Function at 0x401000
Capabilities:
Set environment variable
Start service

Disassembly:
call sub.kernel32.dll_GetUserDefaultLCID
cmp eax, 0xfffffef7
jne 0x401075
call sub.user32.dll_CharNextA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.user32.dll_CharNextA
call sub.advapi32.dll_StartServiceA
call sub.advapi32.dll_StartServiceA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.user32.dll_CharNextA
call sub.advapi32.dll_StartServiceA
call sub.advapi32.dll_StartServiceA
call sub.user32.dll_CharNextA
call sub.user32.dll_CharNextA
call sub.advapi32.dll_StartServiceA
call sub.user32.dll_CharNextA
ret
call sub.user32.dll_GetProcessWindowStation
cmp eax, 0xffffff1b
jne 0x4010ea
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.advapi32.dll_StartServiceA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.user32.dll_CharNextA
call sub.advapi32.dll_StartServiceA
call sub.user32.dll_CharNextA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.user32.dll_CharNextA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.advapi32.dll_StartServiceA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.advapi32.dll_StartServiceA
call sub.advapi32.dll_StartServiceA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.user32.dll_CharNextA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.advapi32.dll_StartServiceA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
ret
call sub.kernel32.dll_GetUserDefaultLCID
cmp eax, 0xffffff30
jne 0x401196
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.advapi32.dll_StartServiceA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.advapi32.dll_StartServiceA
call sub.user32.dll_CharNextA
call sub.user32.dll_CharNextA
call sub.advapi32.dll_StartServiceA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.advapi32.dll_StartServiceA
call sub.advapi32.dll_StartServiceA
call sub.advapi32.dll_StartServiceA
call sub.user32.dll_CharNextA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.user32.dll_CharNextA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.user32.dll_CharNextA
call sub.advapi32.dll_StartServiceA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.user32.dll_CharNextA
ret
call sub.kernel32.dll_GetVersion
cmp eax, 0xfffffedf
jne 0x40123d
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.user32.dll_CharNextA
call sub.advapi32.dll_StartServiceA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.advapi32.dll_StartServiceA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.advapi32.dll_StartServiceA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.advapi32.dll_StartServiceA
call sub.user32.dll_CharNextA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.advapi32.dll_StartServiceA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.user32.dll_CharNextA
call sub.user32.dll_CharNextA
call sub.advapi32.dll_StartServiceA
call sub.user32.dll_CharNextA
call sub.kernel32.dll_SetEnvironmentVariableA
ret
jmp 0x49858a
