Function at 0x425ef0
Capabilities:
Delete registry value
Delete service
Persist via run registry key
Query service status
Stop service

Disassembly:
mov eax, dword [0x43440c]
sub esp, 0x24
dec eax
push ebx
push ebp
push esi
push edi
je 0x426091
dec eax
jne 0x42613a
lea eax, [esp + 0x10]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
test eax, eax
jne 0x425f5c
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 0x10]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x425f51
push 0x30
push 0x4313d8
push 0x4339d8
push 0
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x14], ebx
je 0x426077
push 0xf01ff
push str.WiseNetbladeIf
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x426056
lea eax, [esp + 0x18]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x425ff3
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea ecx, [esp + 0x18]
push ecx
push esi
call edi
test eax, eax
je 0x425fdc
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x1c], 3
jne 0x425fd8
push 0x3e8
call ebx
lea edx, [esp + 0x18]
push edx
push esi
call edi
test eax, eax
jne 0x425fbe
mov ebx, dword [esp + 0x14]
cmp dword [esp + 0x1c], 1
je 0x425ff3
push 0x30
push 0x4313d8
push 0x4339bc
push 0
call ebp
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x42602a
push 0x40
push 0x4313d8
push 0x4339a0
call fcn.00426710
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
push 0x30
push 0x4313d8
push 0x433984
call fcn.00426710
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
push 0x30
push 0x4313d8
push 0x433968
push 0
call ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
push 0x30
push 0x4313d8
push 0x43393c
push 0
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
lea eax, [esp + 0x10]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4260c2
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x30
push 0x4313d8
push 0x43390c
push 0
call esi
jmp 0x426104
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 0x10]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4260fd
mov edx, dword [esp + 0x10]
push edx
call edi
push 0x30
push 0x4313d8
push 0x433984
push 0
call esi
mov eax, dword [esp + 0x10]
push eax
call edi
call fcn.00425990
test eax, eax
jne 0x426126
push 0x30
push 0x4313d8
push 0x4338f0
push eax
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
push 0x40
push 0x4313d8
push 0x4339a0
call fcn.00426710
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret