Function at 0x10005330
Capabilities:
Check if file exists
Delete registry key
Delete registry value
Delete service
Get common file path
Persist via run registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10024d6f
mov eax, dword fs:[0]
push eax
sub esp, 0xca8
mov eax, dword [0x1002e210]
xor eax, esp
mov dword [esp + 0xca0], eax
push ebx
push esi
push edi
mov eax, dword [0x1002e210]
xor eax, esp
push eax
lea eax, [esp + 0xcb8]
mov dword fs:[0], eax
call fcn.10004730
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000542f
lea ecx, [esp + 0x14]
call fcn.100044b0
push 0x208
lea eax, [esp + 0x80]
push 0
push eax
mov dword [esp + 0xccc], 0
call fcn.10016010
mov ecx, dword [esp + 0x20]
add esp, 0xc
push ecx
push str._sSoftMgr360cfzz.dll
mov ecx, 0x104
lea ebx, [esp + 0x84]
call fcn.100099c0
add esp, 8
mov edx, ebx
push edx
call edi
test eax, eax
je 0x10005404
mov eax, ebx
push eax
call fcn.10009750
add esp, 4
test eax, eax
je 0x10005404
push str.cfzz_002
mov ecx, ebx
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10005404
push 1
call eax
add esp, 4
mov dword [esp + 0xcc0], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000542f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esi, [esp + 0x38]
call fcn.1000bb00
push 0x208
lea ecx, [esp + 0x8a0]
push 0
push ecx
mov dword [esp + 0xccc], 1
call fcn.10016010
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x28e]
push eax
mov word [esp + 0x290], dx
call fcn.10016010
add esp, 0xc
push 0x20
push str.BQAGAFMAEAAFABUATQBKAAgAAACSAA
lea esi, [esp + 0x28c]
call fcn.10005f30
mov edx, dword [esp + 0x38]
mov ecx, esi
push ecx
push edx
push str._sSoftMgr_s
mov ecx, 0x104
lea ebx, [esp + 0x8a8]
call fcn.100099c0
add esp, 0xc
mov eax, ebx
push eax
call edi
test eax, eax
je 0x100054d2
mov ecx, ebx
push ecx
call fcn.10009750
add esp, 4
test eax, eax
je 0x100054d2
mov ebx, 4
mov ecx, esi
call fcn.10006000
push 0x208
xor ebx, ebx
lea edx, [esp + 0x490]
push ebx
push edx
call fcn.10016010
add esp, 0xc
lea eax, [esp + 0x3c]
push eax
call fcn.10007330
push 0x104
lea ecx, [esp + 0x490]
push ecx
mov byte [esp + 0xcc8], 2
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edi, [esp + 0x10]
lea esi, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
call fcn.1000bb80
push 0x208
lea edx, [esp + 0x698]
push ebx
push edx
call fcn.10016010
add esp, 0xc
cmp dword [esp + 0x14], 6
lea ebx, [esp + 0x694]
jb 0x10005558
movzx eax, word [esp + 0x48c]
push eax
push str._C:Users
jmp 0x10005566
movzx ecx, word [esp + 0x48c]
push ecx
push str._C:Documents_and_Settings
mov ecx, 0x104
call fcn.100099c0
add esp, 8
lea edx, [esp + 0x694]
push edx
lea ecx, [esp + 0x40]
call fcn.10006790
lea eax, [esp + 0x54]
push eax
call fcn.10007330
mov byte [esp + 0xcc0], 3
mov esi, dword [esp + 0x4c]
sub esi, dword [esp + 0x48]
xor edi, edi
sar esi, 2
test esi, esi
jbe 0x100055ff
push 0x208
lea ecx, [esp + 0x80]
push 0
push ecx
call fcn.10016010
add esp, 0xc
cmp edi, esi
jb 0x100055c7
call fcn.1001516c
mov edx, dword [esp + 0x48]
mov eax, dword [edx + edi*4]
push eax
push str._sRunHelper60safe.lnk
mov ecx, 0x104
lea ebx, [esp + 0x84]
call fcn.100099c0
add esp, 8
mov ecx, ebx
call fcn.100098d0
mov esi, dword [esp + 0x4c]
sub esi, dword [esp + 0x48]
inc edi
sar esi, 2
cmp edi, esi
jb 0x100055a7
push 4
call fcn.1001444c
xor edi, edi
add esp, 4
cmp eax, edi
je 0x10005617
lea ecx, [esp + 0x18]
mov dword [eax], ecx
jmp 0x10005619
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
lea edx, [esp + 0x10]
mov bl, 5
push edx
mov ecx, str.txRepairaafe
mov byte [esp + 0xcc4], bl
call fcn.1000a1c0
mov byte [esp + 0xcc0], 6
mov edx, dword [esp + 0x24]
cmp edx, edi
jne 0x10005655
xor ecx, ecx
jmp 0x1000565e
mov ecx, dword [esp + 0x2c]
sub ecx, edx
sar ecx, 2
mov eax, dword [esp + 0x28]
mov esi, eax
sub esi, edx
sar esi, 2
cmp esi, ecx
mov esi, eax
jae 0x10005697
mov edx, dword [esp + 0x30]
mov byte [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
push ecx
push edx
lea ecx, [esp + 0x18]
push ecx
push 1
push eax
call fcn.10008730
add esp, 0x14
add esi, 4
mov dword [esp + 0x28], esi
jmp 0x100056b9
cmp edx, eax
jbe 0x100056a0
call fcn.1001516c
mov eax, dword [esp + 0x18]
push esi
push eax
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x28]
call fcn.10007af0
mov byte [esp + 0xcc0], bl
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100056e0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.Fix360SafeService
call fcn.1000a1c0
mov byte [esp + 0xcc0], 7
mov edx, dword [esp + 0x24]
cmp edx, edi
jne 0x10005703
xor ecx, ecx
jmp 0x1000570c
mov ecx, dword [esp + 0x2c]
sub ecx, edx
sar ecx, 2
mov eax, dword [esp + 0x28]
mov esi, eax
sub esi, edx
sar esi, 2
cmp esi, ecx
mov esi, eax
jae 0x10005745
mov ecx, dword [esp + 0x30]
mov byte [esp + 0x14], 0
mov edx, dword [esp + 0x14]
push edx
push ecx
lea edx, [esp + 0x18]
push edx
push 1
push eax
call fcn.10008730
add esp, 0x14
add esi, 4
mov dword [esp + 0x28], esi
jmp 0x10005767
cmp edx, eax
jbe 0x1000574e
call fcn.1001516c
mov eax, dword [esp + 0x18]
push esi
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea eax, [esp + 0x28]
call fcn.10007af0
mov byte [esp + 0xcc0], bl
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000578e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.Fix360Service
call fcn.1000a1c0
mov byte [esp + 0xcc0], 8
mov edx, dword [esp + 0x24]
cmp edx, edi
jne 0x100057b1
xor ecx, ecx
jmp 0x100057ba
mov ecx, dword [esp + 0x2c]
sub ecx, edx
sar ecx, 2
mov eax, dword [esp + 0x28]
mov esi, eax
sub esi, edx
sar esi, 2
cmp esi, ecx
mov esi, eax
jae 0x100057f3
mov ecx, dword [esp + 0x30]
mov byte [esp + 0x14], 0
mov edx, dword [esp + 0x14]
push edx
push ecx
lea edx, [esp + 0x18]
push edx
push 1
push eax
call fcn.10008730
add esp, 0x14
add esi, 4
mov dword [esp + 0x28], esi
jmp 0x10005815
cmp edx, eax
jbe 0x100057fc
call fcn.1001516c
mov eax, dword [esp + 0x18]
push esi
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea eax, [esp + 0x28]
call fcn.10007af0
mov byte [esp + 0xcc0], bl
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000583c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.360FixService
call fcn.1000a1c0
mov byte [esp + 0xcc0], 9
mov edx, dword [esp + 0x24]
cmp edx, edi
jne 0x1000585f
xor ecx, ecx
jmp 0x10005868
mov ecx, dword [esp + 0x2c]
sub ecx, edx
sar ecx, 2
mov eax, dword [esp + 0x28]
mov esi, eax
sub esi, edx
sar esi, 2
cmp esi, ecx
mov esi, eax
jae 0x100058a1
mov ecx, dword [esp + 0x30]
mov byte [esp + 0x14], 0
mov edx, dword [esp + 0x14]
push edx
push ecx
lea edx, [esp + 0x18]
push edx
push 1
push eax
call fcn.10008730
add esp, 0x14
add esi, 4
mov dword [esp + 0x28], esi
jmp 0x100058c3
cmp edx, eax
jbe 0x100058aa
call fcn.1001516c
mov eax, dword [esp + 0x18]
push esi
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea eax, [esp + 0x28]
call fcn.10007af0
mov byte [esp + 0xcc0], bl
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100058ea
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.360FixSafe
call fcn.1000a1c0
mov byte [esp + 0xcc0], 0xa
mov edx, dword [esp + 0x24]
cmp edx, edi
jne 0x1000590d
xor ecx, ecx
jmp 0x10005916
mov ecx, dword [esp + 0x2c]
sub ecx, edx
sar ecx, 2
mov eax, dword [esp + 0x28]
mov esi, eax
sub esi, edx
sar esi, 2
cmp esi, ecx
mov esi, eax
jae 0x1000594f
mov ecx, dword [esp + 0x30]
mov byte [esp + 0x14], 0
mov edx, dword [esp + 0x14]
push edx
push ecx
lea edx, [esp + 0x18]
push edx
push 1
push eax
call fcn.10008730
add esp, 0x14
add esi, 4
mov dword [esp + 0x28], esi
jmp 0x10005971
cmp edx, eax
jbe 0x10005958
call fcn.1001516c
mov eax, dword [esp + 0x18]
push esi
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea eax, [esp + 0x28]
call fcn.10007af0
mov byte [esp + 0xcc0], bl
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10005998
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.FixSafeService
call fcn.1000a1c0
mov byte [esp + 0xcc0], 0xb
mov edx, dword [esp + 0x24]
cmp edx, edi
jne 0x100059bb
xor ecx, ecx
jmp 0x100059c4
mov ecx, dword [esp + 0x2c]
sub ecx, edx
sar ecx, 2
mov eax, dword [esp + 0x28]
mov esi, eax
sub esi, edx
sar esi, 2
cmp esi, ecx
mov esi, eax
jae 0x100059fd
mov ecx, dword [esp + 0x30]
mov byte [esp + 0x14], 0
mov edx, dword [esp + 0x14]
push edx
push ecx
lea edx, [esp + 0x18]
push edx
push 1
push eax
call fcn.10008730
add esp, 0x14
add esi, 4
mov dword [esp + 0x28], esi
jmp 0x10005a1f
cmp edx, eax
jbe 0x10005a06
call fcn.1001516c
mov eax, dword [esp + 0x18]
push esi
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea eax, [esp + 0x28]
call fcn.10007af0
mov byte [esp + 0xcc0], bl
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10005a46
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.RepairSafezage
call fcn.1000a1c0
mov byte [esp + 0xcc0], 0xc
mov edx, dword [esp + 0x24]
cmp edx, edi
jne 0x10005a69
xor ecx, ecx
jmp 0x10005a72
mov ecx, dword [esp + 0x2c]
sub ecx, edx
sar ecx, 2
mov eax, dword [esp + 0x28]
mov esi, eax
sub esi, edx
sar esi, 2
cmp esi, ecx
mov esi, eax
jae 0x10005aab
mov ecx, dword [esp + 0x30]
mov byte [esp + 0x14], 0
mov edx, dword [esp + 0x14]
push edx
push ecx
lea edx, [esp + 0x18]
push edx
push 1
push eax
call fcn.10008730
add esp, 0x14
add esi, 4
mov dword [esp + 0x28], esi
jmp 0x10005acd
cmp edx, eax
jbe 0x10005ab4
call fcn.1001516c
mov eax, dword [esp + 0x18]
push esi
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea eax, [esp + 0x28]
call fcn.10007af0
mov byte [esp + 0xcc0], bl
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10005af4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x24]
xor esi, esi
sar eax, 2
cmp eax, edi
jbe 0x10005bf3
cmp esi, eax
jb 0x10005b12
call fcn.1001516c
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + esi*4]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x10005b71
push 0xf01ff
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x10005b62
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x10005b52
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10005b77
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10005b77
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x86]
push eax
mov word [esp + 0x88], dx
call fcn.10016010
mov ecx, dword [esp + 0x34]
sub ecx, dword [esp + 0x30]
add esp, 0xc
sar ecx, 2
cmp esi, ecx
jb 0x10005bab
call fcn.1001516c
mov edx, dword [esp + 0x24]
mov eax, dword [edx + esi*4]
push eax
push str.SYSTEMCurrentControlSet_services
push str._s_s
mov ecx, 0x104
lea ebx, [esp + 0x88]
call fcn.100099c0
add esp, 0xc
mov ecx, ebx
push ecx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x24]
inc esi
sar eax, 2
cmp esi, eax
jb 0x10005b12
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [esp + 0x6c], str.Rep36Osafes
mov dword [esp + 0x70], str.Rep36OFixsafe
mov dword [esp + 0x74], str.Rep36OFixsafe1
mov dword [esp + 0x78], str.36OFix_360safe
xor edi, edi
jmp 0x10005c20
mov esi, dword [esp + edi*4 + 0x6c]
lea edx, [esp + 0x10]
push edx
push 3
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call ebx
test eax, eax
jne 0x10005ca2
push 0x206
push eax
lea ecx, [esp + 0xaae]
push ecx
mov word [esp + 0xab0], ax
call fcn.10016010
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0xaa8]
push eax
push 0
push 0
push esi
push ecx
mov dword [esp + 0x48], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10005c8b
mov edx, dword [esp + 0x10]
push edx
jmp 0x10005c9c
mov eax, dword [esp + 0x10]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
cmp edi, 4
jb 0x10005c20
call fcn.100013c0
mov byte [esp + 0xcc0], 3
mov esi, dword [esp + 0x24]
xor ebx, ebx
cmp esi, ebx
je 0x10005d02
mov eax, dword [esp + 0x28]
mov edi, eax
cmp esi, eax
je 0x10005cf9
lea ecx, [ecx]
mov eax, dword [esi]
sub eax, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10005cee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 4
cmp esi, edi
jne 0x10005cd0
mov esi, dword [esp + 0x24]
push esi
call fcn.10014417
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.10014417
mov byte [esp + 0xcc4], 2
mov esi, dword [esp + 0x64]
add esp, 4
cmp esi, ebx
je 0x10005d67
mov eax, dword [esp + 0x64]
mov edi, eax
cmp esi, eax
je 0x10005d5e
mov eax, dword [esi]
sub eax, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10005d53
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 4
cmp esi, edi
jne 0x10005d35
mov esi, dword [esp + 0x60]
push esi
call fcn.10014417
add esp, 4
mov ecx, dword [esp + 0x54]
push ecx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
call fcn.10014417
mov byte [esp + 0xcc4], 1
mov esi, dword [esp + 0x4c]
add esp, 4
cmp esi, ebx
je 0x10005dd2
mov eax, dword [esp + 0x4c]
mov edi, eax
cmp esi, eax
je 0x10005dc9
lea ebx, [ebx]
mov eax, dword [esi]
sub eax, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10005dbe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 4
cmp esi, edi
jne 0x10005da0
mov esi, dword [esp + 0x48]
push esi
call fcn.10014417
add esp, 4
mov ecx, dword [esp + 0x3c]
push ecx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
call fcn.10014417
mov dword [esp + 0xcc4], 0xffffffff
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10005e16
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0xcb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xca0]
xor ecx, esp
call fcn.10014422
mov esp, ebp
pop ebp
ret