Function at 0x425aa0
Capabilities:
Delete registry value
Delete service
Persist via run registry key
Query service status
Stop service

Disassembly:
mov eax, dword [0x4343ec]
sub esp, 0x24
dec eax
push ebx
push ebp
push esi
push edi
je 0x425c41
dec eax
jne 0x425cea
lea eax, [esp + 0x10]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
test eax, eax
jne 0x425b0c
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 0x10]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x425b01
push 0x30
push 0x4313d8
push 0x4339c0
push 0
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x14], ebx
je 0x425c27
push 0xf01ff
push str.WiseNetbladeIf
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x425c06
lea eax, [esp + 0x18]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x425ba3
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea ecx, [esp + 0x18]
push ecx
push esi
call edi
test eax, eax
je 0x425b8c
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x1c], 3
jne 0x425b88
push 0x3e8
call ebx
lea edx, [esp + 0x18]
push edx
push esi
call edi
test eax, eax
jne 0x425b6e
mov ebx, dword [esp + 0x14]
cmp dword [esp + 0x1c], 1
je 0x425ba3
push 0x30
push 0x4313d8
push 0x4339a4
push 0
call ebp
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x425bda
push 0x40
push 0x4313d8
push 0x433988
call fcn.004262c0
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
push 0x30
push 0x4313d8
push 0x43396c
call fcn.004262c0
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
push 0x30
push 0x4313d8
push 0x433950
push 0
call ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
push 0x30
push 0x4313d8
push 0x433924
push 0
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
lea eax, [esp + 0x10]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x425c72
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x30
push 0x4313d8
push 0x4338f4
push 0
call esi
jmp 0x425cb4
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 0x10]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x425cad
mov edx, dword [esp + 0x10]
push edx
call edi
push 0x30
push 0x4313d8
push 0x43396c
push 0
call esi
mov eax, dword [esp + 0x10]
push eax
call edi
call fcn.00425540
test eax, eax
jne 0x425cd6
push 0x30
push 0x4313d8
push 0x4338d8
push eax
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
push 0x40
push 0x4313d8
push 0x433988
call fcn.004262c0
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret