Function at 0x10003350
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x21c], eax
push edi
mov edi, edx
test ebx, ebx
je 0x10003627
test edi, edi
je 0x10003627
test eax, eax
je 0x10003627
mov eax, dword [0x1005e00c]
test eax, eax
jne 0x100033ce
push str.RtlCreateRegistryKey
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1005e00c], eax
test eax, eax
jne 0x100033ce
mov esi, 0xc0000001
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10004869
mov esp, ebp
pop ebp
ret 4
push edi
push 1
call eax
mov esi, eax
test esi, esi
jne 0x10003612
push 4
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 1
push eax
push 4
push str.Type
mov edx, edi
call fcn.10003270
mov esi, eax
test esi, esi
jne 0x10003612
push 4
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 3
push eax
push 4
push str.Start
mov edx, edi
call fcn.10003270
mov esi, eax
test esi, esi
jne 0x10003612
push 4
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 1
push eax
push 4
push str.ErrorControl
mov edx, edi
call fcn.10003270
mov esi, eax
test esi, esi
jne 0x10003612
mov edx, dword [ebp - 0x21c]
mov ecx, edx
lea esi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10003470
sub ecx, esi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push 1
push str.Devname
mov edx, edi
call fcn.10003270
mov esi, eax
test esi, esi
jne 0x10003612
mov byte [ebp - 0x229], al
mov eax, dword [0x1005e004]
test eax, eax
jne 0x100034cb
push str.RtlDetermineDosPathNameType_U
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1005e004], eax
test eax, eax
je 0x100034d3
push ebx
call eax
cmp eax, 4
je 0x100034f0
sub esp, 8
lea edx, [ebp - 0x228]
mov ecx, ebx
call fcn.100032c0
test al, al
je 0x100034fd
mov byte [ebp - 0x229], 1
jmp 0x100034fd
mov edx, ebx
lea ecx, [ebp - 0x228]
call fcn.10003310
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.10008d40
movzx eax, word [ebp - 0x228]
push eax
push dword [ebp - 0x224]
lea eax, [ebp - 0x214]
push eax
call fcn.10004a20
movzx eax, word [ebp - 0x228]
add esp, 0x18
add eax, 2
mov edx, edi
push eax
lea eax, [ebp - 0x214]
push eax
push 1
push str.ImagePath
call fcn.10003270
mov esi, eax
test esi, esi
js 0x100035d7
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.10008d40
push edi
push str.RegistryMachineSystemCurrentControlSetServices_s
lea eax, [ebp - 0x214]
push 0x208
push eax
call section..text
add esp, 0x1c
lea edx, [ebp - 0x214]
lea ecx, [ebp - 0x220]
call fcn.10003310
mov eax, dword [0x1005e000]
test eax, eax
jne 0x100035c5
push str.ZwLoadDriver
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1005e000], eax
test eax, eax
jne 0x100035c5
mov esi, 0xc0000001
jmp 0x100035d0
lea ecx, [ebp - 0x220]
push ecx
call eax
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [ebp - 0x229], 0
je 0x10003612
mov eax, dword [0x1005dffc]
test eax, eax
jne 0x10003609
push str.RtlFreeUnicodeString
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1005dffc], eax
test eax, eax
je 0x10003612
lea ecx, [ebp - 0x228]
push ecx
call eax
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10004869
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
mov eax, 0xc000000d
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004869
mov esp, ebp
pop ebp
ret 4