Function at 0x401c90
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push 0xffffffffffffffff
push 0x4037d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push edi
mov edi, ecx
mov edx, dword [esp + 0x1c]
mov eax, dword [edi + 0xd8]
lea ecx, [edi + 0xd8]
xor ebx, ebx
push ebx
push edx
mov dword [esp + 0x1c], ebx
call dword [eax + 0x48]
test eax, eax
jne 0x401cff
cmp byte [esp + 0x20], bl
je 0x401cdb
push ebx
push ebx
push 0x406318
call sub.MFC42.DLL_AfxMessageBox
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.004031de
pop edi
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 8
push ebp
push esi
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [edi + 0xf4], eax
jne 0x401d33
cmp byte [esp + 0x28], bl
je 0x401f7b
push ebx
push ebx
push 0x406308
call sub.MFC42.DLL_AfxMessageBox
jmp 0x401f7b
lea esi, [edi + 0xfc]
lea eax, [esp + 0x24]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::operator_1
push 0x406304
mov ecx, esi
call sub.MFC42.DLL_CString::Find
cmp eax, ebx
jl 0x401d94
mov ecx, dword [esi]
lea edx, [esp + 0x10]
mov ecx, dword [ecx - 8]
sub ecx, eax
dec ecx
push ecx
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::Right
push eax
mov ecx, esi
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call fcn.004031de
push 0x406304
mov ecx, esi
call sub.MFC42.DLL_CString::Find
cmp eax, ebx
jge 0x401d55
push 0x406300
mov ecx, esi
call sub.MFC42.DLL_CString::Find
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::Left
push eax
mov ecx, esi
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call fcn.004031de
mov ecx, dword [esp + 0x24]
mov eax, dword [esi]
push ebx
push ebx
push ebx
mov edx, dword [edi + 0xf4]
push ebx
push ebx
push ecx
push 1
push 3
push 1
push 0xf01ff
push eax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
cmp eax, ebx
mov dword [edi + 0xf8], eax
jne 0x401e86
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x7b
jne 0x401e23
cmp byte [esp + 0x28], bl
je 0x401f7b
push ebx
push ebx
push 0x4062d4
call sub.MFC42.DLL_AfxMessageBox
jmp 0x401f7b
call esi
cmp eax, 0x431
jne 0x401e47
cmp byte [esp + 0x28], bl
je 0x401f7b
push ebx
push ebx
push 0x4062a8
call sub.MFC42.DLL_AfxMessageBox
jmp 0x401f7b
call esi
cmp eax, 0x430
mov al, byte [esp + 0x28]
jne 0x401e6d
cmp al, bl
je 0x401f7b
push ebx
push ebx
push 0x40627c
call sub.MFC42.DLL_AfxMessageBox
jmp 0x401f7b
cmp al, bl
je 0x401f7b
push ebx
push ebx
push 0x406268
call sub.MFC42.DLL_AfxMessageBox
jmp 0x401f7b
mov eax, dword [edi + 0xf4]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call ebp
mov ecx, dword [edi + 0xf8]
push ecx
call ebp
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [edi + 0xf4], eax
je 0x401d18
mov esi, dword [esi]
push 0xf01ff
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp eax, ebx
mov dword [edi + 0xf8], eax
jne 0x401eed
cmp byte [esp + 0x28], bl
je 0x401f7b
push ebx
push ebx
push 0x406240
call sub.MFC42.DLL_AfxMessageBox
jmp 0x401f7b
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x401f09
cmp byte [esp + 0x28], bl
je 0x401f69
push ebx
push ebx
push 0x406228
jmp 0x401f64
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x420
jne 0x401f27
cmp byte [esp + 0x28], bl
je 0x401f69
push ebx
push ebx
push 0x4061fc
jmp 0x401f64
call esi
cmp eax, 0x7d1
jne 0x401f3f
cmp byte [esp + 0x28], bl
je 0x401f69
push ebx
push ebx
push 0x4061d0
jmp 0x401f64
call esi
cmp eax, 0x422
mov al, byte [esp + 0x28]
jne 0x401f59
cmp al, bl
je 0x401f69
push ebx
push ebx
push 0x4061a4
jmp 0x401f64
cmp al, bl
je 0x401f69
push ebx
push ebx
push 0x406184
call sub.MFC42.DLL_AfxMessageBox
mov edx, dword [edi + 0xf4]
push edx
call ebp
mov eax, dword [edi + 0xf8]
push eax
call ebp
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004031de
mov ecx, dword [esp + 0x14]
pop esi
pop ebp
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8