Function at 0x41f4f0
Capabilities:
Contain obfuscated stackstrings
Create service
Parse pe header
Query service status
Start service

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x8f8
mov eax, dword [0x465040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x8a0], esi
test esi, esi
jne 0x41f6fa
mov byte [ebp - 0x88c], al
mov byte [ebp - 0x88b], 0x2b
mov byte [ebp - 0x88a], 0x50
mov byte [ebp - 0x889], 0x1f
mov byte [ebp - 0x888], 0x50
mov byte [ebp - 0x887], 0x26
mov byte [ebp - 0x886], 0x50
mov byte [ebp - 0x885], al
mov byte [ebp - 0x884], 0x50
mov byte [ebp - 0x883], 0x49
mov byte [ebp - 0x882], 0x50
mov byte [ebp - 0x881], 0x36
mov byte [ebp - 0x880], 0x50
mov byte [ebp - 0x87f], 0x12
mov byte [ebp - 0x87e], 0x50
mov byte [ebp - 0x87d], 0x3b
mov byte [ebp - 0x87c], 0x50
mov byte [ebp - 0x87b], 0x3f
mov byte [ebp - 0x87a], 0x50
mov byte [ebp - 0x879], 0x67
mov byte [ebp - 0x878], 0x50
mov byte [ebp - 0x877], 0x4e
mov byte [ebp - 0x876], 0x50
mov byte [ebp - 0x875], 0x1c
mov byte [ebp - 0x874], 0x50
mov byte [ebp - 0x873], 0x3b
mov byte [ebp - 0x872], 0x50
mov byte [ebp - 0x871], 0x1c
mov byte [ebp - 0x870], 0x50
mov byte [ebp - 0x86f], 0xd
mov byte [ebp - 0x86e], 0x50
mov byte [ebp - 0x86d], 0x12
mov byte [ebp - 0x86c], 0x50
mov byte [ebp - 0x86b], 0x31
mov byte [ebp - 0x86a], 0x50
mov byte [ebp - 0x869], al
mov byte [ebp - 0x868], 0x50
mov byte [ebp - 0x867], 0x4f
mov byte [ebp - 0x866], 0x50
mov byte [ebp - 0x865], 0x1c
mov byte [ebp - 0x864], 0x50
mov byte [ebp - 0x863], 8
mov byte [ebp - 0x862], 0x50
mov byte [ebp - 0x861], 0x40
mov byte [ebp - 0x860], 0x50
mov byte [ebp - 0x85f], 0x12
mov byte [ebp - 0x85e], 0x50
mov byte [ebp - 0x85d], 0x54
mov byte [ebp - 0x85c], 0x50
mov byte [ebp - 0x85b], 0x50
mov byte [ebp - 0x85a], 0x50
mov al, byte [ebp - 0x88b]
mov al, byte [ebp - 0x88c]
test al, al
jne 0x41f6d6
xor ecx, ecx
lea esi, [ecx + 0x7f]
nop
mov al, byte [ebp + ecx - 0x88b]
movzx eax, al
sub eax, 0x50
imul eax, eax, 0x19
cdq
idiv esi
lea eax, [edx + 0x7f]
cdq
idiv esi
mov byte [ebp + ecx - 0x88b], dl
inc ecx
cmp ecx, 0x32
jb 0x41f6b0
lea eax, [ebp - 0x88b]
push eax
call fcn.00424150
add esp, 4
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437671
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea ecx, [ebp - 0x8d8]
call fcn.0042a730
cmp dword [eax + 0x14], 7
jbe 0x41f70d
mov eax, dword [eax]
push 0xf01ff
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ecx, dword [ebp - 0x8c4]
mov edi, eax
mov dword [ebp - 0x89c], edi
cmp ecx, 7
jbe 0x41f762
mov edx, dword [ebp - 0x8d8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41f758
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42096b
push ecx
push edx
call fcn.004378af
add esp, 8
xor eax, eax
