Function at 0x401593
Capabilities:
Delete file
Execute command
Persist via windows service

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x68
mov dword [ebp - 0x44], sym.___gxx_personality_sj0
mov dword [ebp - 0x40], 0x48b664
lea eax, [ebp - 0x3c]
lea ebx, [ebp - 0x18]
mov dword [eax], ebx
mov edx, 0x4017b0
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dbg._Unwind_SjLj_Register
call dbg.__main
mov dword [ebp - 0x58], 0xffffffff
call sym.do_startup__
mov dword [esp], 0x495003
call sym._system
mov dword [esp], str.sc_stop_choko_nul
call sym._system
mov dword [esp], str.sc_delete_choko_nul
call sym._system
mov dword [esp], str.C:xtreme.sys
mov eax, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call eax
sub esp, 4
call sym.down_dri__
mov dword [esp], str.sc_create_choko_binpath__C:xtreme.sys__type_kernel_nul
call sym._system
mov dword [esp], str.sc_start_choko_nul
call sym._system
mov dword [esp], 0x1e
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp], str.sc_start_choko_nul
mov dword [ebp - 0x58], 0xffffffff
call sym._system
mov dword [esp], 0x495003
call sym._system
mov dword [esp + 4], str.Now__Start_game_manually_n
mov dword [esp], 0x494140
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call sym.find_emulator__
mov dword [esp + 4], 0x4950a3
lea eax, [ebp - 0x1c]
mov dword [esp], eax
mov dword [ebp - 0x58], 1
call method.bool_std::operator_char__std::char_traits_char___std.allocator_char____std::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
mov byte [ebp - 0x60], al
lea eax, [ebp - 0x1c]
mov ecx, eax
call fcn.0045c330
cmp byte [ebp - 0x60], 0
je 0x4016c0
mov dword [ebp - 0x58], 0xffffffff
call sym.get_sg_handle__
jmp 0x4016d1
mov dword [ebp - 0x58], 0xffffffff
call sym.en_G__
call sym.get_g_handle__
mov dword [esp], 0x5dc
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x58], 0xffffffff
call eax
sub esp, 4
mov eax, dword [0x49f024]
mov dword [esp], eax
call sym.suspend_void_
call sym.tersafe_patch__
call sym.ue4_patch__
mov eax, dword [0x49f024]
mov dword [esp], eax
call sym.resume_void_
mov dword [esp], str.sc_stop_choko_nul
call sym._system
mov dword [esp + 0xc], 0x41040
mov dword [esp + 8], 0x4950a6
mov dword [esp + 4], 0x4950b1
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov dword [esp], 0x495003
call sym._system
mov eax, dword [0x49f024]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [esp + 4], str.Press_r_to_restart_bypass............_n
mov dword [esp], 0x494140
mov dword [ebp - 0x58], 0xffffffff
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
lea eax, [ebp - 0x1d]
mov dword [esp + 4], eax
mov dword [esp], 0x493f00
call fcn.004882e0
movzx eax, byte [ebp - 0x1d]
cmp al, 0x72
jne 0x40179b
jmp 0x401647
mov dword [esp], 0x495003
mov dword [ebp - 0x58], 0xffffffff
call sym._system
jmp 0x401760