Function at 0x403bf0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x3c80
call fcn.00406b60
push ebx
push ebp
push esi
push edi
push 0x4147e0
lea eax, [esp + 0x1fc]
push str.Service__s_started.
push eax
call fcn.00405e3a
lea ecx, [esp + 0x204]
push ecx
call fcn.004020a0
push 0x4147e0
lea edx, [esp + 0x20c]
push str.chServiceName:_________s
push edx
call fcn.00405e3a
lea eax, [esp + 0x214]
push eax
call fcn.004020a0
push 0x415000
lea ecx, [esp + 0x21c]
push str.chServiceDisplayName:__s
push ecx
call fcn.00405e3a
lea edx, [esp + 0x224]
push edx
call fcn.004020a0
push 0x413fe0
lea eax, [esp + 0x22c]
push str.chServicePath:_________s
push eax
call fcn.00405e3a
lea ecx, [esp + 0x234]
push ecx
call fcn.004020a0
add esp, 0x40
push 0x414c00
lea edx, [esp + 0x1fc]
push str.chSIniFileNam:_________s
push edx
call fcn.00405e3a
lea eax, [esp + 0x204]
push eax
call fcn.004020a0
push 0x415400
lea ecx, [esp + 0x20c]
push str.chIniFilePath:_________s
push ecx
call fcn.00405e3a
lea edx, [esp + 0x214]
push edx
call fcn.004020a0
push 0x1388
xor ebx, ebx
push ebx
push 2
call fcn.00402ac0
push 0x415400
call fcn.004010a0
add esp, 0x30
test eax, eax
push 0x415400
jne 0x403d45
push str.Error:_File__s_not_found.
lea eax, [esp + 0x200]
push 0x1386
push eax
call fcn.004021b0
lea ecx, [esp + 0x208]
push ecx
call fcn.004020a0
push 0x411c5c
call fcn.004020a0
add esp, 0x18
call fcn.004054d0
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1386
lea edx, [esp + 0x2910]
push edx
push 0x411c7c
push str.ServiceProcesses
push 0x411ca4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, 0x411cac
lea eax, [esp + 0x2908]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403d97
cmp cl, bl
je 0x403d93
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403d97
add eax, 2
add esi, 2
cmp cl, bl
jne 0x403d73
xor eax, eax
jmp 0x403d9c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x403de6
push 0x415400
push str.Error:_Key_ServiceProcesses_not_found_in_section__General__in_file__s.
lea eax, [esp + 0x200]
push 0x1386
push eax
call fcn.004021b0
lea ecx, [esp + 0x208]
push ecx
call fcn.004020a0
push str.Error:_Dont_know_what_to_do_
call fcn.004020a0
add esp, 0x18
call fcn.004054d0
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x2908]
push edx
push str.ServiceProcesses:______s
lea eax, [esp + 0x1588]
push 0x1388
push eax
call fcn.004021b0
lea ecx, [esp + 0x1590]
push ecx
call fcn.004020a0
push 0x1388
push ebx
push 2
call fcn.00402ac0
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esp, 0x20
push 0x415400
push ebx
push str.StartUpPause
push 0x411d58
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
cmp esi, ebx
je 0x403eda
push esi
push str.StartUpPause_value_is__d_seconds.
lea edx, [esp + 0x1588]
push 0x1388
push edx
call fcn.004021b0
lea eax, [esp + 0x1590]
push eax
call fcn.004020a0
push esi
push 0x411d84
lea ecx, [esp + 0x159c]
push 0x1387
push ecx
call fcn.004021b0
lea edx, [esp + 0x15a4]
push edx
call fcn.004020a0
push 0x1388
push ebx
push 2
call fcn.00402ac0
imul esi, esi, 0x3e8
add esp, 0x34
cmp esi, ebx
jbe 0x403eda
dec esi
mov eax, 0x10624dd3
mul esi
mov esi, edx
shr esi, 6
inc esi
lea esp, [esp]
push 0x3e8
call edi
push 0x1388
push ebx
push 2
call fcn.00402ac0
add esp, 0xc
dec esi
jne 0x403ec0
push 0x415400
push ebx
push str.CreateProcessPause
push str.General
call ebp
cmp eax, ebx
mov dword [esp + 0x1c], eax
je 0x403f29
push eax
push str.CreateProcessPause_value_is__d_seconds.