mov dword [ebp - 0x8c8], 0
mov dword [ebp - 0x8c4], 7
mov word [ebp - 0x8d8], ax
lea esi, [eax + 0x7f]
test edi, edi
jne 0x420118
lea ecx, [ebp - 0x8c0]
call fcn.0042a730
mov dword [ebp - 0x89c], eax
cmp dword [eax + 0x14], 7
jbe 0x41f7a9
mov eax, dword [eax]
mov dword [ebp - 0x89c], eax
mov byte [ebp - 0x88c], 0
mov byte [ebp - 0x88b], 6
mov byte [ebp - 0x88a], 5
mov byte [ebp - 0x889], 0x5c
mov byte [ebp - 0x888], 5
mov byte [ebp - 0x887], 0xd
mov byte [ebp - 0x886], 5
mov byte [ebp - 0x885], 0x75
mov byte [ebp - 0x884], 5
mov byte [ebp - 0x883], 0x31
mov byte [ebp - 0x882], 5
mov byte [ebp - 0x881], 0x17
mov byte [ebp - 0x880], 5
mov byte [ebp - 0x87f], 0x29
mov byte [ebp - 0x87e], 5
mov byte [ebp - 0x87d], 0x1b
mov byte [ebp - 0x87c], 5
mov byte [ebp - 0x87b], 0x1e
mov byte [ebp - 0x87a], 5
mov byte [ebp - 0x879], 0x37
mov byte [ebp - 0x878], 5
mov byte [ebp - 0x877], 9
mov byte [ebp - 0x876], 5
mov byte [ebp - 0x875], 0x30
mov byte [ebp - 0x874], 5
mov byte [ebp - 0x873], 0x75
mov byte [ebp - 0x872], 5
mov byte [ebp - 0x871], 0x5a
mov byte [ebp - 0x870], 5
mov byte [ebp - 0x86f], 0x29
mov byte [ebp - 0x86e], 5
mov byte [ebp - 0x86d], 0x17
mov byte [ebp - 0x86c], 5
mov byte [ebp - 0x86b], 0x25
mov byte [ebp - 0x86a], 5
mov byte [ebp - 0x869], 0x37
mov byte [ebp - 0x868], 5
mov byte [ebp - 0x867], 0x22
mov byte [ebp - 0x866], 5
mov byte [ebp - 0x865], 0x29
mov byte [ebp - 0x864], 5
mov byte [ebp - 0x863], 0x51
mov byte [ebp - 0x862], 5
mov byte [ebp - 0x861], 0x75
mov byte [ebp - 0x860], 5
mov byte [ebp - 0x85f], 0x47
mov byte [ebp - 0x85e], 5
mov byte [ebp - 0x85d], 0x5a
mov byte [ebp - 0x85c], 5
mov byte [ebp - 0x85b], 5
mov byte [ebp - 0x85a], 5
mov al, byte [ebp - 0x88b]
mov al, byte [ebp - 0x88c]
test al, al
jne 0x41f94d
xor edi, edi
mov al, byte [ebp + edi - 0x88b]
mov ecx, 5
movzx eax, al
sub ecx, eax
lea eax, [ecx + ecx*8]
shl eax, 2
cdq
idiv esi
lea eax, [edx + 0x7f]
cdq
idiv esi
mov byte [ebp + edi - 0x88b], dl
inc edi
cmp edi, 0x32
jb 0x41f920
push dword [ebp - 0x89c]
lea eax, [ebp - 0x88b]
push eax
call fcn.00424150
mov ecx, dword [ebp - 0x8ac]
add esp, 8
cmp ecx, 7
jbe 0x41f9a2
mov edx, dword [ebp - 0x8c0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41f998
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420970
push ecx
push edx
call fcn.004378af
add esp, 8
xor eax, eax
mov dword [ebp - 0x8b0], 0
mov word [ebp - 0x8c0], ax
lea eax, [ebp - 0x808]
push 0x400
push eax
push 0
mov dword [ebp - 0x8ac], 7
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
mov dword [ebp - 0x8b0], 0
lea ecx, [ebp - 0x808]
movaps xmmword [ebp - 0x8c0], xmm0
mov dword [ebp - 0x8ac], 0
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41fa00
sub ecx, edx
lea eax, [ebp - 0x808]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x8c0]
call fcn.00415e90
sub esp, 8
lea ecx, [ebp - 0x8c0]
call fcn.00415ce0
mov ecx, dword [ebp - 0x8ac]
mov edi, eax
cmp ecx, 7
jbe 0x41fa72
mov edx, dword [ebp - 0x8c0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41fa68
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420975
push ecx
push edx
call fcn.004378af
add esp, 8
xor eax, eax
mov dword [ebp - 0x8b0], 0
xorps xmm0, xmm0
mov dword [ebp - 0x8ac], 7
lea ecx, [ebp - 0x808]
mov word [ebp - 0x8c0], ax
movaps xmmword [ebp - 0x8c0], xmm0
lea edx, [ecx + 2]
mov dword [ebp - 0x8b0], eax
mov dword [ebp - 0x8ac], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41fab0
sub ecx, edx
lea eax, [ebp - 0x808]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x8c0]
call fcn.00415e90
cmp dword [ebp - 0x8b0], edi
lea eax, [ebp - 0x8c0]
xorps xmm0, xmm0
mov dword [ebp - 0x840], 0
cmovb edi, dword [ebp - 0x8b0]
lea ecx, [ebp - 0x850]
cmp dword [ebp - 0x8ac], 7
push edi
cmova eax, dword [ebp - 0x8c0]
push eax
movaps xmmword [ebp - 0x850], xmm0
mov dword [ebp - 0x83c], 0
call fcn.00415e90
mov ecx, dword [ebp - 0x8ac]
cmp ecx, 7
jbe 0x41fb5e
mov edx, dword [ebp - 0x8c0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41fb54
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420984
push ecx
push edx
call fcn.004378af
add esp, 8
push 1
xor eax, eax
mov dword [ebp - 0x8b0], 0
push 0x461a40
lea ecx, [ebp - 0x850]
mov dword [ebp - 0x8ac], 7
mov word [ebp - 0x8c0], ax
call fcn.00418b80
lea ecx, [ebp - 0x8c0]
call fcn.0042a8f0
mov ecx, eax
cmp dword [eax + 0x14], 7
jbe 0x41fba2
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x850]
call fcn.00418b80
mov ecx, dword [ebp - 0x8ac]
cmp ecx, 7
jbe 0x41fbf1
mov edx, dword [ebp - 0x8c0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41fbe7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42097a
push ecx
push edx
call fcn.004378af
add esp, 8
mov dword [ebp - 0x8b0], 0
lea edi, [ebp - 0x850]
mov dword [ebp - 0x8ac], 7
xor eax, eax
cmp dword [ebp - 0x83c], 7
mov word [ebp - 0x8c0], ax
cmova edi, dword [ebp - 0x850]
mov byte [ebp - 0x830], al
mov byte [ebp - 0x82f], 0x37
mov byte [ebp - 0x82e], 0x54
mov byte [ebp - 0x82d], 0x65
mov byte [ebp - 0x82c], 0x54
mov byte [ebp - 0x82b], 0x6a
mov byte [ebp - 0x82a], 0x54
mov byte [ebp - 0x829], 0xb
mov byte [ebp - 0x828], 0x54
mov byte [ebp - 0x827], 0x5b
mov byte [ebp - 0x826], 0x54
mov byte [ebp - 0x825], 0x53
mov byte [ebp - 0x824], 0x54
mov byte [ebp - 0x823], 0x2c
mov byte [ebp - 0x822], 0x54
mov byte [ebp - 0x821], 0x2c
mov byte [ebp - 0x820], 0x54
mov byte [ebp - 0x81f], 0xb
mov byte [ebp - 0x81e], 0x54
mov byte [ebp - 0x81d], 0x13
mov byte [ebp - 0x81c], 0x54
mov byte [ebp - 0x81b], 0x51
mov byte [ebp - 0x81a], 0x54
mov byte [ebp - 0x819], 0x79
mov byte [ebp - 0x818], 0x54
mov byte [ebp - 0x817], 0x45
mov byte [ebp - 0x816], 0x54
mov byte [ebp - 0x815], 0x27
mov byte [ebp - 0x814], 0x54
mov byte [ebp - 0x813], 0xb
mov byte [ebp - 0x812], 0x54
mov byte [ebp - 0x811], 0x4b
mov byte [ebp - 0x810], 0x54
mov byte [ebp - 0x80f], 0x20
mov byte [ebp - 0x80e], 0x54
mov byte [ebp - 0x80d], 0x54
mov byte [ebp - 0x80c], 0x54
mov al, byte [ebp - 0x82f]
mov al, byte [ebp - 0x830]
test al, al
jne 0x41fd68
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x82f]
movzx eax, al
sub eax, 0x54
lea eax, [eax + eax*4]
add eax, eax
cdq
idiv esi
lea eax, [edx + 0x7f]
cdq
idiv esi
mov byte [ebp + ecx - 0x82f], dl
inc ecx
cmp ecx, 0x24
jb 0x41fd40
lea eax, [ebp - 0x82f]
push edi
push eax
call fcn.00424150
add esp, 8
lea eax, [ebp - 0x850]
cmp dword [ebp - 0x83c], 7
lea ecx, [ebp - 0x8f0]
cmova eax, dword [ebp - 0x850]
mov dword [ebp - 0x89c], eax
call fcn.0042a730
mov edi, eax
cmp dword [edi + 0x14], 7
jbe 0x41fda7
mov edi, dword [edi]
lea ecx, [ebp - 0x8c0]
call fcn.0042a730
cmp dword [eax + 0x14], 7
jbe 0x41fdba
mov eax, dword [eax]
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x89c]
push 0
push 3
push 1
push 0xf01ff
push edi
push eax
push dword [ebp - 0x8a0]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ecx, dword [ebp - 0x8ac]
mov edi, eax
mov dword [ebp - 0x89c], eax
cmp ecx, 7
jbe 0x41fe2b
mov edx, dword [ebp - 0x8c0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41fe21
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42097f
push ecx
push edx
call fcn.004378af
add esp, 8
mov ecx, dword [ebp - 0x8dc]
xor eax, eax
mov dword [ebp - 0x8b0], 0
mov dword [ebp - 0x8ac], 7
mov word [ebp - 0x8c0], ax
cmp ecx, 7
jbe 0x41fe88
mov edx, dword [ebp - 0x8f0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41fe7e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42097f
push ecx
push edx
call fcn.004378af
add esp, 8
xor eax, eax
mov dword [ebp - 0x8e0], 0
mov dword [ebp - 0x8dc], 7
mov word [ebp - 0x8f0], ax
test edi, edi
jne 0x4200bb
mov byte [ebp - 0x88c], al
mov byte [ebp - 0x88b], 0x42
mov byte [ebp - 0x88a], 0x6b
mov byte [ebp - 0x889], 0x3f
mov byte [ebp - 0x888], 0x6b
mov byte [ebp - 0x887], 0x21
mov byte [ebp - 0x886], 0x6b
mov byte [ebp - 0x885], 0x57
mov byte [ebp - 0x884], 0x6b
mov byte [ebp - 0x883], 0x51
mov byte [ebp - 0x882], 0x6b
mov byte [ebp - 0x881], 4
mov byte [ebp - 0x880], 0x6b
mov byte [ebp - 0x87f], 0x1c
mov byte [ebp - 0x87e], 0x6b
mov byte [ebp - 0x87d], 0x5e
mov byte [ebp - 0x87c], 0x6b
mov byte [ebp - 0x87b], 0x62
mov byte [ebp - 0x87a], 0x6b
mov byte [ebp - 0x879], 0x1c
mov byte [ebp - 0x878], 0x6b
mov byte [ebp - 0x877], 0x47
mov byte [ebp - 0x876], 0x6b
mov byte [ebp - 0x875], 0x1c
