Function at 0x421860
Capabilities:
Delete registry value
Delete service
Persist via run registry key
Query service status
Stop service

Disassembly:
mov eax, dword [0x42da7c]
sub esp, 0x24
dec eax
push ebx
push ebp
push esi
push edi
je 0x421a01
dec eax
jne 0x421aaa
lea eax, [esp + 0x10]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
test eax, eax
jne 0x4218cc
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 0x10]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4218c1
push 0x30
push 0x42b3d8
push 0x42d078
push 0
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x14], ebx
je 0x4219e7
push 0xf01ff
push str.WiseNetbladeIf
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x4219c6
lea eax, [esp + 0x18]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x421963
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea ecx, [esp + 0x18]
push ecx
push esi
call edi
test eax, eax
je 0x42194c
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x1c], 3
jne 0x421948
push 0x3e8
call ebx
lea edx, [esp + 0x18]
push edx
push esi
call edi
test eax, eax
jne 0x42192e
mov ebx, dword [esp + 0x14]
cmp dword [esp + 0x1c], 1
je 0x421963
push 0x30
push 0x42b3d8
push 0x42d05c
push 0
call ebp
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x42199a
push 0x40
push 0x42b3d8
push 0x42d040
call fcn.00422080
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
push 0x30
push 0x42b3d8
push 0x42d024
call fcn.00422080
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
push 0x30
push 0x42b3d8
push 0x42d008
push 0
call ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
push 0x30
push 0x42b3d8
push 0x42cfdc
push 0
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
lea eax, [esp + 0x10]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x421a32
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x30
push 0x42b3d8
push 0x42cfac
push 0
call esi
jmp 0x421a74
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 0x10]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x421a6d
mov edx, dword [esp + 0x10]
push edx
call edi
push 0x30
push 0x42b3d8
push 0x42d024
push 0
call esi
mov eax, dword [esp + 0x10]
push eax
call edi
call fcn.00421300
test eax, eax
jne 0x421a96
push 0x30
push 0x42b3d8
push 0x42cf90
push eax
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
push 0x40
push 0x42b3d8
push 0x42d040
call fcn.00422080
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret