Function at 0x4075b3
Capabilities:
Check os version
Contain obfuscated stackstrings
Create process on windows
Terminate process

Disassembly:
push 0x4f8
push 0x435288
call fcn.004189e0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x490], ebx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x488], eax
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x38], 0x625c3a63
mov dword [ebp - 0x34], 0x6b616572
mov dword [ebp - 0x30], 0x6e69616d
mov byte [ebp - 0x2c], 0
xor eax, eax
lea edi, [ebp - 0x2b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
call fcn.0040545e
pop ecx
test al, al
je 0x407665
mov edi, 0x94
push edi
push esi
lea eax, [ebp - 0x104]
push eax
call fcn.00416670
add esp, 0xc
mov dword [ebp - 0x104], edi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x100], 6
jb 0x40765f
mov dword [ebp - 0x4a0], 0xc
cmp dword [ebp - 0x4a0], esi
je 0x407665
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [ebp - 0x4a0]
jmp 0x407644
call dword [sym.imp.KERNEL32.dll_DebugBreak]
lea eax, [ebp - 0x278]
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4c0], 0x40746c
mov dword [ebp - 0x4bc], esi
mov dword [ebp - 0x4b8], esi
push esi
push esi
push 0xc
push ebx
call fcn.0040af16
add esp, 0x10
mov bl, al
call fcn.0040c6b6
mov dword [0x43a6f0], eax
call fcn.00404fa3
test al, al
je 0x4076ed
push 0x23
push 3
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x4076e1
push 0x42db20
call fcn.00408be0
mov esi, eax
push esi
push 0x246
push 0xd3
push 0x23
push 3
call fcn.004094a0
push esi
call fcn.004141bd
add esp, 0x1c
mov dword [ebp - 4], 0xfffffffe
jmp 0x408501
test bl, bl
jne 0x407719
call fcn.0040b08b
push 0x23
push 3
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x4076e1
push 0x42dae8
call fcn.00408be0
mov esi, eax
push esi
push 0x24f
jmp 0x4076ca
cmp dword [0x43c180], esi
jne 0x407760
push 0x23
push 1
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x407759
push 0x42daa8
call fcn.00408be0
mov esi, eax
push esi
push 0x255
push 0xd3
push 0x23
push 1
call fcn.004094a0
push esi
call fcn.004141bd
add esp, 0x1c
call fcn.0040b08b
jmp 0x4076e1
push 0x42b838
call fcn.004087f7
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
cmp edi, esi
je 0x407826
push 0x42b81c
call fcn.004087f7
pop ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x407826
push 1
call eax
push 0x23
push 3
test eax, eax
je 0x4077e1
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x407826
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x42b7fc
call fcn.00408be0
mov edi, eax
push edi
push 0x267
mov esi, 0xd3
push esi
push 0x23
push 3
call fcn.004094a0
push edi
call fcn.004141bd
add esp, 0x20
jmp 0x40782b
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x407826
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x42b7d0
call fcn.00408be0
mov edi, eax
push edi
push 0x26b
mov esi, 0xd3
push esi
push 0x23
push 3
call fcn.004094a0
push edi
call fcn.004141bd
add esp, 0x24
jmp 0x40782b
mov esi, 0xd3
push 0x23
push 4
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x40785f
push 0x42da8c
call fcn.00408be0
mov edi, eax
push edi
push 0x274
push esi
push 0x23
push 4
call fcn.004094a0
push edi
call fcn.004141bd
add esp, 0x1c
mov ebx, 0x42da80
push ebx
call fcn.004087f7
push eax
push dword [ebp - 0x488]
call fcn.004053ab
mov dword [ebp - 0x480], eax
push 0x279
mov edi, str.service.cpp
push edi
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00414105
