Function at 0x45b880
Capabilities:
Create service
Get common file path
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
je 0x45c3d9
test byte [eax + 0xb], dl
add byte [eax], al
jne 0x45c3d9
push 0xb120c0
push 0xaff76c
mov eax, dword [0x43c7a0]
push 0x697f1e7c
movsx ecx, byte [ebp + 0x2c]
in al, 0x12
and eax, 0x6ef5c02
dec ebp
cli
push esi
je 0x45bf04
jne 0x45bf04
push 0xb3e038
mov ebx, dword [0x1001f078]
mov dword [0x4a7f60], eax
cmp ch, byte [esi - 0x51b2eec8]
lea ecx, [eax + 0x808]
pop esi
jecxz 0x45b884
pushfd
outsb dx, byte [esi]
mov dh, byte [ecx + 0x37]
in al, 0x91
pop esp
scasd eax, dword es:[edi]
lea ecx, [ebp - 0x240]
call fcn.004249d0
lea ecx, [ebp - 0x244]
push 0x45c512
ret
push 0x46fe4e
push 0x45cf01
ret
mov edx, dword [ebp - 0x24c]
add edx, 0xfffffff0
or esi, 0xffffffff
mov byte [ebp - 4], 3
lea ecx, [edx + 0xc]
mov eax, esi
push 0x45ba8f
ret
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
jmp 0x45ca37
in al, dx
mov ecx, 0x109f9e0
push 0x697e0c30
pushal
iretd
push 0xffffffffffffffff
je 0x45b9e9
jne 0x45b9e9
and dword [ebp - 0x40], 0xfffffffd
push 0x10510a78
mov dword [0x477ebc], ecx
cmp esi, 0x52
mov eax, 0xf6b330
mov dword [0x11540824], eax
jl 0x45c3a0
jp 0x45c3a0
mov edx, 0xa15d73ca
push ebx
push ebx
push dword [ebp - 0x234]
push ebx
push 2
push 0x10
push 0x12
push eax
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
push 0x45cf57
ret
mov dword [ebp - 0x10], esp
jmp 0x45d10f
push 0x522358
jmp 0x45cfcd
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
jmp 0x45d009
push eax
mov byte [ebp - 4], 3
call fcn.0044b5e0
add esp, 8
mov eax, dword [ebp - 0x234]
mov byte [ebp - 4], 4
je 0x45d24b
jne 0x45d24b
mov eax, 0x1058c4f4
push 0x1fff
push 0x697b62a8
jp 0x45d012
invalid
test eax, eax
je 0x45d2f9
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x248]
je 0x45d1b8
test esp, edx
std
invalid
jne 0x45d1b8
push 0x11479000
lea ebx, [eax + 3]
mov ecx, dword [0x1153e3c8]
or al, 0xe2
invalid
xor eax, eax
push 0x206
push eax
mov word [ebp - reloc.winhttp.dll_WinHttpCrackUrl], ax
lea eax, [ebp - 0x22a]
push eax
mov dword [ebp - 4], 0
call fcn.00462a40
jmp 0x45d655
call fcn.00423fd0
mov eax, dword [0x5239c0]
mov ecx, 0x5239c0
mov byte [ebp - 4], 1
call dword [eax + 0xc]
add eax, 0x10
jmp 0x45d780
cmp dword [eax - 0xc], 0
je 0x45bcd4
mov eax, dword [ebp - 0x24c]
cmp dword [eax - 0xc], 0
push 0x45c139
ret
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
je 0x45d49b
jne 0x45d49b
mov dword [0x4639b0], eax
mov dword [0x112b3f78], ecx
push 0x46de3c
push 0x4874a8
cmp word [0x4571a8], si
mov byte [0xcee87d], dl
mov byte [ebp + 0xd], bl
mov ebx, dword [0x100b238c]
mov dword [ebp - 0x24], esi
push 0x1143a690
mov eax, dword [0xe4b3e0]
lea ebx, [ebp + ebx*4]
inc ebx
daa
inc edx
retf
xor ecx, ebp
push 0x45c16b
ret
add esp, 0xc
lea eax, [ebp - 0x22c]
push 0
push 0x1a
push eax
je 0x45cc79
jne 0x45cc79
mov eax, 0xfffffffe
sbb edx, dword [esi + 0x3c]
mov dword [0xda9ab4], eax
add ax, 0x30
cmp byte [edx + 0x28], bl
shr byte [ebp - 0x5219ff89], 1
and esi, 2
mov eax, 0x102c93e0
mov dword [edx + 0x48], eax
push 0x100e3e58
push eax
stc
rcl ebp, 0x45
push ebx
push ebx
je 0x45c40c
jne 0x45c40c
add byte [esi + ebp*4 - 0x5173ffbf], dl
push 0x100f0464
push 0xb0f560
push 0xa76d34
cmp dword [0xdbd5e8], 0
mov dword [0x4b1aac], eax
test byte [0xf190043], 0x43
call dword [0x1001c134]
mov ah, 0xe8
push 0x6307a160
push 0x4f16a4
mov esi, dword [ebp - 0x414]
sub ah, byte [ecx + 0xff0495c]
sal dword [eax], 0x4e
push 0x45d4cd
ret
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x234]
push 0x522310
push eax
mov byte [ebp - 4], 2
call fcn.0044b5e0
add esp, 8
lea eax, [ebp - 0x24c]
jmp 0x45cc58