mov ebx, edi
not edi
sub ebx, 0xe24e451f
xchg ecx, edx
mov edi, edx
jmp 0x49a091
pop ecx
sub edx, esi
add ebx, edi
sub ebx, 0xe620001b
add edi, esi
not edi
or ebx, edx
jmp 0x499f96
push 0xe25ca72d
or ebx, edx
mov ebx, esi
or ebx, edx
xchg esi, edi
xor esi, 0xe6237ee8
mov edx, ebx
shl esi, 1
sub esi, ebx
sub edx, 0xe6252120
add esi, ebx
inc edi
mov edx, ebx
jmp 0x49a6e7
push 0xe261b6d3
xor ebx, esi
inc esi
sub edx, edi
shl edi, 0xb
sub ebx, edi
add esi, edi
mov edx, 0xe6887faf
not ebx
nop
xchg edi, edx
xchg edi, esi
add ebx, edx
jmp 0x499539
mov ecx, 0x2774562b
xchg ebx, esi
and edx, esi
xchg esi, ebx
dec ebx
add esi, edx
xor edx, 0xe6b15ae9
mov edx, 0xe6b1f385
xor esi, 0xe6b2597f
add ebx, esi
xchg edi, esi
or esi, edx
ror edi, 0x1b
xor ebx, esi
jmp 0x49acde
pop ecx
bswap esi
sub edi, edx
mov ebx, esi
or edi, edx
neg esi
mov edi, edx
jmp 0x498d32
call fcn.00499480
xor ebx, esi
xchg esi, edx
and esi, ebx
or ebx, edx
sub edi, 0xe7031d9b
shl edx, 2
inc ebx
add edx, 0xe7044cf5
dec edi
or ebx, edi
xor ebx, esi
xchg edi, edx
jmp 0x499972
call ecx
bswap esi
or edx, ebx
bswap edi
sub esi, 0xe715fa91
sub esi, edi
add edi, esi
sub edx, esi
and ebx, edx
xor edx, edi
sub ebx, edx
or esi, edx
and edi, ebx
add edx, edi
and edx, esi
jmp 0x49986d
push 0xe25fd292
and edi, ebx
or esi, edx
and esi, edx
xor edi, edx
xchg edx, esi
add edx, edi
dec edx
mov esi, edx
and edx, esi
jmp 0x498f2c
pop ecx
neg edi
and edx, edi
xchg edx, edi
sub edi, 0xe721c836
xor edx, esi
or edx, edi
ror ebx, 0xc
rol ebx, 0x14
dec ebx
ror edi, 0x15
inc esi
and edx, ebx
jmp 0x4988f7
pop ecx
xor ebx, 0xe73a4e63
and ebx, edx
add edi, ebx
xchg edi, esi
sub edx, esi
sub esi, ebx
add ebx, edi
sub edi, ebx
shr ebx, 5
or edx, esi
mov ebx, 0xe73eb923
sub edi, ebx
add esi, edx
sub ebx, 0xe73fe71d
jmp 0x49a6aa
mov ecx, 0x123b2f04
add edx, ebx
or ebx, edx
mov esi, ebx
mov edi, ebx
and ebx, 0xe76422f6
xchg ebx, edi
xchg esi, edx
shr ebx, 0xa
and ebx, 0xe765d670
mov edi, ebx
xor edx, esi
xchg esi, edx
shr edi, 1
or edi, ebx
sub edx, ebx
jmp 0x498c72
mov ecx, 0x2774562b
neg ebx
mov edi, 0xe76997e0
sub ebx, esi
rol edx, 0x12
not esi
xor edx, edi
bswap esi
jmp 0x4996f1
push 0xe256cce4
and esi, ebx
or esi, edi
or ebx, 0xe7842e0a
mov esi, edi
or ebx, edx
or esi, 0xe7859b35
or edi, 0xe785fddd
xor ebx, edx
xchg edi, ebx
sub edi, 0xe787802a
or esi, 0xe787fff9
mov ebx, esi
add edi, 0xe788cc5c
jmp 0x49a9b0
call fcn.00499480
xchg edi, edx
xor edx, esi
sub ebx, edi
or edi, ebx
xor edi, esi
mov edi, esi
xchg esi, edi
inc esi
sub edi, edx
sub ebx, esi
and esi, 0xe7c35b0c
jmp 0x498cf0
push 0xe2620601
or ebx, 0xe836dce2
mov esi, ebx
sub ebx, esi
sub edx, edi
ror ebx, 0x1a
inc edi
jmp 0x49a146
pop ecx
xor edi, ebx
xor edx, ebx
sub edi, esi
and ebx, esi
and esi, edx
and esi, edi
or esi, edi
and edx, edi
jmp 0x499a55
call fcn.00499480
xchg esi, ebx
mov esi, 0xe873a81d
and edx, ebx
add edx, ebx
mov edx, ebx
jmp 0x49a210
pop ecx
add esi, 0xe87be557
xor edi, 0xe87c55ff
and esi, ebx
sub ebx, esi
or ebx, esi
and esi, edi
rol edi, 0x16
jmp 0x498614
call fcn.00499480
or edi, 0xe87f15e3
xor esi, edx
add esi, edi
and esi, 0xe8804f8d
xchg esi, edi
or edi, esi
inc esi
mov esi, edi
jmp 0x49af34
mov ecx, 0x123b2f04
xor edi, ebx
shl edi, 6
mov esi, 0xe883439b
mov edi, edx
shl edi, 6
add edi, ebx
shl ebx, 0x1d
and edx, 0xe887791f
and edx, ebx
mov ebx, edx
jmp 0x499744
pop ecx
bswap edx
dec ebx
jmp 0x49af06
call ecx
add edi, edx
ror esi, 0x16
xchg edi, esi
mov esi, edi
and edx, 0xe8cab687
and edi, ebx
neg edi
jmp 0x49b04d
pop ecx
sub edi, ebx
bswap esi
mov edi, 0xe91ccaeb
sub ebx, edx
xor esi, edi
mov esi, 0xe9418105
or edi, ebx
sub ebx, edx
and esi, ebx
xchg edi, esi
add edi, edx
or ebx, esi
sub ebx, edi
xchg edx, ebx
sub edi, 0xe94bb833
jmp 0x498de0
mov ecx, 0x2774562b
neg ebx
rol edi, 0x13
or edx, edi
and edi, 0xe96e3e23
add edx, edi
or edi, esi
xchg esi, edx
jmp 0x499192
push 0xe2576adf
dec edi
neg edx
or edx, ebx
add ebx, edx
shr ebx, 0x1e
or esi, 0xe9b6cd2b
mov esi, edx
and edi, edx
add edx, esi
dec esi
jmp 0x49a2ff
push 0xe25f81a1
not ebx
ror edx, 0x1b
xor edi, ebx
add edx, ebx
and edx, edi
sub esi, edi
xchg ebx, edi
add ebx, esi
or edi, esi
sub edi, esi
xor edi, esi
nop
sub ebx, 0xe9fa0622
and edx, esi
jmp 0x498d17
push 0xe254dba8
sub ebx, 0xea1779cd
add ebx, 0xea1b7a32
xchg esi, edi
and edi, 0xea1c4cf9
shl esi, 0xd
xchg esi, edx
or edi, esi
mov edi, edx
add esi, edx
xor esi, ebx
mov edi, esi
bswap edi
sub esi, ebx
or edx, esi
neg edx
add esi, edx
jmp 0x499b84
push 0xe262502e
or edx, 0xea34b9b3
mov edx, edi
ror edx, 0x11
and ebx, edi
or ebx, edx
xor esi, edx
xor edx, edi
inc edi
xchg esi, ebx
and ebx, edx
jmp 0x498a09
call ecx
sub edi, 0xea4e2d34
xchg ebx, edi
bswap esi
jmp 0x498ba0
push 0xe257b5a0
and edi, esi
xor ebx, edx
mov esi, ebx
neg ebx
sub edx, esi
shl edi, 9
mov esi, edx
ror edi, 0x13
xchg edi, esi
jmp 0x499765
pop ecx
not ebx
shl ebx, 0x1b
sub edi, edx
add esi, 0xeafb2ba5
mov edx, edi
xor esi, ebx
add edx, esi
and esi, 0xeafcd94a
inc esi
jmp 0x499727
push 0xe25cf0fb
inc ebx
xchg ebx, esi
sub edi, ebx
sub esi, edi
xor edx, 0xeb02ba52
xchg esi, ebx
xor ebx, 0xeb0386fc
shr edx, 6
bswap ebx
and esi, edi
jmp 0x49ac59
push 0xe2571c68
and esi, ebx
sub esi, ebx
and edx, ebx
bswap edi
shl edx, 6
or esi, edi
bswap edx
sub ebx, edi
shl edx, 0xa
sub esi, edx
sub ebx, esi
xor edx, esi
jmp 0x499db3
push 0xe25d467b
sub edx, edi
neg ebx
mov ebx, esi
xor edx, 0xebbb000e
sub esi, edx
jmp 0x498efa
jmp loc.004a081d
pop ecx
shr edx, 0x18
or esi, edx
dec esi
or edi, ebx
or edx, edi
mov edi, esi
sub esi, edi
shl esi, 6
ror edi, 8
or ebx, edi
jmp 0x4985fe
push 0xe2568215
or esi, edi
bswap edi
inc ebx
add esi, edi
jmp 0x498fd3
call ecx
add ebx, esi
or ebx, 0xec1e42f5
mov edx, 0xec1ea90b
or edx, esi
or esi, edx
and esi, 0xec200917
xchg edx, esi
jmp 0x499599
pop ecx
xchg ebx, edi
or edi, esi
sub esi, 0xec459e1a
not esi
jmp 0x49ae71