c
mov edx, dword [esi + 8]
push str.RepairAll
push edx
mov ecx, esi
call fcn.00418e9d
mov eax, dword [esi + 8]
push str.REPAIR2
push eax
mov ecx, esi
call fcn.00418e9d
mov ecx, dword [esi + 8]
push 0x49596c
push ecx
mov ecx, esi
call fcn.00418e9d
mov edx, dword [ebp + 0x20]
push 0
push 0
push 0xbba
push edx
jmp 0x413d6a
lea eax, [esp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.00418c1c
mov ecx, dword [esi + 8]
push str.RepairAll
push ecx
mov ecx, esi
call fcn.00418e9d
mov edx, dword [esi + 8]
push str.REPAIR0
push edx
mov ecx, esi
call fcn.00418e9d
mov eax, dword [esi + 8]
push 0x49596c
push eax
mov ecx, esi
call fcn.00418e9d
mov ecx, dword [ebp + 0x20]
push 0
push 0
push 0xbba
push ecx
call ebx
lea edi, [esp + 0x34]
call fcn.00405a30
xor eax, eax
mov ecx, dword [esp + 0x214]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1f8]
xor ecx, esp
call fcn.0043671a
add esp, 0x20c
ret 4