Function at 0x403860
Capabilities:
Create process on windows
Hide graphical window
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43300e
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x446050]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
push esi
push edi
mov eax, dword [0x446050]
xor eax, esp
push eax
lea eax, [esp + 0xa8]
mov dword fs:[0], eax
xor eax, eax
mov ebx, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x9c], 0xf
mov dword [esp + 0x98], eax
mov byte [esp + 0x88], al
mov dword [esp + 0xb0], eax
mov esi, 0x10
cmp dword [ebx + 0x3c], esi
jb 0x4038db
mov eax, dword [ebx + 0x28]
jmp 0x4038de
lea eax, [ebx + 0x28]
push eax
push ecx
push str.Attempting_to__s__s
call fcn.0040d8e0
mov ecx, dword [ebx + 0xbc]
sub ecx, dword [ebx + 0xb8]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add esp, 0xc
add eax, edx
je 0x403b6d
mov ecx, dword [0x44a6ec]
push 0x4364e7
push 0x41e
push ecx
mov byte [0x44a704], 0
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov edx, dword [0x44a6ec]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x4b
push 0
push 0x40a
push 0x3eb
push edx
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x44a6ec]
push 0
push 0x3eb
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
mov ecx, dword [0x44a6ec]
push 0
push 0x41e
push ecx
call esi
push eax
call edi
mov edx, dword [0x44a6ec]
push 1
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebx + 0xbc]
sub ecx, dword [ebx + 0xb8]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
mov eax, 0x436acc
je 0x4039bc
mov eax, str.s_are
push eax
push str.The_following_required_file_s_not_present_in_the_installation_folder:_r_n_r_n
lea ecx, [esp + 0x28]
call fcn.004172c0
add esp, 8
mov byte [esp + 0xb0], 1
push 0xffffffffffffffff
xor edi, edi
push edi
push eax
lea ecx, [esp + 0x90]
call fcn.004096e0
mov byte [esp + 0xb0], 0
cmp dword [esp + 0x38], 0x10
jb 0x403a04
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0042019e
add esp, 4
mov ecx, dword [ebx + 0xbc]
sub ecx, dword [ebx + 0xb8]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], edi
mov byte [esp + 0x24], 0
je 0x403ad2
mov dword [esp + 0x18], edi
mov edi, edi
push 1
push 0x436b24
lea eax, [esp + 0x8c]
call fcn.004095d0
mov ecx, dword [ebx + 0xbc]
sub ecx, dword [ebx + 0xb8]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp edi, ecx
jb 0x403a7b
call fcn.00420164
mov eax, dword [ebx + 0xb8]
add eax, dword [esp + 0x18]
push 0
push eax
or eax, 0xffffffff
lea esi, [esp + 0x8c]
call fcn.00409d20
push 2
push 0x436b28
mov eax, esi
call fcn.004095d0
mov ecx, dword [ebx + 0xbc]
sub ecx, dword [ebx + 0xb8]
add dword [esp + 0x18], 0x1c
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
cmp edi, eax
jb 0x403a40
cmp dword [esp + 0x9c], 0x10
mov eax, dword [esp + 0x88]
jae 0x403aea
lea eax, [esp + 0x88]
push eax
push 0x4364e4
mov edi, 2
call fcn.0040d7c0
mov esi, 0x10
add esp, 8
cmp dword [ebx + 0x3c], esi
jb 0x403b0c
mov ebx, dword [ebx + 0x28]
jmp 0x403b0f
add ebx, 0x28
mov ecx, dword [esp + 0x88]
cmp dword [esp + 0x9c], esi
jae 0x403b26
lea ecx, [esp + 0x88]
mov edx, dword [0x448730]
push 0
push ebx
push 0x30
push edx
mov edi, 0x436b2c
call fcn.0041a340
add esp, 0x10
mov dword [esp + 0xb0], 0xffffffff
cmp dword [esp + 0x9c], esi
jb 0x403b63
mov eax, dword [esp + 0x88]
push eax
call fcn.0042019e
add esp, 4
mov eax, 2
jmp 0x4042cc
cmp dword [ebx + 0x3c], esi
jb 0x403b77
mov eax, dword [ebx + 0x28]
jmp 0x403b7a
lea eax, [ebx + 0x28]
push eax
push str.Domain_Time_Server
call fcn.0041f9ca
add esp, 8
test eax, eax
je 0x403bab
cmp dword [ebx + 0x3c], esi
jb 0x403b96
mov eax, dword [ebx + 0x28]
jmp 0x403b99
lea eax, [ebx + 0x28]
push eax
push str.Domain_Time_Client
call fcn.0041f9ca
add esp, 8
test eax, eax
jne 0x403bed
cmp dword [ebx + 0x3c], esi
jb 0x403bb5
mov eax, dword [ebx + 0x28]
jmp 0x403bb8
lea eax, [ebx + 0x28]
push eax
push str.Killing_CPL_for__s
call fcn.0040d8e0
add esp, 8
push 1
mov esi, str.domtime_cpl_all_shutdown_event
xor edi, edi
call fcn.004125c0
mov esi, eax
test esi, esi
je 0x403bed
cmp esi, 0xffffffff
je 0x403bed
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push str.advapi32.dll
mov dword [esp + 0x40], vtable.CServiceControl.0
mov dword [esp + 0x44], 0x2710
mov dword [esp + 0x48], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, edi
je 0x403c22
push str.ControlServiceExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x44], eax
mov byte [esp + 0xb0], 2
mov esi, 0x10
mov dword [esp + 0x14], 1
cmp dword [ebx + 0x3c], esi
jb 0x403c41
mov eax, dword [ebx + 0x28]
jmp 0x403c44
lea eax, [ebx + 0x28]
lea ecx, [esp + 0x14]
push ecx
push eax
call fcn.00414a50
test eax, eax
jne 0x403ca2
cmp dword [esp + 0x14], 4
jne 0x403ca2
cmp dword [ebx + 0x3c], esi
jb 0x403c64
mov eax, dword [ebx + 0x28]
jmp 0x403c67
lea eax, [ebx + 0x28]
push eax
push str.Stopping__s_service
call fcn.0040d8e0
add esp, 8
cmp dword [ebx + 0x3c], esi
jb 0x403c7f
mov eax, dword [ebx + 0x28]
jmp 0x403c82
lea eax, [ebx + 0x28]
push str.DTSetup_preparing_for_service_upgrade
push 0x40040004
push eax
lea edx, [esp + 0x48]
push edx
call fcn.004147f0
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebx + 0x3c], esi
jb 0x403cac
mov eax, dword [ebx + 0x28]
jmp 0x403caf
lea eax, [ebx + 0x28]
push eax
push str.Checking_for_exclusive_access_to__s_files
call fcn.0040d8e0
lea eax, [esp + 0x28]
lea ecx, [ebx + 0x94]
push eax
call fcn.0040dc90
add esp, 0xc
mov byte [esp + 0xb0], 3
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x90]
call fcn.004096e0
mov byte [esp + 0xb0], 2
cmp dword [esp + 0x38], esi
jb 0x403d00
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0042019e
add esp, 4
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], edi
mov byte [esp + 0x24], 0
cmp dword [esp + 0x98], edi
je 0x403f3f
mov eax, dword [esp + 0x88]
cmp dword [esp + 0x9c], esi
jae 0x403d35
lea eax, [esp + 0x88]
push eax
push str.Cannot_get_exclusive_access_to__s
mov edi, 0x20
call fcn.0040d7c0
mov edx, dword [0x44a6ec]
add esp, 8
push 0x4364e7
push 0x41e
push edx
mov byte [0x44a704], 0
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov eax, dword [0x44a6ec]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x4b
push 0
push 0x40a
push 0x3eb
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x44a6ec]
push 0
push 0x3eb
push ecx
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
mov edx, dword [0x44a6ec]
push 0
push 0x41e
push edx
call esi
push eax
call edi
mov eax, dword [0x44a6ec]
push 1
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x26
push str.Setup_cannot_gain_exclusive_access_to
lea eax, [esp + 0x8c]
call fcn.004097c0
push 0x199
push str.._The_file_is_locked_open__either_because_you_are_currently_using_it_or_because_a_system_program_such_as_Event_Viewer_or_WMI_has_a_portion_of_the_file_mapped._r_n_r_nYou_may_proceed_with_the_operation__but_you_will_probably_have_to_reboot_your_machine_afterward._To_avoid_a_reboot__you_may_try_logging_out_and_back_in__then_trying_again._This_sometimes_clears_the_locked_file._r_n_r_nDo_you_want_to_continue_with_the
lea eax, [esp + 0x8c]
call fcn.004095d0
mov edi, dword [esp + 0x1c]
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403df5
sub eax, ecx
push eax
push edi
lea eax, [esp + 0x8c]
call fcn.004095d0
push 1
push 0x436dcc
lea eax, [esp + 0x8c]
call fcn.004095d0
mov ecx, 0x10
cmp dword [ebx + 0x3c], ecx
jb 0x403e2e
mov eax, dword [ebx + 0x28]
jmp 0x403e31
lea eax, [ebx + 0x28]
cmp dword [esp + 0x9c], ecx
mov ecx, dword [esp + 0x88]
jae 0x403e48
lea ecx, [esp + 0x88]
mov edx, dword [0x448730]
push 0
push eax
push 0x24
push edx
mov edi, 0x436b2c
call fcn.0041a340
add esp, 0x10
cmp eax, 7
jne 0x403ec5
cmp dword [esp + 0x14], 4
jne 0x403e86
cmp dword [ebx + 0x3c], 0x10
jb 0x403e78
mov ebx, dword [ebx + 0x28]
jmp 0x403e7b
add ebx, 0x28
push ebx
lea eax, [esp + 0x40]
push eax
call fcn.00414680
mov byte [esp + 0xb0], 0
mov dword [esp + 0x3c], vtable.CServiceControl.0
mov dword [esp + 0xb0], 0xffffffff
cmp dword [esp + 0x9c], 0x10
jb 0x403ebb
mov ecx, dword [esp + 0x88]
push ecx
call fcn.0042019e
add esp, 4
mov eax, 0x20
jmp 0x4042cc
mov edx, dword [0x44a6ec]
push 0x4364e7
push 0x41e
push edx
mov byte [0x44a704], 1
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov eax, dword [0x44a6ec]
push 0x4b
push 0
push 0x40a
push 0x3eb
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x44a6ec]
push 0
push 0x3eb
push ecx
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
mov edx, dword [0x44a6ec]
push 0
push 0x41e
push edx
call esi
push eax
call edi
mov eax, dword [0x44a6ec]
push 0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov esi, 0x10
cmp dword [ebx + 0x1c], 0
je 0x403fe9
mov eax, dword [ebp + 8]
sub eax, 0
je 0x403f97
sub eax, 1
jne 0x403fe9
cmp dword [ebx + 0x20], esi
jb 0x403f64
mov ecx, dword [ebx + 0xc]
jmp 0x403f67
lea ecx, [ebx + 0xc]
lea ebx, [esp + 0x14]
call fcn.00411880
mov esi, eax
test esi, esi
jne 0x403fde
mov ecx, dword [esp + 0x14]
push 5
push str.True
push 1
push eax
push str.Auto_Manage_Firewall
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x14]
push edx
jmp 0x403fd2
cmp dword [ebx + 0x20], esi
jb 0x403fa1
mov ecx, dword [ebx + 0xc]
jmp 0x403fa4
lea ecx, [ebx + 0xc]
lea ebx, [esp + 0x14]
call fcn.00411880
mov esi, eax
test esi, esi
jne 0x403fde
push 6
push str.False
push 1
push eax
mov eax, dword [esp + 0x24]
push str.Auto_Manage_Firewall
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x14]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x403fe5
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [esp + 0x18]
mov esi, 0x10
cmp dword [ebx + 0x3c], esi
jb 0x403ff8
mov eax, dword [ebx + 0x28]
jmp 0x403ffb
lea eax, [ebx + 0x28]
mov edi, dword [esp + 0x1c]
push eax
push edi
push str.Running__s_for__s
call fcn.0040d8e0
add esp, 0xc
cmp dword [ebx + 0x58], esi
jb 0x404018
mov eax, dword [ebx + 0x44]