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x484], eax
push 0x100
push dword [ebp - 0x488]
lea eax, [ebp - 0x47c]
push eax
call fcn.0040e267
add esp, 0x24
push 0x104
lea eax, [ebp - 0x37c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x37c]
push eax
call fcn.004167a0
mov dword [esp], 0x27e
push edi
inc eax
push eax
call fcn.00414105
mov ecx, dword [ebp - 0x48c]
mov dword [ecx], eax
push dword [ebp - 0x480]
lea ecx, [ebp - 0x37c]
push ecx
push eax
call fcn.0040e267
add esp, 0x18
and dword [ebp - 0x4a4], 0
lea eax, [ebp - 0x4a4]
push eax
push ebx
call fcn.004087f7
pop ecx
push eax
lea eax, [ebp - 0x47c]
push eax
call fcn.004168de
add esp, 0xc
mov dword [ebp - 0x498], 1
mov dword [ebp - 0x488], eax
mov eax, dword [ebp - 0x480]
cmp dword [ebp - 0x498], eax
jae 0x4079b6
push dword [ebp - 0x488]
call fcn.004167a0
inc eax
mov dword [ebp - 0x48c], eax
mov dword [esp], 0x287
push edi
push eax
call fcn.00414105
mov ecx, dword [ebp - 0x484]
mov edx, dword [ebp - 0x498]
mov dword [ecx + edx*4], eax
push dword [ebp - 0x48c]
push dword [ebp - 0x488]
push eax
call fcn.0040e267
add esp, 0x18
lea eax, [ebp - 0x4a4]
push eax
push ebx
call fcn.004087f7
pop ecx
push eax
push 0
call fcn.004168de
add esp, 0xc
inc dword [ebp - 0x498]
jmp 0x40793d
cmp eax, 1
jbe 0x407c80
mov eax, dword [ebp - 0x484]
mov eax, dword [eax + 4]
mov cl, byte [eax]
cmp cl, 0x2d
je 0x4079d8
cmp cl, 0x2f
jne 0x407c80
inc eax
push eax
push 0x42da7c
call fcn.004164fa
pop ecx
pop ecx
test eax, eax
jne 0x407a2e
push 0x23
push 4
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x407a1e
push 0x42da58
call fcn.00408be0
mov edi, eax
push edi
push 0x294
push esi
push 0x23
push 4
call fcn.004094a0
push edi
call fcn.004141bd
add esp, 0x1c
call fcn.00406ec0
mov ebx, dword [ebp - 0x484]
jmp 0x407c23
mov ebx, dword [ebp - 0x484]
mov eax, dword [ebx + 4]
inc eax
push eax
push 0x42da54
call fcn.004164fa
pop ecx
pop ecx
test eax, eax
jne 0x407a87
push 0x23
push 4
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x407a7d
push 0x42da30
call fcn.00408be0
mov edi, eax
push edi
push 0x299
push esi
push 0x23
push 4
call fcn.004094a0
push edi
call fcn.004141bd
add esp, 0x1c
call fcn.0040716c
jmp 0x407c23
mov eax, dword [ebx + 4]
inc eax
push eax
push 0x42da2c
call fcn.004164fa
pop ecx
pop ecx
test eax, eax
je 0x407c23
mov eax, dword [ebx + 4]
inc eax
push eax
push 0x42da28
call fcn.004164fa
pop ecx
pop ecx
test eax, eax
jne 0x407b3e
push 0x23
push 4
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x407aed
push 0x42d9f8
call fcn.00408be0
mov edi, eax
push edi
push 0x2a3
push esi
push 0x23
push 4
call fcn.004094a0
push edi
call fcn.004141bd
add esp, 0x1c
push dword [ebp - 0x480]
push ebx
call fcn.0040542f
xor ebx, ebx
mov dword [ebp - 0x484], ebx
mov dword [ebp - 0x480], ebx
push ebx
push dword [ebp - 0x490]
call fcn.00404553
push 0x23
push 3
call fcn.00409a80
add esp, 0x18
test al, al
je 0x407c23
push 0x42d9d0
call fcn.00408be0
mov edi, eax
push edi
push 0x2a9
jmp 0x407bd4
mov eax, dword [ebx + 4]
inc eax
push eax
push 0x42d9cc
call fcn.004164fa
pop ecx
pop ecx
test eax, eax
jne 0x407be9
push 0x23
push 4
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x407b8b
push 0x42d988
call fcn.00408be0
mov edi, eax
push edi
push 0x2ae
push esi
push 0x23
push 4
call fcn.004094a0
push edi
call fcn.004141bd
add esp, 0x1c
push dword [ebp - 0x480]
push ebx
call fcn.0040542f
xor ebx, ebx
mov dword [ebp - 0x484], ebx
mov dword [ebp - 0x480], ebx
push 1
push dword [ebp - 0x490]
call fcn.00404553
push 0x23
push 3
call fcn.00409a80
add esp, 0x18
test al, al
je 0x407c23
push 0x42d9d0
call fcn.00408be0
mov edi, eax
push edi
push 0x2b4
push esi
push 0x23
push 3
call fcn.004094a0
push edi
call fcn.004141bd
add esp, 0x1c
jmp 0x407c23
mov eax, dword [ebx + 4]
inc eax
push eax
push 0x42d978
call fcn.004087f7
pop ecx
push eax
call fcn.004164fa
pop ecx
pop ecx
test eax, eax
jne 0x407c80
mov dword [0x43a6ec], 1
mov ebx, dword [ebp - 0x484]
push ebx
push dword [ebp - 0x480]
call fcn.004073b1
pop ecx
pop ecx
push 0x23
push 4
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x407c66
test ebx, ebx
je 0x407c3b
mov eax, dword [ebx + 4]
jmp 0x407c40
mov eax, 0x42d974
push eax
push 0x42d950
call fcn.00408be0
mov edi, eax
push edi
push 0x2c1
push esi
push 0x23
push 4
call fcn.004094a0
push edi
call fcn.004141bd
add esp, 0x20
push dword [ebp - 0x480]
push ebx
call fcn.0040542f
pop ecx
pop ecx
call fcn.0040b08b
push 0
call fcn.00418cba
cmp dword [ebp - 0x480], 3
jb 0x4080e8
mov eax, dword [ebp - 0x484]
mov eax, dword [eax + 4]
mov cl, byte [eax]
cmp cl, 0x2d
je 0x407ca6
cmp cl, 0x2f
jne 0x4080e8
inc eax
push eax
push 0x42d94c
call fcn.004164fa
pop ecx
pop ecx
test eax, eax
jne 0x407f46
call fcn.0040601c
mov dword [ebp - 0x490], eax
test eax, eax
jne 0x407d28
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push 0x23
push 1
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x407d08
push edi
push 0x42d910
call fcn.00408be0
mov edi, eax
push edi
push 0x2d9
push esi
push 0x23
push 1
call fcn.004094a0
push edi
call fcn.004141bd
add esp, 0x20
push dword [ebp - 0x480]
push dword [ebp - 0x484]
call fcn.0040542f
pop ecx
pop ecx
call fcn.0040b08b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
push 0x23
pop ebx
push ebx
push 3
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x407d6d
push edi
push 0x42d8b8
call fcn.00408be0
mov edi, eax
push edi
push 0x2e1
push esi
push ebx
push 3
call fcn.004094a0
push edi
call fcn.004141bd
add esp, 0x20
mov eax, dword [ebp - 0x484]
push dword [eax + 8]
call fcn.00416ab5
pop ecx
push eax
push 0x42d8a8
call fcn.004087f7
pop ecx
push eax
push 0x104
lea eax, [ebp - 0x174]
push eax
call fcn.0040e32c
push 0x44
pop edi
push edi
push 0
lea eax, [ebp - 0x508]
push eax
call fcn.00416670
mov dword [ebp - 0x508], edi
push 0x10
push 0
lea eax, [ebp - 0x4b4]
push eax
call fcn.00416670
add esp, 0x28
push ebx
push 3
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x407e04
lea eax, [ebp - 0x174]
push eax
push dword [ebp - 0x490]
push 0x42d858
call fcn.00408be0
mov edi, eax
push edi
push 0x2f3
push esi
push ebx
push 3
call fcn.004094a0
push edi
call fcn.004141bd
add esp, 0x24
lea eax, [ebp - 0x4b4]
push eax
lea eax, [ebp - 0x508]
push eax
xor edi, edi
push edi
push edi
push 0x8000000
push edi
push edi
push edi
lea eax, [ebp - 0x174]
push eax
push dword [ebp - 0x490]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x407e69
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push ebx
push 1
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x407d08
push edi
push 0x42d910
call fcn.00408be0
mov edi, eax
push edi
push 0x2f7
push esi
push ebx
jmp 0x407cf8
push dword [ebp - 0x4b4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x4b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 3
cmp dword [ebp - 0x4ac], 0x103
jne 0x407ed9
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x407ec7
push dword [ebp - 0x4ac]
push 0x42d808
call fcn.00408be0
mov edi, eax
push edi
push 0x306
push esi
push ebx
push 3
call fcn.004094a0
push edi
call fcn.004141bd
add esp, 0x20
xor edi, edi
push edi
push dword [ebp - 0x4b4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x407dc5
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x407f0e
push dword [ebp - 0x4ac]
push 0x42d7c0
call fcn.00408be0
mov edi, eax
push edi
push 0x30f
push esi
push ebx
push 3
call fcn.004094a0
push edi
call fcn.004141bd
add esp, 0x20
push dword [ebp - 0x480]
push dword [ebp - 0x484]
call fcn.0040542f
pop ecx
pop ecx
call fcn.0040b08b
push dword [ebp - 0x4ac]
jmp 0x407d22
mov edi, dword [ebp - 0x484]
mov eax, dword [edi + 4]
inc eax
push eax
push 0x42d7bc
call fcn.004164fa
pop ecx
pop ecx
test eax, eax
jne 0x408163
mov dword [ebp - 4], 2
call fcn.00401027
test eax, eax
jne 0x407fcb
push 0x23
push 4
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x407fa9
push 0x42d788
call fcn.00408be0
mov ebx, eax
push ebx
push 0x31f
push esi
push 0x23
push 4
call fcn.004094a0
push ebx
call fcn.004141bd
add esp, 0x1c
push dword [ebp - 0x480]
push edi
call fcn.0040542f
pop ecx
pop ecx
call fcn.0040b08b
mov dword [ebp - 4], 0xfffffffe
or eax, 0xffffffff
jmp 0x408503
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x6b
push 3
pop ebx
push ebx
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x40800f
push 0x42d754
call fcn.00408be0
mov dword [ebp - 0x48c], eax
push eax
push 0x326
push esi
push 0x6b
push ebx
call fcn.004094a0
push dword [ebp - 0x48c]
call fcn.004141bd
add esp, 0x1c
push dword [edi + 8]
call fcn.00416ab5
push eax
call fcn.00403770
mov dword [ebp - 0x488], eax
push 0x6b
push ebx
call fcn.00409a80
add esp, 0x10
test al, al
je 0x40805f
push 0x42d738
call fcn.00408be0
mov dword [ebp - 0x48c], eax
push eax
push 0x32a
push esi
push 0x6b
push ebx
call fcn.004094a0
push dword [ebp - 0x48c]
call fcn.004141bd
add esp, 0x1c
cmp dword [ebp - 0x488], 0
jne 0x408074
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x488], eax
push 0x23
push 4
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x4080ae
push dword [ebp - 0x488]
push 0x42d704
call fcn.00408be0
mov ebx, eax
push ebx
push 0x331
push esi
push 0x23
push 4
call fcn.004094a0
push ebx
call fcn.004141bd
add esp, 0x20
push dword [ebp - 0x480]
push edi
call fcn.0040542f
pop ecx
pop ecx
call fcn.0040b08b
push dword [ebp - 0x488]
jmp 0x407d22
call fcn.00409840
mov dword [ebp - 0x70], 0x625c3a63
mov dword [ebp - 0x6c], 0x6b616572
mov dword [ebp - 0x68], 0x637673
xor eax, eax
lea edi, [ebp - 0x64]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x70]
push eax
call fcn.0040545e
pop ecx
test al, al
je 0x40828a
mov ecx, dword [0x43c180]
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc0]
push 0x19
pop ecx
cmp eax, ecx
jne 0x40826a
mov dword [ebp - 0x49c], ecx
cmp dword [ebp - 0x49c], 0
je 0x40828a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [ebp - 0x49c]
jmp 0x408143
mov eax, dword [edi + 4]
inc eax
push eax
push 0x42d700
call fcn.004164fa
pop ecx
pop ecx
test eax, eax
jne 0x408239
push dword [edi + 8]
call fcn.00416ab5
mov ebx, eax
push dword [edi + 0xc]
call fcn.00416ab5
mov dword [ebp - 0x488], eax
push dword [edi + 0x10]
call fcn.00416ab5
mov dword [ebp - 0x490], eax
push dword [edi + 0x14]
call fcn.00416ab5
mov dword [ebp - 0x48c], eax
push dword [edi + 0x18]
call fcn.00416ab5
push eax
push dword [ebp - 0x48c]
push dword [ebp - 0x490]
push dword [ebp - 0x488]
push ebx
call fcn.004073e6
dec al
movzx ebx, al
neg ebx
sbb ebx, ebx
push 0x23
push 4
call fcn.00409a80
add esp, 0x30
test al, al
je 0x408218
push 0x42d6dc
call fcn.00408be0
mov dword [ebp - 0x48c], eax
push eax
push 0x345
push esi
push 0x23
push 4
call fcn.004094a0
push dword [ebp - 0x48c]
call fcn.004141bd
add esp, 0x1c
push dword [ebp - 0x480]
push edi
call fcn.0040542f
pop ecx
pop ecx
call fcn.0040b08b
mov dword [ebp - 4], 0xfffffffe
mov eax, ebx
jmp 0x408503
mov eax, dword [edi + 4]
inc eax
push eax
push 0x42d6d8
call fcn.004164fa
pop ecx
pop ecx
test eax, eax
jne 0x4080e8
call fcn.0040651f
push dword [ebp - 0x480]
push edi
call fcn.0040542f
pop ecx
pop ecx
jmp 0x407759
mov ecx, dword [0x43c180]
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc0]
cmp eax, 0x1a
jge 0x40828a
call dword [sym.imp.KERNEL32.dll_DebugBreak]
mov dword [ebp - 0x54], 0x625c3a63
mov dword [ebp - 0x50], 0x6b616572
mov dword [ebp - 0x4c], 0x706c73
xor eax, eax
lea edi, [ebp - 0x48]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x54]
push eax
call fcn.0040545e
pop ecx
test al, al
je 0x4082f0
lea eax, [ebp - 0x54]
push eax
call fcn.004054a0
pop ecx
mov dword [ebp - 0x494], 0xc
test eax, eax
je 0x4082d4
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0
je 0x4082f0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [ebp - 0x494]
jmp 0x4082d4
mov ecx, dword [0x43c180]
mov eax, dword [ecx]
call dword [eax + 0x38]
test eax, eax
je 0x408306
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
push 0x23
pop edi
push edi
push 4
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x408341
call fcn.0040e9f8
push eax
push 0x42d6a0
call fcn.00408be0
mov ebx, eax
push ebx
push 0x389
push esi
push edi
push 4
call fcn.004094a0
push ebx
call fcn.004141bd
add esp, 0x20
call fcn.00406056
push edi
test al, al
jne 0x40838b
push 1
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x407759
call fcn.0040e9f8
push eax
push 0x42d664
call fcn.00408be0
mov ebx, eax
push ebx
push 0x38f
push esi
push edi
push 1
call fcn.004094a0
push ebx
call fcn.004141bd
add esp, 0x20
jmp 0x407759
push 4
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x4083c2
call fcn.0040e9f8
push eax
push 0x42d62c
call fcn.00408be0
mov ebx, eax
push ebx
push 0x394
push esi
push edi
push 4
call fcn.004094a0
push ebx
call fcn.004141bd
add esp, 0x20
push 0x104
lea eax, [ebp - 0x278]
push eax
call fcn.00405d37
pop ecx
pop ecx
test al, al
jne 0x408409
push edi
push 1
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x407759
lea eax, [ebp - 0x278]
push eax
push 0x42d5f8
call fcn.00408be0
mov ebx, eax
push ebx
push 0x399
jmp 0x408374
call fcn.00405540
lea eax, [ebp - 0x4c4]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x408451
push edi
push 3
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x408451
push 0x42d5cc
call fcn.00408be0
mov ebx, eax
push ebx
push 0x3a7
push esi
push edi
push 3
call fcn.004094a0
push ebx
call fcn.004141bd
add esp, 0x1c
push dword [ebp - 0x480]
push dword [ebp - 0x484]
call fcn.0040542f
pop ecx
pop ecx
call fcn.0040b08b
mov dword [ebp - 4], 0xfffffffe
jmp 0x4084cf
push edi
push 4
call fcn.00409a80
pop ecx
pop ecx
test al, al
je 0x408501
push 0x42d58c
call fcn.00408be0
mov ebx, eax
push ebx
push 0x3b1
push esi
push edi
push 4
call fcn.004094a0
push ebx
call fcn.004141bd
add esp, 0x1c
xor eax, eax
call fcn.00418a28
ret 0x10