Function at 0x437070
Capabilities:
Delete registry value
Delete service
Persist via run registry key
Query service status
Stop service

Disassembly:
mov eax, dword [0x480160]
sub esp, 0x24
dec eax
push ebx
push ebp
push esi
push edi
je 0x437273
dec eax
jne 0x437341
lea eax, [esp + 0x10]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
test eax, eax
jne 0x4370e4
mov ecx, dword [str.WinVNC]
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ebx, dword [esp + 0x38]
test eax, eax
je 0x4370d7
test ebx, ebx
jne 0x4370d7
mov eax, dword [str.WinVNC]
push 0x30
push eax
push 0x480ab8
push ebx
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4370e8
mov ebx, dword [esp + 0x38]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
je 0x437250
push 0xf01ff
push str.winvnc
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x43722b
lea edx, [esp + 0x18]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x437188
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [esp + 0x18]
push eax
push esi
call edi
test eax, eax
je 0x437168
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x1c], 3
jne 0x437164
push 0x3e8
call ebx
lea ecx, [esp + 0x18]
push ecx
push esi
call edi
test eax, eax
jne 0x43714a
mov ebx, dword [esp + 0x38]
cmp dword [esp + 0x1c], 1
je 0x437184
test ebx, ebx
jne 0x437184
mov edx, dword [str.WinVNC]
push 0x30
push edx
push 0x480520
push ebx
call ebp
mov edi, dword [esp + 0x14]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x4371c4
test ebx, ebx
jne 0x437213
mov eax, dword [str.WinVNC]
push 0x40
push eax
push 0x481198
call fcn.00438320
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
jne 0x4371fe
test ebx, ebx
jne 0x437213
mov ecx, dword [str.WinVNC]
push 0x30
push ecx
push 0x480630
push ebx
call ebp
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
test ebx, ebx
jne 0x437213
mov edx, dword [str.WinVNC]
push 0x30
push edx
push 0x4805b0
push ebx
call ebp
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
test ebx, ebx
jne 0x43723f
mov eax, dword [str.WinVNC]
push 0x30
push eax
push 0x481258
push ebx
call ebp
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
test ebx, ebx
jne 0x437341
mov ecx, dword [str.WinVNC]
push 0x30
push ecx
push 0x4803e0
push ebx
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
lea edx, [esp + 0x10]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4372fb
mov esi, dword [esp + 0x38]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
test esi, esi
jne 0x4372ab
mov eax, dword [str.WinVNC]
push 0x30
push eax
push 0x4803e0
push 0
call edi
call fcn.00436870
test eax, eax
jne 0x4372d7
test esi, esi
jne 0x437341
mov ecx, dword [str.WinVNC]
push 0x30
push ecx
push 0x480210
push esi
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
test esi, esi
jne 0x437341
mov edx, dword [str.WinVNC]
push 0x40
push edx
push 0x481198
call fcn.00438320
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov eax, dword [str.WinVNC]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x43733a
mov edx, dword [esp + 0x10]
push edx
call esi
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x43733a
mov eax, dword [str.WinVNC]
push 0x30
push eax
push 0x4805b0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x10]
push ecx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret