Function at 0x410d50
Capabilities:
Create process on windows
Query service status
Read .ini file
Start service

Disassembly:
mov eax, dword [0x42902c]
sub esp, 0x280
cmp eax, 8
push ebx
push ebp
push esi
push edi
jle 0x411053
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
mov dword [esp + 0x10], edi
jne 0x410d88
push str._____Open_ScManager_Failed__n
jmp 0x410f15
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, dword [sym.imp.MSVCRT.dll__mbsrchr]
mov dword [esp + 0x14], 0
jmp 0x410da2
mov edi, dword [esp + 0x10]
push 0x14
push str.RfwService
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x410ef2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x410e9e
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x8a]
mov byte [esp + 0x88], 0x22
mov byte [esp + 0x89], 0
push 0x208
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x8d]
push eax
push esi
call ebp
lea ecx, [esp + 0x88]
push 0x5c
push ecx
call ebx
mov byte [eax + 1], 0
mov eax, dword [0x4232cc]
add esp, 8
cmp eax, 1
push 0x208
jne 0x410e2e
lea edx, [esp + 0x8c]
push str.rfwsrv.exe___install
push edx
jmp 0x410e3b
lea eax, [esp + 0x8c]
push str.rfwsrv.exe___installManual
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcat]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x50]
add esp, 0xc
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
lea edx, [esp + 0x44]
push ecx
push edx
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0xa8]
mov dword [esp + 0x64], 0x44
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x410e9e
mov ecx, dword [esp + 0x18]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esp + 0x18]
push eax
call edi
mov edi, dword [esp + 0x14]
push 0x3e8
inc edi
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 2
jb 0x410d9e
test esi, esi
jne 0x410eee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov esi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp esi, 5
jne 0x410ee7
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x280
ret
push str._____Open_service_Failed__n
jmp 0x410f15
mov edi, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea edx, [esp + 0x28]
push edx
push esi
call ebp
test eax, eax
jne 0x410f2a
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
push str._____Query_service_stat_Failed__n
call fcn.004011d0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x280
ret
mov eax, dword [esp + 0x2c]
cmp eax, 1
jne 0x411002
mov edi, dword [sym.imp.ADVAPI32.dll_StartServiceA]
push 0
push 0
push esi
call edi
test eax, eax
jne 0x410fae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x410fae
cmp eax, 0x41f
jne 0x410f83
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebx
push 0
push 0
push esi
call edi
test eax, eax
jne 0x410fb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x41f
je 0x410f5c
jmp 0x410f89
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x410fb4
cmp eax, 0x420
je 0x410fb4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
push str._____start_service_Failed__n
jmp 0x410f15
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call ebx
lea ecx, [esp + 0x28]
push ecx
push esi
call ebp
test eax, eax
jne 0x410fda
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov edx, dword [esp + 0x10]
push edx
jmp 0x410f0e
mov eax, dword [esp + 0x2c]
mov edi, 2
cmp eax, edi
jne 0x41102c
push 0x3e8
call ebx
lea eax, [esp + 0x28]
push eax
push esi
call ebp
test eax, eax
je 0x41102c
cmp dword [esp + 0x2c], edi
je 0x410fe7
jmp 0x41102c
cmp eax, 4
je 0x41102c
cmp eax, 4
je 0x41102c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x28]
push ecx
push esi
call ebp
test eax, eax
je 0x41102c
mov eax, dword [esp + 0x2c]
cmp eax, 1
jne 0x411007
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
mov ecx, dword [esp + 0x2c]
xor eax, eax
pop edi
cmp ecx, 4
pop esi
pop ebp
sete al
pop ebx
add esp, 0x280
ret
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0x4259b8
push 0
push str.RfwService
push str.WINHANDLE
call ebp
mov esi, eax
test esi, esi
je 0x41109d
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41109d
push str.RisingRfwWnd
push esi
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je 0x41109d
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x280
ret
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x8a]
mov byte [esp + 0x88], 0x22
mov byte [esp + 0x89], 0
push 0x208
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x8d]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x88]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll__mbsrchr]
push 0x208
lea edx, [esp + 0x94]
push str.rfwsrv.exe___start
push edx
mov byte [eax + 1], 0
call dword [sym.imp.MSVCRT.dll__mbsnbcat]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x58]
add esp, 0x14
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
lea ecx, [esp + 0x44]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0xa4]
push 0
push edx
push 0
mov dword [esp + 0x6c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x411163
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
call esi
push 0x3e8
call ebx
xor edi, edi
push 0x4259b8
push 0
push str.RfwService
push str.WINHANDLE
call ebp
mov esi, eax
test esi, esi
je 0x41119d
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41119d
push str.RisingRfwWnd
push esi
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
jne 0x41108d
push 0x3e8
call ebx
inc edi
cmp edi, 0x1e
jl 0x411165
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x280
ret