mov byte [ebp - 0x874], 0x6b
mov byte [ebp - 0x873], 4
mov byte [ebp - 0x872], 0x6b
mov byte [ebp - 0x871], 0x41
mov byte [ebp - 0x870], 0x6b
mov byte [ebp - 0x86f], 0x59
mov byte [ebp - 0x86e], 0x6b
mov byte [ebp - 0x86d], 0x3d
mov byte [ebp - 0x86c], 0x6b
mov byte [ebp - 0x86b], 0x1c
mov byte [ebp - 0x86a], 0x6b
mov byte [ebp - 0x869], 0x57
mov byte [ebp - 0x868], 0x6b
mov byte [ebp - 0x867], 0x4b
mov byte [ebp - 0x866], 0x6b
mov byte [ebp - 0x865], 0x5e
mov byte [ebp - 0x864], 0x6b
mov byte [ebp - 0x863], 0x59
mov byte [ebp - 0x862], 0x6b
mov byte [ebp - 0x861], 0x67
mov byte [ebp - 0x860], 0x6b
mov byte [ebp - 0x85f], 0x1c
mov byte [ebp - 0x85e], 0x6b
mov byte [ebp - 0x85d], 0x6c
mov byte [ebp - 0x85c], 0x6b
mov byte [ebp - 0x85b], 0x6b
mov byte [ebp - 0x85a], 0x6b
mov al, byte [ebp - 0x88b]
mov al, byte [ebp - 0x88c]
test al, al
jne 0x42004b
mov al, byte [ebp + edi - 0x88b]
mov ecx, 0x6b
movzx eax, al
sub ecx, eax
imul eax, ecx, 0x1b
cdq
idiv esi
lea eax, [edx + 0x7f]
cdq
idiv esi
mov byte [ebp + edi - 0x88b], dl
inc edi
cmp edi, 0x32
jb 0x420021
lea eax, [ebp - 0x88b]
push eax
call fcn.00424150
add esp, 4
push dword [ebp - 0x8a0]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x83c]
cmp ecx, 7
jbe 0x4200a6
mov edx, dword [ebp - 0x850]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42009c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420984
push ecx
push edx
call fcn.004378af
add esp, 8
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437671
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov ecx, dword [ebp - 0x83c]
cmp ecx, 7
jbe 0x4200fb
mov edx, dword [ebp - 0x850]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4200f1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x420984
push ecx
push edx
call fcn.004378af
add esp, 8
xor eax, eax
mov dword [ebp - 0x840], 0
mov dword [ebp - 0x83c], 7
mov word [ebp - 0x850], ax
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x420728
lea eax, [ebp - 0x828]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4204fb
cmp dword [ebp - 0x824], 4
jne 0x42034f
mov byte [ebp - 0x898], 0
mov byte [ebp - 0x897], 0x58
mov byte [ebp - 0x896], 0x74
mov byte [ebp - 0x895], 0x39
mov byte [ebp - 0x894], 0x74
mov byte [ebp - 0x893], 0x13
mov byte [ebp - 0x892], 0x74
mov byte [ebp - 0x891], 0x1c
mov byte [ebp - 0x890], 0x74
mov byte [ebp - 0x88f], 0x6e
mov byte [ebp - 0x88e], 0x74
mov byte [ebp - 0x88d], 0x7c
mov byte [ebp - 0x88c], 0x74
mov byte [ebp - 0x88b], 0x78
mov byte [ebp - 0x88a], 0x74
mov byte [ebp - 0x889], 0x6d
mov byte [ebp - 0x888], 0x74
mov byte [ebp - 0x887], 0x71
mov byte [ebp - 0x886], 0x74
mov byte [ebp - 0x885], 0x42
mov byte [ebp - 0x884], 0x74
mov byte [ebp - 0x883], 0x7c
mov byte [ebp - 0x882], 0x74
mov byte [ebp - 0x881], 0x1c
mov byte [ebp - 0x880], 0x74
mov byte [ebp - 0x87f], 0x71
mov byte [ebp - 0x87e], 0x74
mov byte [ebp - 0x87d], 0x16
mov byte [ebp - 0x87c], 0x74
mov byte [ebp - 0x87b], 0x1c
mov byte [ebp - 0x87a], 0x74
mov byte [ebp - 0x879], 8
mov byte [ebp - 0x878], 0x74
mov byte [ebp - 0x877], 0x49
mov byte [ebp - 0x876], 0x74
mov byte [ebp - 0x875], 0x78
mov byte [ebp - 0x874], 0x74
mov byte [ebp - 0x873], 0x7c
mov byte [ebp - 0x872], 0x74
mov byte [ebp - 0x871], 8
mov byte [ebp - 0x870], 0x74
mov byte [ebp - 0x86f], 0x5f
mov byte [ebp - 0x86e], 0x74
mov byte [ebp - 0x86d], 0x45
mov byte [ebp - 0x86c], 0x74
mov byte [ebp - 0x86b], 0x1c
mov byte [ebp - 0x86a], 0x74
mov byte [ebp - 0x869], 0x78
mov byte [ebp - 0x868], 0x74
mov byte [ebp - 0x867], 0x50
mov byte [ebp - 0x866], 0x74
mov byte [ebp - 0x865], 4
mov byte [ebp - 0x864], 0x74
mov byte [ebp - 0x863], 4
mov byte [ebp - 0x862], 0x74
mov byte [ebp - 0x861], 0x71
mov byte [ebp - 0x860], 0x74
mov byte [ebp - 0x85f], 4
mov byte [ebp - 0x85e], 0x74
mov byte [ebp - 0x85d], 0x37
mov byte [ebp - 0x85c], 0x74
mov byte [ebp - 0x85b], 0x74
mov byte [ebp - 0x85a], 0x74
mov al, byte [ebp - 0x897]
mov al, byte [ebp - 0x898]
test al, al
jne 0x420931
xor edi, edi
nop dword [eax]
mov al, byte [ebp + edi - 0x897]
mov ecx, 0x74
movzx eax, al
sub ecx, eax
imul eax, ecx, 0x23
cdq
idiv esi
lea eax, [edx + 0x7f]
cdq
idiv esi
mov byte [ebp + edi - 0x897], dl
inc edi
cmp edi, 0x3e
jb 0x420320
jmp 0x42092b
mov byte [ebp - 0x888], 0
mov byte [ebp - 0x887], 0x30
mov byte [ebp - 0x886], 8
mov byte [ebp - 0x885], 0x55
mov byte [ebp - 0x884], 8
mov byte [ebp - 0x883], 0x4a
mov byte [ebp - 0x882], 8
mov byte [ebp - 0x881], 0x2b
mov byte [ebp - 0x880], 8
mov byte [ebp - 0x87f], 0x47
mov byte [ebp - 0x87e], 8
mov byte [ebp - 0x87d], 0x77
mov byte [ebp - 0x87c], 8
mov byte [ebp - 0x87b], 0x7e
mov byte [ebp - 0x87a], 8
mov byte [ebp - 0x879], 0x5d
mov byte [ebp - 0x878], 8
mov byte [ebp - 0x877], 0x77
mov byte [ebp - 0x876], 8
mov byte [ebp - 0x875], 0x47
mov byte [ebp - 0x874], 8
mov byte [ebp - 0x873], 0x33
mov byte [ebp - 0x872], 8
mov byte [ebp - 0x871], 0x5d
mov byte [ebp - 0x870], 8
mov byte [ebp - 0x86f], 0x12
mov byte [ebp - 0x86e], 8
mov byte [ebp - 0x86d], 0x67
mov byte [ebp - 0x86c], 8
mov byte [ebp - 0x86b], 0x19
mov byte [ebp - 0x86a], 8
mov byte [ebp - 0x869], 0x33
mov byte [ebp - 0x868], 8
mov byte [ebp - 0x867], 0x2b
mov byte [ebp - 0x866], 8
mov byte [ebp - 0x865], 0x40
mov byte [ebp - 0x864], 8
mov byte [ebp - 0x863], 0x7e
mov byte [ebp - 0x862], 8
mov byte [ebp - 0x861], 0x67
mov byte [ebp - 0x860], 8
mov byte [ebp - 0x85f], 0xf
mov byte [ebp - 0x85e], 8
mov byte [ebp - 0x85d], 0x33
mov byte [ebp - 0x85c], 8
mov byte [ebp - 0x85b], 0x26
mov byte [ebp - 0x85a], 8
mov byte [ebp - 0x859], 8
mov byte [ebp - 0x858], 8
mov al, byte [ebp - 0x887]
mov al, byte [ebp - 0x888]
test al, al
jne 0x4204f0
xor edi, edi
nop dword [eax + eax]
mov al, byte [ebp + edi - 0x887]
mov ecx, 8
movzx eax, al
sub ecx, eax
imul eax, ecx, 0x27
cdq
idiv esi
lea eax, [edx + 0x7f]
cdq
idiv esi
mov byte [ebp + edi - 0x887], dl
inc edi
cmp edi, 0x30
jb 0x4204c0
mov edi, dword [ebp - 0x89c]
lea eax, [ebp - 0x887]
jmp 0x4206f9
mov byte [ebp - 0x894], 0
mov byte [ebp - 0x893], 0x42
mov byte [ebp - 0x892], 0x1b
mov byte [ebp - 0x891], 0xa
mov byte [ebp - 0x890], 0x1b
mov byte [ebp - 0x88f], 0x55
mov byte [ebp - 0x88e], 0x1b
mov byte [ebp - 0x88d], 0x4d
mov byte [ebp - 0x88c], 0x1b
mov byte [ebp - 0x88b], 0x62
mov byte [ebp - 0x88a], 0x1b
mov byte [ebp - 0x889], 0x3b
mov byte [ebp - 0x888], 0x1b
mov byte [ebp - 0x887], 0x22
mov byte [ebp - 0x886], 0x1b
mov byte [ebp - 0x885], 0x5e
mov byte [ebp - 0x884], 0x1b
mov byte [ebp - 0x883], 0x61
mov byte [ebp - 0x882], 0x1b
mov byte [ebp - 0x881], 0x75
mov byte [ebp - 0x880], 0x1b
mov byte [ebp - 0x87f], 0x22
mov byte [ebp - 0x87e], 0x1b
mov byte [ebp - 0x87d], 0x5e
mov byte [ebp - 0x87c], 0x1b
mov byte [ebp - 0x87b], 5
mov byte [ebp - 0x87a], 0x1b
mov byte [ebp - 0x879], 0x48
mov byte [ebp - 0x878], 0x1b
mov byte [ebp - 0x877], 0xf
mov byte [ebp - 0x876], 0x1b
mov byte [ebp - 0x875], 0x22
mov byte [ebp - 0x874], 0x1b
mov byte [ebp - 0x873], 0x75
mov byte [ebp - 0x872], 0x1b
mov byte [ebp - 0x871], 0x71
mov byte [ebp - 0x870], 0x1b
mov byte [ebp - 0x86f], 0x7b
mov byte [ebp - 0x86e], 0x1b
mov byte [ebp - 0x86d], 0x71
mov byte [ebp - 0x86c], 0x1b
mov byte [ebp - 0x86b], 0x3b
mov byte [ebp - 0x86a], 0x1b
mov byte [ebp - 0x869], 0x28
mov byte [ebp - 0x868], 0x1b
mov byte [ebp - 0x867], 0x4d
mov byte [ebp - 0x866], 0x1b
mov byte [ebp - 0x865], 0x6b
mov byte [ebp - 0x864], 0x1b
mov byte [ebp - 0x863], 0x7b
mov byte [ebp - 0x862], 0x1b
mov byte [ebp - 0x861], 0x48
mov byte [ebp - 0x860], 0x1b
mov byte [ebp - 0x85f], 0x25
mov byte [ebp - 0x85e], 0x1b
mov byte [ebp - 0x85d], 0x22
mov byte [ebp - 0x85c], 0x1b
mov byte [ebp - 0x85b], 0x58
mov byte [ebp - 0x85a], 0x1b
mov byte [ebp - 0x859], 0x1b
mov byte [ebp - 0x858], 0x1b
mov al, byte [ebp - 0x893]
mov al, byte [ebp - 0x894]
test al, al
jne 0x4206f3
xor edi, edi
nop dword [eax + eax]
mov al, byte [ebp + edi - 0x893]
mov ecx, 0x1b
movzx eax, al
sub ecx, eax
lea eax, [ecx + ecx*4]
shl eax, 3
cdq
idiv esi
lea eax, [edx + 0x7f]
cdq
idiv esi
mov byte [ebp + edi - 0x893], dl
inc edi
cmp edi, 0x3c
jb 0x4206c0
mov edi, dword [ebp - 0x89c]
lea eax, [ebp - 0x893]
push eax
call fcn.00424150
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 4
push edi
call esi
push dword [ebp - 0x8a0]
call esi
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437671
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov byte [ebp - 0x898], 0
mov byte [ebp - 0x897], 0x7c
mov byte [ebp - 0x896], 0x65
mov byte [ebp - 0x895], 0x46
mov byte [ebp - 0x894], 0x65
mov byte [ebp - 0x893], 0x1f
mov byte [ebp - 0x892], 0x65
mov byte [ebp - 0x891], 0xa
mov byte [ebp - 0x890], 0x65
mov byte [ebp - 0x88f], 0x72
mov byte [ebp - 0x88e], 0x65
mov byte [ebp - 0x88d], 7
mov byte [ebp - 0x88c], 0x65
mov byte [ebp - 0x88b], 0x6c
mov byte [ebp - 0x88a], 0x65
mov byte [ebp - 0x889], 0x4b
mov byte [ebp - 0x888], 0x65
mov byte [ebp - 0x887], 0x28
mov byte [ebp - 0x886], 0x65
mov byte [ebp - 0x885], 7
mov byte [ebp - 0x884], 0x65
mov byte [ebp - 0x883], 0xa
mov byte [ebp - 0x882], 0x65
mov byte [ebp - 0x881], 0x20
mov byte [ebp - 0x880], 0x65
mov byte [ebp - 0x87f], 0x53
mov byte [ebp - 0x87e], 0x65
mov byte [ebp - 0x87d], 0x63
mov byte [ebp - 0x87c], 0x65
mov byte [ebp - 0x87b], 0x17
mov byte [ebp - 0x87a], 0x65
mov byte [ebp - 0x879], 0x28
mov byte [ebp - 0x878], 0x65
mov byte [ebp - 0x877], 0x17
mov byte [ebp - 0x876], 0x65
mov byte [ebp - 0x875], 0xa
mov byte [ebp - 0x874], 0x65
mov byte [ebp - 0x873], 0x18
mov byte [ebp - 0x872], 0x65
mov byte [ebp - 0x871], 0x3a
mov byte [ebp - 0x870], 0x65
mov byte [ebp - 0x86f], 6
mov byte [ebp - 0x86e], 0x65
mov byte [ebp - 0x86d], 6
mov byte [ebp - 0x86c], 0x65
mov byte [ebp - 0x86b], 0x28
mov byte [ebp - 0x86a], 0x65
mov byte [ebp - 0x869], 0x18
mov byte [ebp - 0x868], 0x65
mov byte [ebp - 0x867], 0x18
mov byte [ebp - 0x866], 0x65
mov byte [ebp - 0x865], 0x39
mov byte [ebp - 0x864], 0x65
mov byte [ebp - 0x863], 0x3a
mov byte [ebp - 0x862], 0x65
mov byte [ebp - 0x861], 0x20
mov byte [ebp - 0x860], 0x65
mov byte [ebp - 0x85f], 0x20
mov byte [ebp - 0x85e], 0x65
mov byte [ebp - 0x85d], 0x7e
mov byte [ebp - 0x85c], 0x65
mov byte [ebp - 0x85b], 0x1b
mov byte [ebp - 0x85a], 0x65
mov byte [ebp - 0x859], 0x65
mov byte [ebp - 0x858], 0x65
mov al, byte [ebp - 0x897]
mov al, byte [ebp - 0x898]
test al, al
jne 0x420931
xor edi, edi
mov al, byte [ebp + edi - 0x897]
movzx ecx, al
sub ecx, 0x65
mov eax, ecx
shl eax, 4
sub eax, ecx
cdq
idiv esi
lea eax, [edx + 0x7f]
cdq
idiv esi
mov byte [ebp + edi - 0x897], dl
inc edi
cmp edi, 0x40
jb 0x420901
mov edi, dword [ebp - 0x89c]
lea eax, [ebp - 0x897]
push eax
call fcn.00424150
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 4
push edi
call esi
push dword [ebp - 0x8a0]
call esi
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
mov byte [0x46883c], al
pop esi
call fcn.00437671
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0043c56a
call fcn.0043c56a
call fcn.0043c56a
call fcn.0043c56a
call fcn.0043c56a
call fcn.0043c56a
int3