Function at 0x4c8cd0
Capabilities:
Accept command line arguments
Get common file path
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x3e0
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x3dc], eax
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x12
mov ebp, eax
xor ebx, ebx
mov esi, 0xf
push 0x7b7710
lea ecx, [esp + 0x78]
mov dword [esp + 0x40], ebp
mov dword [esp + 0x90], esi
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
call fcn.00405920
mov ecx, dword [esp + 0x3f4]
push 0x7b6590
lea eax, [esp + 0x74]
push eax
push ecx
push 0x853840
mov ecx, 0x868b78
call fcn.00406d0c
mov edi, 0x10
cmp dword [esp + 0x88], edi
jb 0x4c8d59
mov edx, dword [esp + 0x74]
push edx
call fcn.00564155
add esp, 4
mov ax, word [0x7b7724]
mov cl, byte [0x7b7726]
push str._nolog
push ebp
mov dword [0x868ecc], 1
mov word [esp + 0x3c], ax
mov byte [esp + 0x3e], cl
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1e], bl
mov byte [esp + 0x1b], 1
mov byte [esp + 0x1f], bl
call fcn.00403ec7
add esp, 8
test eax, eax
je 0x4c8da5
mov byte [esp + 0x13], bl
jmp 0x4c8e19
push 0x1c
push str.KeepMyFamilySecureProxyr.log
lea ecx, [esp + 0x78]
mov dword [esp + 0x90], esi
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
call fcn.00405920
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.00403436
add esp, 8
push eax
mov ecx, 0x868edc
call fcn.0054c840
cmp dword [esp + 0x30], edi
jb 0x4c8df7
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00564155
add esp, 4
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
cmp dword [esp + 0x88], edi
jb 0x4c8e19
mov edx, dword [esp + 0x74]
push edx
call fcn.00564155
add esp, 4
push 0x15
push str.Redirector_started__V
lea ecx, [esp + 0xcc]
mov dword [esp + 0xe4], esi
mov dword [esp + 0xe0], ebx
mov byte [esp + 0xd0], bl
call fcn.00405920
push 1
push 0x7b7768
lea ecx, [esp + 0xcc]
call fcn.004021c6
push 0x2e
push 1
lea ecx, [esp + 0xcc]
call fcn.0040323d
push 5
push str.2.4.5
lea ecx, [esp + 0xcc]
call fcn.004021c6
push 0x29
push 1
lea ecx, [esp + 0xcc]
call fcn.0040323d
push ebx
lea eax, [esp + 0xc8]
push eax
mov ecx, 0x868edc
call fcn.0054c860
push 0x1e
push str.Parental_control_solutions_Ltd
lea ecx, [esp + 0xb0]
mov dword [esp + 0xc8], esi
mov dword [esp + 0xc4], ebx
mov byte [esp + 0xb4], bl
call fcn.00405920
push 0xd
push str.Licensed_to:
lea ecx, [esp + 0x78]
mov dword [esp + 0x90], esi
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
call fcn.00405920
push ebx
lea ecx, [esp + 0xac]
push ecx
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.00402fd1
add esp, 0xc
push eax
mov ecx, 0x868edc
call fcn.0054c860
cmp dword [esp + 0x30], edi
jb 0x4c8f1d
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00564155
add esp, 4
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
cmp dword [esp + 0x88], edi
jb 0x4c8f3f
mov edx, dword [esp + 0x74]
push edx
call fcn.00564155
add esp, 4
mov dword [esp + 0x88], esi
mov dword [esp + 0x84], ebx
mov byte [esp + 0x74], bl
cmp dword [esp + 0xc0], edi
jb 0x4c8f6a
mov eax, dword [esp + 0xac]
push eax
call fcn.00564155
add esp, 4
mov eax, ebp
mov dword [esp + 0xc0], esi
mov dword [esp + 0xbc], ebx
