Function at 0x402275
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1bc
push 0x14
mov ecx, 0x4103e0
call fcn.00401c5d
mov eax, dword [0x40b1d4]
push eax
mov ecx, 0x4103e0
call fcn.00401bc1
push 0
push 0x40d1d4
mov ecx, 0x4103e0
call fcn.00401c84
mov ecx, dword [ebp + 0x10]
push ecx
push str._tWinMain_start___s__n
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0x10
push 0x100
lea edx, [ebp - 0x104]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x104]
push eax
call fcn.00404080
add esp, 4
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x4022f7
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jl 0x40231c
mov edx, dword [ebp - 4]
movsx eax, byte [ebp + edx - 0x104]
cmp eax, 0x5c
jne 0x40230f
jmp 0x40231c
mov ecx, dword [ebp - 4]
mov byte [ebp + ecx - 0x104], 0
jmp 0x4022ee
push 0x40b1e0
call fcn.00404080
add esp, 4
push eax
push 0x40b1e0
mov edx, dword [ebp + 0x10]
push edx
call fcn.00403d20
add esp, 0xc
test eax, eax
jne 0x402378
push str._tWinMain__i_start__n
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0xc
call fcn.00402ced
call fcn.00403062
push str._tWinMain__i_end__n
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0xc
xor eax, eax
jmp 0x402722
push 0x40b1e4
call fcn.00404080
add esp, 4
push eax
push 0x40b1e4
mov eax, dword [ebp + 0x10]
push eax
call fcn.00403d20
add esp, 0xc
test eax, eax
jne 0x4023d4
push str._tWinMain__u_start__n
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0xc
call fcn.004031ec
call fcn.00402f3b
push str._tWinMain__u_end__n
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0xc
xor eax, eax
jmp 0x402722
push str._start
call fcn.00404080
add esp, 4
push eax
push str._start
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00403d20
add esp, 0xc
test eax, eax
jne 0x40242b
push str._tWinMain__start_start__n
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0xc
call fcn.00403062
push str._tWinMain__start_end__n
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0xc
xor eax, eax
jmp 0x402722
push str._stop
call fcn.00404080
add esp, 4
push eax
push str._stop
mov edx, dword [ebp + 0x10]
push edx
call fcn.00403d20
add esp, 0xc
test eax, eax
jne 0x402482
push str._tWinMain__stop_start__n
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0xc
call fcn.004031ec
push str._tWinMain__stop_end__n
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0xc
xor eax, eax
jmp 0x402722
push 0x40b1f8
call fcn.00404080
add esp, 4
push eax
push 0x40b1f8
mov eax, dword [ebp + 0x10]
push eax
call fcn.00403d20
add esp, 0xc
test eax, eax
jne 0x40258b
push str._tWinMain__b_start__n
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0xc
mov dword [0x410394], 0xffffffff
push 0x64
push 0
lea ecx, [ebp - 0x168]
push ecx
call fcn.004038e0
add esp, 0xc
lea edx, [ebp - 0x168]
push edx
call fcn.00402030
add esp, 4
cmp dword [0x410394], 4
je 0x4024fb
cmp dword [0x410394], 5
jne 0x40256b
mov dword [ebp - 0x1a4], 0x3c
mov dword [ebp - 0x1a0], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], str.runas
mov dword [ebp - 0x194], str.neturo.exe
mov dword [ebp - 0x190], 0x4103bc
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x188], 1
mov dword [ebp - 0x184], 0
lea eax, [ebp - 0x1a4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
xor eax, eax
jmp 0x402722
call fcn.004032bb
push str._tWinMain__b_end__n
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0xc
xor eax, eax
jmp 0x402722
push str._tWinMain_mid__n
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0xc
call fcn.00402cc8
test eax, eax
je 0x40260a
push str._tWinMain_NeturoService::IsWinNT___start__n
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0xc
mov dword [ebp - 0x1b4], str.NeturoNTService
mov dword [ebp - 0x1b0], 0x402728
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x1a8], 0
lea ecx, [ebp - 0x1b4]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
push str._tWinMain_NeturoService::IsWinNT___end__n
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0xc
jmp 0x402720
push 0x40d360
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0xc
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0
jne 0x40263f
xor eax, eax
jmp 0x402722
push 0x40d3a4
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0xc
push str.RegisterServiceProcess
mov edx, dword [ebp - 0x1bc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
jne 0x40267b
xor eax, eax
jmp 0x402722
push 0x40d3ec
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0xc
push 1
push 0
call dword [ebp - 0x1b8]
add esp, 8
push 0x40d41c
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0xc
push str._service
push str.AutoPatcher.exe
call fcn.00402b1b
add esp, 8
push 0x40d468
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0xc
push 0
push 0
call dword [ebp - 0x1b8]
add esp, 8
push 0x40d498
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0xc
mov eax, dword [ebp - 0x1bc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x40d4c8
push 0
push 0x4103e0
call fcn.00401b00
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10