lea eax, [esp + 0x1588]
push 0x1388
push eax
call fcn.004021b0
lea ecx, [esp + 0x1590]
push ecx
call fcn.004020a0
push 0x1388
push ebx
push 2
call fcn.00402ac0
add esp, 0x20
push str.Starting_service_processes...
call fcn.004020a0
push 0x1388
push ebx
push 2
call fcn.00402ac0
push 0x411e04
push 0x64
lea edx, [esp + 0x80]
push edx
lea eax, [esp + 0x2924]
push eax
mov dword [0x413ed4], ebx
xor ebp, ebp
call fcn.00405520
add esp, 0x20
cmp eax, ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebx
jle 0x404653
jmp 0x403f80
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + ecx*4 + 0x68]
cmp eax, ebx
je 0x40462e
push eax
push str.Field:__s_n
call fcn.00406142
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + edx*4 + 0x70]
push eax
push str.Retrieving_parameters_for_process__s...
lea ecx, [esp + 0x1590]
push 0x1388
push ecx
call fcn.004021b0
lea edx, [esp + 0x1598]
push edx
call fcn.004020a0
push 0x38
call fcn.00405b95
mov esi, eax
add esp, 0x20
cmp esi, ebx
je 0x40466a
xor eax, eax
mov ecx, 0xe
mov edi, esi
rep stosd dword es:[edi], eax
cmp dword [0x413ed4], ebx
jne 0x403ff5
mov dword [0x413ed4], esi
cmp ebp, ebx
je 0x403ffc
mov dword [ebp], esi
mov edi, dword [esp + 0x14]
mov dword [esi], ebx
mov eax, dword [esp + edi*4 + 0x68]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x404010
sub eax, edx
add eax, 2
push eax
call fcn.00405b95
add esp, 4
cmp eax, ebx
mov dword [esi + 0x20], eax
je 0x404671
mov ecx, dword [esp + edi*4 + 0x68]
mov edx, eax
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x404036
mov eax, dword [esi + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0x415400
push ebx
push str.FailStrategy
push eax
call edi
mov ecx, dword [esi + 0x20]
push 0x415400
push 0x15f90
push str.RestartTimeMS
push ecx
mov dword [esi + 0x30], eax
call edi
push 0x415400
push 0x1386
lea edx, [esp + 0x200]
push edx
push 0x411e98
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x20]
push str.ApplicationName
push eax
call fcn.00402780
add esp, 0x18
mov edi, 0x411ebc
lea eax, [esp + 0x1f8]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x4040ca
cmp cl, bl
je 0x4040c6
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x4040ca
add eax, 2
add edi, 2
cmp cl, bl
jne 0x4040a6
xor eax, eax
jmp 0x4040cf
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x404115
mov eax, dword [esi + 0x20]
push 0x415400
push eax
push str.Key_ApplicationName_not_found_in_section___s__in_file__s.
lea ecx, [esp + 0x204]
push 0x1388
push ecx
call fcn.004021b0
lea edx, [esp + 0x20c]
push edx
call fcn.004020a0
push str.Assuming_ApplicationName_NULL_.
call fcn.004020a0
add esp, 0x1c
mov dword [esi + 0x24], ebx
jmp 0x4041ae
lea eax, [esp + 0x1f8]
push eax
push str.ApplicationName:__s
lea ecx, [esp + 0x1588]
push 0x1388
push ecx
call fcn.004021b0
lea edx, [esp + 0x1590]
push edx
call fcn.004020a0
lea eax, [esp + 0x20c]
add esp, 0x14
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x404150
sub eax, edx
jne 0x40416d
push str.ApplicationName_NULL_.
mov dword [esi + 0x24], ebx
call fcn.004020a0
add esp, 4
jmp 0x4041ae
add eax, 2
push eax
call fcn.00405b95
add esp, 4
cmp eax, ebx
mov dword [esi + 0x24], eax
je 0x404678
lea ecx, [esp + 0x1f8]
mov edx, eax
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x404190
mov eax, dword [esi + 0x24]
push eax
call fcn.004010e0
add esp, 4
test eax, eax
je 0x40467f
mov edx, dword [esi + 0x20]
push 0x415400
push 0x1386
lea ecx, [esp + 0x200]
push ecx
push 0x411fb4
push str.CommandLine
push edx
call fcn.00402780
add esp, 0x18
mov edi, 0x411fd4
lea eax, [esp + 0x1f8]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x404206
cmp cl, bl
je 0x404202
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x404206
add eax, 2
add edi, 2
cmp cl, bl
jne 0x4041e2
xor eax, eax
jmp 0x40420b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x404251
mov eax, dword [esi + 0x20]
push 0x415400
push eax
push str.Key_CommandLine_not_found_in_section___s__in_file__s.
lea ecx, [esp + 0x204]
push 0x1388
push ecx
call fcn.004021b0
lea edx, [esp + 0x20c]
push edx
call fcn.004020a0
push str.Assuming_CommandLine_NULL_.
call fcn.004020a0
add esp, 0x1c
mov dword [esi + 0x28], ebx
jmp 0x4042da
lea eax, [esp + 0x1f8]
push eax
push str.CommandLine:__s
lea ecx, [esp + 0x1588]
push 0x1388
push ecx
call fcn.004021b0
lea edx, [esp + 0x1590]
push edx
call fcn.004020a0
lea eax, [esp + 0x20c]
add esp, 0x14
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x404290
sub eax, edx
jne 0x4042ad
push str.CommandLine_NULL_.
mov dword [esi + 0x28], ebx
call fcn.004020a0
add esp, 4
jmp 0x4042da
add eax, 2
push eax
call fcn.00405b95
add esp, 4
cmp eax, ebx
mov dword [esi + 0x28], eax
je 0x4046c4
lea ecx, [esp + 0x1f8]
mov edx, eax
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x4042d0
cmp dword [esi + 0x24], ebx
jne 0x4042e8
cmp dword [esi + 0x28], ebx
je 0x4046cb
mov ecx, dword [esi + 0x20]
push 0x415400
push 0x1386
lea eax, [esp + 0x200]
push eax
push 0x4120c8
push str.CurrentDirectory
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, str.Error_ini_file___
lea eax, [esp + 0x1f8]
lea ebx, [ebx]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x404344
cmp cl, bl
je 0x404340
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x404344
add eax, 2
add edi, 2
cmp cl, bl
jne 0x404320
xor eax, eax
jmp 0x404349
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4043b8
mov eax, dword [esi + 0x20]
push 0x415400
push eax
push str.Key_CurrentDirectory_not_found_in_section___s__in_file__s.
lea ecx, [esp + 0x204]
push 0x1388
push ecx
call fcn.004021b0
lea edx, [esp + 0x20c]
push edx
call fcn.004020a0
push str.Assuming_CurrentDirectory_NULL_.
call fcn.004020a0
push 0x413fe0
push 0x412168
lea eax, [esp + 0x21c]
push 0x1388
push eax
call fcn.004021b0
lea ecx, [esp + 0x224]
push ecx
call fcn.004020a0
add esp, 0x30
mov dword [esi + 0x28], ebx
jmp 0x40446a
lea edx, [esp + 0x1f8]
push edx
push str.CurrentDirectory:__s
lea eax, [esp + 0x1588]
push 0x1388
push eax
call fcn.004021b0
lea ecx, [esp + 0x1590]
push ecx
mov byte [esp + 0x291b], bl
call fcn.004020a0
lea eax, [esp + 0x20c]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4043f8
sub eax, edx
jne 0x40443e
push str.CurrentDirectory_NULL_.
mov dword [esi + 0x2c], ebx
call fcn.004020a0
push 0x413fe0
push str.Using_CurrentDirectory_s.