mov byte [esp + 0xac], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4c8f84
sub eax, edx
push eax
push ebp
lea ecx, [esp + 0xb0]
call fcn.00405920
push 0x11
push str.Path_and_params:
lea ecx, [esp + 0x78]
mov dword [esp + 0x90], esi
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
call fcn.00405920
push ebx
lea ecx, [esp + 0xac]
push ecx
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.00402fd1
add esp, 0xc
push eax
mov ecx, 0x868edc
call fcn.0054c860
cmp dword [esp + 0x30], edi
jb 0x4c8ff6
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00564155
add esp, 4
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
cmp dword [esp + 0x88], edi
jb 0x4c9018
mov edx, dword [esp + 0x74]
push edx
call fcn.00564155
add esp, 4
mov dword [esp + 0x88], esi
mov dword [esp + 0x84], ebx
mov byte [esp + 0x74], bl
cmp dword [esp + 0xc0], edi
jb 0x4c9043
mov eax, dword [esp + 0xac]
push eax
call fcn.00564155
add esp, 4
lea ecx, [esp + 0xe0]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0xe0]
mov dword [esp + 0xc0], esi
mov dword [esp + 0xbc], ebx
mov byte [esp + 0xac], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4c9075
sub eax, edx
push eax
lea edx, [esp + 0xe4]
push edx
lea ecx, [esp + 0xb0]
call fcn.00405920
push 0x16
push str.Current_directory_is:
lea ecx, [esp + 0x78]
mov dword [esp + 0x90], esi
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
call fcn.00405920
push ebx
lea eax, [esp + 0xac]
push eax
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.00402fd1
add esp, 0xc
push eax
mov ecx, 0x868edc
call fcn.0054c860
cmp dword [esp + 0x30], edi
jb 0x4c90ee
mov eax, dword [esp + 0x1c]
push eax
call fcn.00564155
add esp, 4
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
cmp dword [esp + 0x88], edi
jb 0x4c9110
mov ecx, dword [esp + 0x74]
push ecx
call fcn.00564155
add esp, 4
mov dword [esp + 0x88], esi
mov dword [esp + 0x84], ebx
mov byte [esp + 0x74], bl
cmp dword [esp + 0xc0], edi
jb 0x4c913b
mov edx, dword [esp + 0xac]
push edx
call fcn.00564155
add esp, 4
push 0x11
push str.Time_since_boot:
lea ecx, [esp + 0x78]
mov dword [esp + 0x90], esi
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
call fcn.00405920
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [esp + 0x94]
push eax
call fcn.004083af
push eax
lea ecx, [esp + 0x80]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00402fd1
add esp, 0x14
push eax
mov ecx, 0x868edc
call fcn.0054c860
cmp dword [esp + 0x30], edi
jb 0x4c91a6
mov eax, dword [esp + 0x1c]
push eax
call fcn.00564155
add esp, 4
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
cmp dword [esp + 0x88], edi
jb 0x4c91c8
mov ecx, dword [esp + 0x74]
push ecx
call fcn.00564155
add esp, 4
mov dword [esp + 0x88], esi
mov dword [esp + 0x84], ebx
mov byte [esp + 0x74], bl
cmp dword [esp + 0xa4], edi
jb 0x4c91f3
mov edx, dword [esp + 0x90]
push edx
call fcn.00564155
add esp, 4
push 5
push str.PID:
lea ecx, [esp + 0x78]
mov dword [esp + 0x90], esi
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
call fcn.00405920
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 0x94]
push eax
call fcn.004083af
push eax
lea ecx, [esp + 0x80]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00402fd1
add esp, 0x14
push eax
mov ecx, 0x868edc
call fcn.0054c860
cmp dword [esp + 0x30], edi
jb 0x4c925e
mov eax, dword [esp + 0x1c]
push eax
call fcn.00564155
add esp, 4
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
cmp dword [esp + 0x88], edi
jb 0x4c9280
mov ecx, dword [esp + 0x74]
push ecx
call fcn.00564155
add esp, 4
mov dword [esp + 0x88], esi
mov dword [esp + 0x84], ebx
mov byte [esp + 0x74], bl
cmp dword [esp + 0xa4], edi
jb 0x4c92ab
mov edx, dword [esp + 0x90]
push edx
call fcn.00564155
add esp, 4
push 4
push 0x7b77ec
lea ecx, [esp + 0x78]
mov dword [esp + 0x90], esi
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
call fcn.00405920
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0xb4]
mov dword [esp + 0xcc], esi
mov dword [esp + 0xc8], ebx
mov byte [esp + 0xb8], bl
call fcn.00403fb2
mov eax, dword [esp + 0xac]
cmp dword [esp + 0xc0], edi
jae 0x4c930d
lea eax, [esp + 0xac]
push eax
call fcn.006f5389
mov eax, dword [esp + 0xb0]
add esp, 4
cmp dword [esp + 0xc0], edi
jae 0x4c932d
lea eax, [esp + 0xac]
mov ecx, dword [esp + 0xbc]
mov edx, dword [esp + 0x84]
push ecx
push eax
push edx
push ebx
lea ecx, [esp + 0x80]
call fcn.00408076
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
lea ecx, [esp + 0x18]
test eax, eax
jne 0x4c940c
push 0x16
push str.Bad_MT_string_library_
call fcn.00405920
push 1
lea eax, [esp + 0x1c]
push eax
mov ecx, 0x868edc
call fcn.0054c860
cmp dword [esp + 0x30], edi
jb 0x4c9393
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00564155
add esp, 4
cmp dword [esp + 0xc0], edi
jb 0x4c93ac
mov edx, dword [esp + 0xac]
push edx
call fcn.00564155
add esp, 4
mov dword [esp + 0xc0], esi
mov dword [esp + 0xbc], ebx
mov byte [esp + 0xac], bl
cmp dword [esp + 0x88], edi
jb 0x4c93d7
mov eax, dword [esp + 0x74]
push eax
call fcn.00564155
add esp, 4
mov dword [esp + 0x88], esi
mov dword [esp + 0x84], ebx
mov byte [esp + 0x74], bl
cmp dword [esp + 0xdc], edi
jb 0x4c9402
mov ecx, dword [esp + 0xc8]
push ecx
call fcn.00564155
add esp, 4
mov eax, 1
jmp 0x4c9d59
push 0x1d
push str.String_library_passed_MT_test
call fcn.00405920
push ebx
lea edx, [esp + 0x1c]
push edx
mov ecx, 0x868edc
call fcn.0054c860
cmp dword [esp + 0x30], edi
jb 0x4c943b
mov eax, dword [esp + 0x1c]
push eax
call fcn.00564155
add esp, 4
cmp dword [esp + 0xc0], edi
jb 0x4c9454
mov ecx, dword [esp + 0xac]
push ecx
call fcn.00564155
add esp, 4
mov dword [esp + 0xc0], esi
mov dword [esp + 0xbc], ebx
mov byte [esp + 0xac], bl
cmp dword [esp + 0x88], edi
jb 0x4c947f
mov edx, dword [esp + 0x74]
push edx
call fcn.00564155
add esp, 4
call fcn.00401384
test al, al
je 0x4c9609
call fcn.00408a76
mov ecx, eax
call fcn.00402694
push 6
push str._64bit
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.00405920
call fcn.0040151e
mov ebp, eax
mov ecx, ebp
mov dword [esp + 0xc0], esi
mov dword [esp + 0xbc], ebx
mov byte [esp + 0xac], bl
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
cmp al, bl
jne 0x4c94d5
sub ecx, edx
push ecx
push ebp
lea ecx, [esp + 0xb0]
call fcn.00405920
push 4
push 0x7b7834
lea ecx, [esp + 0x78]
mov dword [esp + 0x90], esi
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
call fcn.00405920
push ebx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0xb0]
push ecx
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x9c]
push eax
call fcn.00402fd1
add esp, 0xc
push eax
lea ecx, [esp + 0x60]
push ecx
call fcn.00402fd1
add esp, 0xc
push eax
mov ecx, 0x868edc
call fcn.0054c860
cmp dword [esp + 0x6c], edi
jb 0x4c955d
mov edx, dword [esp + 0x58]
push edx
call fcn.00564155
add esp, 4
mov dword [esp + 0x6c], esi
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
cmp dword [esp + 0xa4], edi
jb 0x4c9582
mov eax, dword [esp + 0x90]
push eax
call fcn.00564155
add esp, 4
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa0], ebx
mov byte [esp + 0x90], bl
cmp dword [esp + 0x88], edi
jb 0x4c95ad
mov ecx, dword [esp + 0x74]
push ecx
call fcn.00564155
add esp, 4
mov dword [esp + 0x88], esi
mov dword [esp + 0x84], ebx
mov byte [esp + 0x74], bl
cmp dword [esp + 0xc0], edi
jb 0x4c95d8
mov edx, dword [esp + 0xac]
push edx
call fcn.00564155
add esp, 4
mov dword [esp + 0xc0], esi
mov dword [esp + 0xbc], ebx
mov byte [esp + 0xac], bl
cmp dword [esp + 0x30], edi
jb 0x4c9684
mov eax, dword [esp + 0x1c]
push eax
call fcn.00564155
add esp, 4
jmp 0x4c9684
push ebx
call fcn.0040151e
push eax
lea ecx, [esp + 0x20]
call fcn.004062df
push eax
push str.OS:
lea ecx, [esp + 0x60]
call fcn.004062df
push eax
lea ecx, [esp + 0x98]
push ecx
call fcn.00402fd1
add esp, 0xc
push eax
mov ecx, 0x868edc
call fcn.0054c860
cmp dword [esp + 0xa4], edi
jb 0x4c965d
mov edx, dword [esp + 0x90]
push edx
call fcn.00564155
add esp, 4
lea ecx, [esp + 0x54]
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa0], ebx
mov byte [esp + 0x90], bl
call fcn.00402ed7
lea ecx, [esp + 0x18]
call fcn.00402ed7
mov byte [esp + 0x12], 1
cmp byte [esp + 0x13], bl
je 0x4c971e
call fcn.004074d7
push eax
call fcn.0040806c
add esp, 4
test al, al
je 0x4c971e
lea eax, [esp + 0x13]
push eax
call fcn.00404192
add esp, 4
mov byte [esp + 0x12], al
lea ecx, [esp + 0x8c]
cmp byte [esp + 0x13], bl
je 0x4c96d9
push str.Failed_getting_UAC_status_
call fcn.004062df
push 1
lea ecx, [esp + 0x90]
push ecx
jmp 0x4c9708
cmp byte [esp + 0x12], bl
jne 0x4c96f5
push str.UAC_not_elevated_
call fcn.004062df
push 1
lea edx, [esp + 0x90]
push edx
jmp 0x4c9708
push str.UAC_is_elevated__this_is_good
call fcn.004062df
push ebx
lea eax, [esp + 0x90]
push eax
mov ecx, 0x868edc
call fcn.0054c860
lea ecx, [esp + 0x8c]
call fcn.00402ed7
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x34]
push ecx
push edx
call fcn.00403a3a
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x4c9826
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.UnregServer
push esi
call edi
test eax, eax
je 0x4c987a
push str.RegServer
push esi
call edi
test eax, eax
je 0x4c9909
push 0x7b795c
push esi
call edi
test eax, eax
je 0x4c994d
push str.Auto
push esi
call fcn.005687ea
add esp, 8
test eax, eax
jne 0x4c9787
mov byte [esp + 0x15], 1
push str.NoStop
push esi
call fcn.005687ea
add esp, 8
test eax, eax
jne 0x4c979e
mov byte [esp + 0x14], 1
push 0x7b7a0c
push esi
call fcn.005687ea
add esp, 8
test eax, eax
jne 0x4c97b5
mov byte [esp + 0x16], 1
push str.NoSafeMode
push esi
call fcn.005687ea
add esp, 8
test eax, eax
jne 0x4c97cc
mov byte [esp + 0x17], 1
push str.IsInstalled
push esi
call fcn.005687ea
add esp, 8
test eax, eax
je 0x4c99cc
push str.IsOtherInstalled
push esi
call fcn.005687ea
add esp, 8
test eax, eax
je 0x4c9a47
push str.Replace
push esi
call fcn.005687ea
add esp, 8
test eax, eax
je 0x4c9ac2
lea eax, [esp + 0x34]
push eax
push esi
call fcn.00403a3a
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x4c9740
push ebx
call fcn.00403b70
add esp, 4
test al, al
je 0x4c9b25
push str.Service_already_running__exiting
lea ecx, [esp + 0x90]
call fcn.004062df
push ebx
lea ecx, [esp + 0x90]
push ecx
mov ecx, 0x868edc
call fcn.0054c860
lea ecx, [esp + 0x8c]
call fcn.00402ed7
lea ecx, [esp + 0xc4]
call fcn.00402ed7
xor eax, eax
jmp 0x4c9d59
cmp byte [esp + 0x12], bl
jne 0x4c98d4
push str.Must_have_UAC_to_unistall
lea ecx, [esp + 0x90]
call fcn.004062df
push 1
lea ecx, [esp + 0x90]
push ecx
mov ecx, 0x868edc
call fcn.0054c860
lea ecx, [esp + 0x8c]
call fcn.00402ed7
push 0x7b78bc
call fcn.00567321
add esp, 4
lea ecx, [esp + 0xc4]
call fcn.00402ed7
mov eax, 1
jmp 0x4c9d59
mov ecx, 0x868b78
call fcn.00407f8b
test eax, eax
jge 0x4c98e9
push str.Failed_to_uninstall_service_n
jmp 0x4c98b6
push str.Service_uninstalled_successfuly_n
call fcn.00567321
add esp, 4
lea ecx, [esp + 0xc4]
call fcn.00402ed7
xor eax, eax
jmp 0x4c9d59
push str._RegServer_flag_not_support_
lea ecx, [esp + 0x90]
call fcn.004062df
push 1
lea edx, [esp + 0x90]
push edx
mov ecx, 0x868edc
call fcn.0054c860
lea ecx, [esp + 0x8c]
call fcn.00402ed7
lea ecx, [esp + 0xc4]
call fcn.00402ed7
xor eax, eax
jmp 0x4c9d59
cmp byte [esp + 0x12], bl
jne 0x4c998e
push str.Must_have_UAC_to_install
lea ecx, [esp + 0x90]
call fcn.004062df
push 1
lea eax, [esp + 0x90]
push eax
mov ecx, 0x868edc
call fcn.0054c860
lea ecx, [esp + 0x8c]
call fcn.00402ed7
push 0x7b7990
jmp 0x4c98b6
movzx ecx, byte [esp + 0x17]
movzx edx, byte [esp + 0x16]
movzx eax, byte [esp + 0x14]
push ecx
movzx ecx, byte [esp + 0x19]
push edx
push eax
push ecx
push 1
push 1
mov ecx, 0x868b78
call fcn.00405ac9
test eax, eax
jge 0x4c99c2
push 0x7b79c0
jmp 0x4c98b6
push 0x7b79dc
jmp 0x4c98ee
mov ecx, 0x868b78
call fcn.0040768f
lea ecx, [esp + 0x8c]
test eax, eax
je 0x4c9a14
push str.Service_process_installed
call fcn.004062df
push ebx
lea edx, [esp + 0x90]
push edx
mov ecx, 0x868edc
call fcn.0054c860
lea ecx, [esp + 0x8c]
call fcn.00402ed7
push str.Service_process_installed_n
jmp 0x4c98ee
push str.Service_process_not_installed
call fcn.004062df
push ebx
lea eax, [esp + 0x90]
push eax
mov ecx, 0x868edc
call fcn.0054c860
lea ecx, [esp + 0x8c]
call fcn.00402ed7
push str.Service_process_not_installed_n
jmp 0x4c98b6
mov ecx, 0x868b78
call fcn.00401e47
lea ecx, [esp + 0x8c]
test eax, eax
je 0x4c9a8f
push str.Other_SDK_installed
call fcn.004062df
push ebx
lea ecx, [esp + 0x90]
push ecx
mov ecx, 0x868edc
call fcn.0054c860
lea ecx, [esp + 0x8c]
call fcn.00402ed7
push str.Other_SDK_installed_n
jmp 0x4c98ee
push str.Other_SDK_not_installed
call fcn.004062df
