Function at 0x10049aff
Capabilities:
Delete registry value
Get geographical location
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
mov dword [ebp - 0xfc], 0xffffffff
mov dword [ebp - 0x124], 0xedcad208
mov dword [ebp - 0xc4], 0xc9e53e58
mov dword [ebp - 0x188], 1
mov dword [ebp - 0x168], 0xfffffff9
mov dword [ebp - 0x1c], 0xc8ddac0f
mov dword [ebp - 0x5c], 0xa1434a93
mov dword [ebp - 0x11c], 7
mov dword [ebp - 4], 0
jmp 0x10049b62
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x10049b78
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x130], 0x7d2703d9
jmp 0x10049b5b
mov dword [ebp - 4], 0
jmp 0x10049b88
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x10049b9e
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x174], 0xab72b21a
jmp 0x10049b81
mov dword [ebp - 4], 0
jmp 0x10049bae
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x10049bc4
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1bc], 0xfffffff6
jmp 0x10049ba7
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x1c], ecx
test eax, eax
je 0x10049bf3
mov eax, 0x9e22401d
test eax, eax
je 0x10049bf3
mov dword [ebp - 0xb8], 1
jmp 0x10049bfa
and dword [ebp - 0xb8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x130]
cmp dword [ebp - 0xb8], eax
jne 0x10049c18
mov dword [ebp - 0x70], 1
jmp 0x10049c1c
and dword [ebp - 0x70], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 6
je 0x10049c31
mov dword [ebp - 0x74], 1
jmp 0x10049c35
and dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 0x52a2
jle 0x10049c4a
mov dword [ebp - 0xb4], 1
jmp 0x10049c51
and dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0xb4]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x174]
jge 0x10049c72
mov dword [ebp - 0x7c], 1
jmp 0x10049c76
and dword [ebp - 0x7c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x130]
cmp dword [ebp - 0x7c], eax
jge 0x10049c94
mov dword [ebp - 0xa4], 1
jmp 0x10049c9b
and dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x1c], 0
jmp 0x10049cb7
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x21
jl 0x10049e46
mov dword [ebp - 0x40], 8
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x9c], 0xffffffff
mov dword [ebp - 0x54], 0
jmp 0x10049cec
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x10049d02
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x1cc], 0x9cbadbef
jmp 0x10049ce5
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x40], eax
jl 0x10049d16
mov dword [ebp - 0x84], 1
jmp 0x10049d1d
and dword [ebp - 0x84], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x84], eax
jne 0x10049d37
mov dword [ebp - 0x94], 1
jmp 0x10049d3e
and dword [ebp - 0x94], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x11c], eax
jge 0x10049d58
mov dword [ebp - 0x8c], 1
jmp 0x10049d5f
and dword [ebp - 0x8c], 0
cmp dword [ebp - 0x8c], 1
jne 0x10049d74
mov dword [ebp - 0xac], 1
jmp 0x10049d7b
and dword [ebp - 0xac], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0xac]
mov dword [ebp - 0xbc], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xbc]
mov dword [ebp + eax - 0x1cc], ecx
mov eax, dword [ebp - 0x94]
imul eax, dword [ebp - 0xbc]
test eax, eax
jle 0x10049e38
mov dword [ebp - 0x190], 1
mov dword [ebp - 0x13c], 2
mov dword [ebp - 0x178], 0xffffffff
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x180], 0xe85dc32c
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x134], 8
mov dword [ebp - 0x154], 0x7655
mov dword [ebp - 0x50], 0
jmp 0x10049e13
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x10049e29
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x184], 0xc0f4fd1a
jmp 0x10049e0c
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
jmp 0x10049e41
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x110], eax
jmp 0x10049cb0
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004a34d
mov dword [ebp - 0x15c], 0xffffffff
mov dword [ebp - 0x198], 0xa8e97eed
mov dword [ebp - 0x164], 0xffffffff
mov dword [ebp - 8], 0
jmp 0x10049e80
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x10049e96
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1d8], 0xdd03248c
jmp 0x10049e79
mov dword [ebp - 8], 0
jmp 0x10049ea6
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x10049ebc
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1a8], 8
jmp 0x10049e9f
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1a8]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x1a8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [eax], 0
jmp 0x10049eff
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
mov eax, dword [ebp - 0x58]
cmp dword [eax], 0
jg 0x1004a348
mov dword [ebp - 0x48], 0x3ae35568
mov dword [ebp - 0x48], 0xa
jmp 0x10049f22
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 7
jne 0x10049fcd
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x120], 0xffffffff
mov dword [ebp - 0x34], 0
jmp 0x10049f4d
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x10049f63
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1b4], 0xffffffff
jmp 0x10049f46
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x78]
mov dword [ebp + eax - 0x1b4], ecx
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x78], eax
je 0x10049f8a
mov dword [ebp - 0x80], 1
jmp 0x10049f8e
and dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x120], eax
mov byte [ebp - 0x13], 0
movzx eax, byte [ebp - 0x13]
test eax, eax
je 0x10049fc8
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x24d7
push 0x1735
push 0x95c
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x10049f1b
mov dword [ebp - 0x38], 0
jmp 0x10049fdd
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x10049ff3
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xf0], 0x841b3c69
jmp 0x10049fd6
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xf0], 0
jmp 0x1004a01e
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf0]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xf0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xf0], 0xffffffe4
je 0x1004a07b
mov dword [ebp - 0x100], 0x43046b6e
mov dword [ebp - 0x118], 0x464f16ef
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xf0]
sub eax, dword [ebp - 0x100]
cmp eax, 0xb9dd952e
jne 0x1004a066
mov dword [ebp - 0x88], 1
jmp 0x1004a06d
and dword [ebp - 0x88], 0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x118], eax
jmp 0x1004a005
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xf0], 0
je 0x1004a09d
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x1004a09d
mov dword [ebp - 0x90], 1
jmp 0x1004a0a4
and dword [ebp - 0x90], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x90]
mov dword [ebp + eax - 0xf0], ecx
mov byte [ebp - 0x11], 0
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0xe0], 0x89afca86
mov dword [ebp - 0x18c], 4
mov dword [ebp - 0x3c], 0
jmp 0x1004a0e6
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1004a0fc
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xa8], 0xaf11
jmp 0x1004a0df
mov dword [ebp - 0xc], 0
jmp 0x1004a10c
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x1004a333
mov dword [ebp - 0x10], 0xe0091df8
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x60], 0x2e6c0b33
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], 1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x16c], eax
push 0xfffffffffffffff6
pop eax
add eax, 0x7cdedfc4
je 0x1004a15e
mov eax, 0xfc2e
test eax, eax
je 0x1004a15e
and dword [ebp - 0x98], 0
jmp 0x1004a168
mov dword [ebp - 0x98], 1
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0xc], eax
jge 0x1004a17f
mov dword [ebp - 0x108], 1
jmp 0x1004a186
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x24], 0xffffffff
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jle 0x1004a1c8
mov dword [ebp - 0xa0], 1
jmp 0x1004a1cf
and dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xa0]
je 0x1004a1ea
mov dword [ebp - 0x128], 1
jmp 0x1004a1f1
and dword [ebp - 0x128], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x150], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa8]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0xe0], 0xf47f28a9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x160], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa8], 1
je 0x1004a2ec
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xdc], 0x10b42b8f
mov dword [ebp - 0x2c], 0
jmp 0x1004a258
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jg 0x1004a26c
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xdc], eax
jmp 0x1004a251
mov dword [ebp - 0x10], 0
jmp 0x1004a27c
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1004a2ea
mov dword [ebp - 0x24], 0
jmp 0x1004a292
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jg 0x1004a2e8
mov byte [ebp - 0x1d], 0
movzx eax, byte [ebp - 0x1d]
test eax, eax
je 0x1004a2b5
push 0x386
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov byte [ebp - 0x15], 0
movzx eax, byte [ebp - 0x15]
test eax, eax
je 0x1004a2e6
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x24d7
push 0x1735
push 0x95c
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x1004a28b
jmp 0x1004a275
jmp 0x1004a302
mov byte [ebp - 0x12], 0
movzx eax, byte [ebp - 0x12]
test eax, eax
je 0x1004a302
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x28], 0
jmp 0x1004a312
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jg 0x1004a32e
mov byte [ebp - 0x14], 0
movzx eax, byte [ebp - 0x14]
test eax, eax
je 0x1004a32c
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x1004a30b
jmp 0x1004a105
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1004a343
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x10049ef4
jmp 0x1004a4fb
mov dword [ebp - 0xd8], 0x76820624
mov dword [ebp - 0xd4], 0x76820624
mov dword [ebp - 0xd0], 0x76820624
mov dword [ebp - 0xcc], 0x76820624
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x30], 0xffffffff
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd8], 0
jmp 0x1004a3b1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xd8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd8], 0x17
jge 0x1004a498
mov dword [ebp - 0x44], 0xa986
mov dword [ebp - 0x114], 0x49968cb6
cmp dword [ebp - 0x44], 0
jne 0x1004a44f
mov eax, 0x38d9
test eax, eax
je 0x1004a3f9
mov eax, dword [ebp - 0x44]
sub eax, 5
je 0x1004a3f9
mov dword [ebp - 0xb0], 1
jmp 0x1004a400
and dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0xb0], eax
je 0x1004a417
mov dword [ebp - 0x104], 1
jmp 0x1004a41e
and dword [ebp - 0x104], 0
mov eax, 0x4142b919
test eax, eax
je 0x1004a43c
mov eax, 0xde6fc608
test eax, eax
je 0x1004a43c
mov dword [ebp - 0x10c], 1
jmp 0x1004a443
and dword [ebp - 0x10c], 0
cmp dword [ebp - 0x44], 0
jne 0x1004a44f
and dword [ebp - 0x68], 0
jmp 0x1004a456
mov dword [ebp - 0x68], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd8]
cmp dword [ebp - 0x68], eax
jg 0x1004a474
mov dword [ebp - 0xc0], 1
jmp 0x1004a47b
and dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x30], eax
jmp 0x1004a396
mov dword [ebp - 0x30], 0
jmp 0x1004a4a8
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffff7
jg 0x1004a4f1
mov dword [ebp - 0x4c], 0
jmp 0x1004a4be
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1004a4d4
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xc8], 0x512dc6d0
jmp 0x1004a4b7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xc8], eax
jmp 0x1004a4a1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esp, ebp
pop ebp
ret