jmp 0x40401b
lea eax, [ebx + 0x44]
push edi
push eax
push 0x448840
push str._s_s___s__noack__nocpl__vq
lea ecx, [esp + 0x30]
call fcn.004172c0
add esp, 0x10
mov byte [esp + 0xb0], 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x90]
call fcn.004096e0
mov byte [esp + 0xb0], 2
cmp dword [esp + 0x38], esi
jb 0x404067
mov edx, dword [esp + 0x24]
push edx
call fcn.0042019e
add esp, 4
cmp byte [0x449dbe], 0
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
je 0x404098
push 7
push str.__force
lea eax, [esp + 0x8c]
call fcn.004095d0
mov eax, dword [esp + 0x88]
cmp dword [esp + 0x9c], esi
jae 0x4040af
lea eax, [esp + 0x88]
push 1
push eax
call fcn.0040e520
mov edi, eax
mov eax, dword [esp + 0x90]
add esp, 8
test edi, edi
je 0x4040ea
cmp dword [esp + 0x9c], esi
jae 0x4040d7
lea eax, [esp + 0x88]
push eax
push str.Problem_while_executing__s
call fcn.0040d7c0
add esp, 8
jmp 0x404296
cmp dword [esp + 0x9c], esi
jae 0x4040fa
lea eax, [esp + 0x88]
push eax
push str._s_executed_successfully
call fcn.0040d8e0
add esp, 8
cmp dword [ebx + 0x3c], esi
jb 0x404112
mov eax, dword [ebx + 0x28]
jmp 0x404115
lea eax, [ebx + 0x28]
push eax
push str.Domain_Time_Server
call fcn.0041f9ca
add esp, 8
test eax, eax
je 0x40414a
cmp dword [ebx + 0x3c], esi
jb 0x404131
mov eax, dword [ebx + 0x28]
jmp 0x404134
lea eax, [ebx + 0x28]
push eax
push str.Domain_Time_Client
call fcn.0041f9ca
add esp, 8
test eax, eax
jne 0x4041d8
lea eax, [esp + 0x20]
push eax
call fcn.00417a60
mov byte [esp + 0xb0], 5
mov ecx, dword [esp + 0x1c]
push ecx
push 0x4477f0
push 0x4477e0
lea eax, [esp + 0x2c]
call fcn.0040ab00
lea edx, [esp + 0x20]
push edx
push 0x449398
mov ecx, 0x448c60
call fcn.0040c7a0
mov eax, dword [esp + 0x24]
add esp, 8
push eax
push 0x4477f8
push 0x4477f0
lea eax, [esp + 0x2c]
call fcn.0040ab00
lea ecx, [esp + 0x20]
push ecx
push 0x448840
mov ecx, 0x448c60
call fcn.0040c7a0
call fcn.0040ca20
push 1
call fcn.0040bc40
add esp, 0xc
mov byte [esp + 0xb0], 2
lea edx, [esp + 0x20]
push edx
call fcn.00409370
cmp byte [ebx + 1], 0
je 0x404296
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.DomainTimeTrayIcon
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.00411c70
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x404296
cmp byte [ebx], 0
je 0x40428a
lea esi, [esp + 0x20]
call fcn.004025f0
push 0x38
xor esi, esi
lea eax, [esp + 0x50]
push esi
push eax
call fcn.004249d0
add esp, 0xc
mov dword [esp + 0x48], 0x3c
mov dword [esp + 0x4c], esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp byte [esp + 0x20], 0
mov dword [esp + 0x50], eax
mov dword [esp + 0x58], ebx
je 0x40425d
cmp byte [esp + 0x21], 0
mov dword [esp + 0x54], str.runas
jne 0x404265
mov dword [esp + 0x54], str.open
lea ecx, [esp + 0x48]
push ecx
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x40428a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, 0x10
mov byte [esp + 0xb0], 0
mov dword [esp + 0x3c], vtable.CServiceControl.0
mov dword [esp + 0xb0], 0xffffffff
cmp dword [esp + 0x9c], esi
jb 0x4042ca
mov edx, dword [esp + 0x88]
push edx
call fcn.0042019e
add esp, 4
mov eax, edi
mov dword [esp + 0x9c], 0xf
mov dword [esp + 0x98], 0
mov byte [esp + 0x88], 0
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.0041f826
mov esp, ebp
pop ebp
ret 4