lea edx, [esp + 0x204]
push 0x1388
push edx
call fcn.004021b0
lea eax, [esp + 0x20c]
push eax
call fcn.004020a0
add esp, 0x18
jmp 0x40446a
add eax, 2
push eax
call fcn.00405b95
add esp, 4
cmp eax, ebx
mov dword [esi + 0x2c], eax
je 0x4046d2
lea ecx, [esp + 0x1f8]
mov edx, eax
mov edi, edi
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x404460
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov dword [esp + 0x20], 0x44
xor ecx, ecx
lea edi, [esi + 4]
mov edx, edi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x4044d1
mov ecx, dword [esi + 0x28]
cmp ecx, ebx
je 0x4044c1
push ecx
push eax
mov eax, dword [esi + 0x20]
push eax
push str.Creating_process__s___s___s_...
lea ecx, [esp + 0x208]
push 0x1388
push ecx
call fcn.004061a8
add esp, 0x18
jmp 0x4044f3
cmp eax, ebx
je 0x4044d1
mov edx, dword [esi + 0x20]
push eax
push edx
push str.Creating_process__s___s___NULL__...
jmp 0x4044de
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x20]
push ecx
push edx
push str.Creating_process__s___NULL____s_...
lea eax, [esp + 0x204]
push 0x1388
push eax
call fcn.004061a8
add esp, 0x14
lea ecx, [esp + 0x1f8]
push ecx
call fcn.004020a0
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x28]
add esp, 4
push edi
lea edx, [esp + 0x24]
push edx
mov edx, dword [esi + 0x24]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4045cf
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x404568
mov ecx, dword [esi + 0x28]
cmp ecx, ebx
je 0x404558
push ecx
push eax
mov eax, dword [esi + 0x20]
push eax
push str.Process__s___s___s__successfully_created.
lea ecx, [esp + 0x208]
push 0x1388
push ecx
call fcn.004021b0
add esp, 0x18
jmp 0x40458a
cmp eax, ebx
je 0x404568
mov edx, dword [esi + 0x20]
push eax
push edx
push str.Process__s___s___NULL___successfully_created.
jmp 0x404575
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x20]
push ecx
push edx
push str.Process__s___NULL____s__successfully_created.
lea eax, [esp + 0x204]
push 0x1388
push eax
call fcn.004021b0
add esp, 0x14
lea ecx, [esp + 0x1f8]
push ecx
call fcn.004020a0
mov edx, dword [esi + 0xc]
push edx
call fcn.004049d0
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0xc]
push eax
push ecx
push str.Monitoring_process__u:_s...
lea edx, [esp + 0x20c]
push 0x1388
push edx
call fcn.004021b0
lea eax, [esp + 0x214]
push eax
call fcn.004020a0
add esp, 0x20
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
inc ecx
cmp ecx, eax
mov ebp, esi
jge 0x40462e
mov esi, dword [esp + 0x1c]
push esi
push str.Waiting_for__d_seconds...
lea edx, [esp + 0x1588]
push 0x1387
push edx
call fcn.004021b0
lea eax, [esp + 0x1590]
push eax
call fcn.004020a0
add esp, 0x14
cmp esi, ebx
jbe 0x40462e
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
push 0x1388
push ebx
push 2
call fcn.00402ac0
add esp, 0xc
dec esi
jne 0x404614
push 0x1388
push ebx
push 2
call fcn.00402ac0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
add esp, 0xc
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x403f80
push str.All_service_processes_created.
call fcn.004020a0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0x411e40
jmp 0x4046d7
push 0x411e5c
jmp 0x4046d7
push 0x411f64
jmp 0x4046d7
mov ecx, dword [esi + 0x24]
push ecx
push str.Error:_Cannot_find_executable_file__s
lea edx, [esp + 0x1588]
push 0x1388
push edx
call fcn.004021b0
lea eax, [esp + 0x1590]
push eax
call fcn.004020a0
push str.Exiting...
call fcn.004020a0
add esp, 0x18
call fcn.004054d0
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0x41206c
jmp 0x4046d7
push str.Error:_ApplicationName_and_CommandLine_omitted_at_the_same_time
jmp 0x4046d7
push str.Error:_Not_enough_memory
call fcn.004020a0
add esp, 4
call fcn.004054d0
pop edi
or eax, 0xffffffff
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret