Function at 0x40d2b8
Capabilities:
Terminate process

Disassembly:
mov eax, 0x4ce646
call fcn.004bc0f4
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov dword [ebp - 0x14], ebx
call fcn.0040906b
test eax, eax
jne 0x40d344
mov eax, dword [0x6cfe50]
cmp byte [eax + 0x1a1], bl
jne 0x40d334
push 0x4f1b58
lea ecx, [ebp - 0x14]
call fcn.00401072
push str.__ERROR:__Since_this_program_needs_to_install_a_system_service__it_must_be_run_as_Administrator.__If_you_need_assistance_with_this__please_visit_our_FAQ_page_at:__http:__www.evenbalance.com_index.php_pagepbsvcfaq.php
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.00401072
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 5
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 1
call fcn.0042a430
add esp, 0x18
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.00401028
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401028
push 1
mov ecx, esi
call fcn.0041f830
push 6
call fcn.004bc330
mov edi, 0x174
push edi
call fcn.004bb98c
pop ecx
mov dword [ebp - 0x20], eax
cmp eax, ebx
mov dword [ebp - 4], 2
je 0x40d368
push esi
mov ecx, eax
call fcn.0040a208
jmp 0x40d36a
xor eax, eax
or dword [ebp - 4], 0xffffffff
push edi
mov dword [esi + 0x1d8], eax
call fcn.004bb98c
pop ecx
mov dword [ebp - 0x20], eax
cmp eax, ebx
mov dword [ebp - 4], 3
je 0x40d393
push esi
mov ecx, eax
call fcn.0040a6cd
jmp 0x40d395
xor eax, eax
or edi, 0xffffffff
push 0x170
mov dword [ebp - 4], edi
mov dword [esi + 0x1dc], eax
call fcn.004bb98c
pop ecx
mov dword [ebp - 0x20], eax
cmp eax, ebx
mov dword [ebp - 4], 4
je 0x40d3c4
push esi
mov ecx, eax
call fcn.0040d14b
jmp 0x40d3c6
xor eax, eax
mov ecx, dword [esi + 0x1d8]
mov dword [esi + 0x1e0], eax
mov eax, dword [esi + 0x1dc]
mov dword [ecx + 0x15c], eax
mov eax, dword [esi + 0x1d8]
mov ecx, dword [esi + 0x1dc]
mov dword [ecx + 0x158], eax
mov eax, dword [0x6cfe50]
cmp byte [eax + 0x1a4], bl
mov dword [ebp - 4], edi
je 0x40d41a
mov eax, dword [esi + 0x1dc]
mov dword [eax + 0x15c], ebx
mov eax, dword [esi + 0x1e0]
mov dword [eax + 0x158], ebx
jmp 0x40d43e
mov eax, dword [esi + 0x1e0]
mov ecx, dword [esi + 0x1dc]
mov dword [ecx + 0x15c], eax
mov eax, dword [esi + 0x1d8]
mov ecx, dword [esi + 0x1e0]
mov dword [ecx + 0x158], eax
mov eax, dword [esi + 0x1e0]
lea ecx, [ebp - 0x1c]
mov dword [eax + 0x15c], ebx
mov eax, dword [esi]
push ecx
mov ecx, esi
mov dword [ebp - 0x1c], 0x1ae
mov dword [ebp - 0x18], 0x12c
call dword [eax + 0x31c]
cmp dword [0x6d0264], ebx
je 0x40d4a0
push 0x4e8770
lea ecx, [ebp - 0x18]
call fcn.00401072
mov ecx, dword [0x6d0264]
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x14], 1
call fcn.0049daa0
test al, al
mov byte [ebp - 0xd], 1
jne 0x40d4a3
mov byte [ebp - 0xd], bl
test byte [ebp - 0x14], 1
mov dword [ebp - 4], edi
je 0x40d4b8
and dword [ebp - 0x14], 0xfffffffe
lea ecx, [ebp - 0x18]
call fcn.00401028
cmp byte [ebp - 0xd], bl
je 0x40d564
mov byte [0x55b2b4], 1
mov eax, dword [esi + 0x1d8]
mov eax, dword [eax + 0x160]
lea ecx, [eax + 0x150]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
mov eax, dword [0x6cfe50]
mov ecx, dword [eax + 0x19c]
push 0x13f3
call fcn.00420050
mov edi, eax
cmp edi, ebx
je 0x40d511
mov eax, dword [edi]
push ebx
mov ecx, edi
call dword [eax + 0x9c]
mov eax, dword [edi]
push ebx
mov ecx, edi
call dword [eax + 0x98]
mov eax, dword [0x6cfe50]
mov ecx, dword [eax + 0x19c]
push 0x13ed
call fcn.00420050
cmp eax, ebx
je 0x40d543
mov ecx, dword [0x6cfe50]
cmp byte [ecx + 0x1a0], bl
je 0x40d543
mov edx, dword [eax]
push ebx
mov ecx, eax
call dword [edx + 0x9c]
mov eax, dword [esi + 0x1dc]
mov dword [eax + 0x158], ebx
push dword [esi + 0x1dc]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x314]
jmp 0x40d69d
cmp dword [0x6d0264], ebx
je 0x40d59b
push 0x4e86ac
lea ecx, [ebp - 0x20]
call fcn.00401072
mov ecx, dword [0x6d0264]
or dword [ebp - 0x14], 2
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 4], 6
call fcn.0049daa0
test al, al
mov byte [ebp - 0xd], 1
jne 0x40d59e
mov byte [ebp - 0xd], bl
test byte [ebp - 0x14], 2
mov dword [ebp - 4], edi
je 0x40d5af
lea ecx, [ebp - 0x20]
call fcn.00401028
cmp byte [ebp - 0xd], bl
je 0x40d657
mov byte [0x55b2b4], bl
mov eax, dword [esi + 0x1d8]
mov eax, dword [eax + 0x160]
lea ecx, [eax + 0x150]
mov eax, dword [ecx]
push 1
call dword [eax + 0x14]
mov eax, dword [0x6cfe50]
mov ecx, dword [eax + 0x19c]
push 0x13f3
call fcn.00420050
mov edi, eax
cmp edi, ebx
je 0x40d608
mov eax, dword [edi]
push ebx
mov ecx, edi
call dword [eax + 0x9c]
mov eax, dword [edi]
push ebx
mov ecx, edi
call dword [eax + 0x98]
mov eax, dword [0x6cfe50]
mov ecx, dword [eax + 0x19c]
push 0x13ed
call fcn.00420050
cmp eax, ebx
je 0x40d63a
mov ecx, dword [0x6cfe50]
cmp byte [ecx + 0x1a0], bl
je 0x40d63a
mov edx, dword [eax]
push ebx
mov ecx, eax
call dword [edx + 0x9c]
mov eax, dword [esi + 0x1dc]
mov dword [eax + 0x158], ebx
mov eax, dword [esi + 0x1dc]
mov dword [eax + 0x15c], ebx
jmp 0x40d54f
cmp byte [ebp + 8], bl
je 0x40d675
push dword [esi + 0x1d8]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x314]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x38]
jmp 0x40d69d
mov eax, dword [0x6cfe50]
cmp byte [eax + 0x1a1], bl
jne 0x40d69d
push 1
push dword [esi + 0x1d8]
mov ecx, esi
call fcn.0040f1a0
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x98]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4