push ebx
lea edx, [esp + 0x90]
push edx
mov ecx, 0x868edc
call fcn.0054c860
lea ecx, [esp + 0x8c]
call fcn.00402ed7
push str.Other_SDK_not_installed_n
jmp 0x4c98b6
cmp byte [esp + 0x12], bl
jne 0x4c9b03
push str.Must_have_UAC_to_replace
lea ecx, [esp + 0x90]
call fcn.004062df
push 1
lea eax, [esp + 0x90]
push eax
mov ecx, 0x868edc
call fcn.0054c860
lea ecx, [esp + 0x8c]
call fcn.00402ed7
push str.You_must_have_UAC_privileges_for_this_command__n
jmp 0x4c98b6
mov ecx, 0x868b78
call fcn.00406258
test eax, eax
jge 0x4c9b1b
push str.Failed_to_install_service_n
jmp 0x4c98b6
push str.Service_installed_successfuly_n
jmp 0x4c98ee
push 0x20019
push 0x7b7bec
push accept
lea ecx, [esp + 0x50]
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
call fcn.00402185
mov esi, eax
cmp esi, ebx
je 0x4c9b81
push str.Error_openning_key_HKEY_CLASSES_ROOT_
lea ecx, [esp + 0x90]
call fcn.004062df
push 1
lea edx, [esp + 0x90]
push edx
mov ecx, 0x868edc
call fcn.0054c860
lea ecx, [esp + 0x8c]
call fcn.00402ed7
jmp 0x4c9d42
mov eax, dword [esp + 0x44]
push 0x20019
push 0x7b7c1c
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
call fcn.00402185
mov esi, eax
cmp esi, ebx
je 0x4c9bdd
push str.Error_openning_key_keyAppID_
lea ecx, [esp + 0x90]
call fcn.004062df
push 1
lea ecx, [esp + 0x90]
push ecx
mov ecx, 0x868edc
call fcn.0054c860
lea ecx, [esp + 0x8c]
call fcn.00402ed7
jmp 0x4c9d39
lea edx, [esp + 0x50]
push edx
push 0x7b7c64
lea eax, [esp + 0x2f0]
mov esi, 0x104
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x5c], esi
call fcn.00407d83
mov dword [0x868ecc], ebx
lea ecx, [esp + 0x8c]
cmp eax, ebx
jne 0x4c9c47
push str.Configured_to_run_as_a_service
call fcn.004062df
push ebx
lea ecx, [esp + 0x90]
push ecx
mov ecx, 0x868edc
call fcn.0054c860
lea ecx, [esp + 0x8c]
call fcn.00402ed7
mov dword [0x868ecc], 1
jmp 0x4c9c70
push str.Configured_to_run_as_a_server
call fcn.004062df
push ebx
lea edx, [esp + 0x90]
push edx
mov ecx, 0x868edc
call fcn.0054c860
lea ecx, [esp + 0x8c]
call fcn.00402ed7
lea eax, [esp + 0x4c]
push eax
push 0x7b7cb4
lea ecx, [esp + 0x1ec]
push ecx
lea ecx, [esp + 0x48]
mov dword [esp + 0x58], esi
call fcn.00407d83
test eax, eax
jne 0x4c9ce9
lea edx, [esp + 0x1e4]
push edx
lea ecx, [esp + 0x58]
call fcn.004062df
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x90]
push ecx
call fcn.00404539
add esp, 8
lea ecx, [esp + 0x54]
call fcn.00402ed7
cmp dword [esp + 0xa0], ebx
je 0x4c9cdd
lea edx, [esp + 0x8c]
push edx
mov ecx, 0x868b78
call fcn.004071e9
lea ecx, [esp + 0x8c]
call fcn.00403a26
cmp dword [0x868ecc], ebx
je 0x4c9d29
push 0x7b7cc4
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x40], ebx
call fcn.00408cb0
test eax, eax
mov eax, dword [esp + 0x38]
jne 0x4c9d1b
cmp eax, ebx
setne cl
mov byte [0x868ed8], cl
cmp eax, ebx
je 0x4c9d29
mov dword [0x868eb4], 4
mov ecx, 0x868b78
call fcn.0040270c
mov esi, dword [0x868eb8]
lea ecx, [esp + 0x3c]
call fcn.00406226
lea ecx, [esp + 0x44]
call fcn.00406226
lea ecx, [esp + 0xc4]
call fcn.00402ed7
mov eax, esi
mov ecx, dword [esp + 0x3ec]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00564b24
add esp, 0x3e0
ret 0x10