Function at 0x401c20
Capabilities:
Check for time delay via gettickcount
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40dc0c
mov eax, dword fs:[0]
push eax
sub esp, 0x6d8
mov eax, dword [0x41234c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
nop
nop
nop
nop
nop
nop
push 0x4018e0
push str.3fix1
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
mov dword [0x413344], eax
nop
nop
nop
nop
nop
nop
mov eax, dword [0x4122e4]
mov esi, dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov dword [0x413334], eax
add eax, 1
mov dword [0x4122e4], eax
mov eax, dword [0x413344]
xor ebx, ebx
push 0x413320
mov edi, 0x10
push eax
mov dword [0x413320], edi
mov dword [0x413330], ebx
mov dword [0x413324], 2
mov dword [0x41332c], ebx
mov dword [0x413338], 0xbb8
mov dword [0x413328], ebx
call esi
nop
nop
nop
nop
nop
nop
mov ecx, dword [0x413344]
push 0x413320
push ecx
mov dword [0x413320], edi
mov dword [0x413330], ebx
mov dword [0x413324], 4
mov dword [0x41332c], ebx
mov dword [0x413338], ebx
mov dword [0x413328], 1
mov dword [0x413334], ebx
call esi
push 0x410
lea edx, [ebp - 0x462]
push ebx
push edx
mov word [ebp - 0x464], bx
call fcn.00403430
add esp, 0xc
push 0xffffffffffffffff
call sub.IMM32.dll_ImmDisableIME
nop
nop
nop
nop
nop
nop
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
cmp esi, ebx
je 0x401d74
lea eax, [ebp - 0x6c8]
push eax
lea ecx, [ebp - 0x464]
push ecx
push str.3fix1
push esi
mov dword [ebp - 0x6c8], 0x208
call dword [sym.imp.ADVAPI32.dll_GetServiceKeyNameW]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp word [ebp - 0x464], bx
lea esi, [ebp - 0x464]
jne 0x401d88
mov esi, str.3fix1
lea edx, [ebp - 0x6c8]
push edx
push esi
mov dword [ebp - 0x6c8], ebx
call fcn.00401260
lea eax, [ebp - 0x6c8]
push eax
push esi
call fcn.00401320
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
mov esi, 7
push 0x40e348
lea ecx, [ebp - 0x688]
mov dword [ebp - 0x670], esi
mov dword [ebp - 0x674], ebx
mov word [ebp - 0x684], bx
call fcn.004028b0
push ebx
push 0x40e34c
lea ecx, [ebp - 0x6a4]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x68c], esi
mov dword [ebp - 0x690], ebx
mov word [ebp - 0x6a0], bx
call fcn.004028b0
lea ecx, [ebp - 0x6a4]
push ecx
lea edx, [ebp - 0x688]
push edx
mov byte [ebp - 4], 1
call fcn.00401ab0
add esp, 8
push 1
push 0x40e350
lea ecx, [ebp - 0x688]
call fcn.004029b0
mov eax, str.QQPCFIX.DLL
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401e60
sub eax, edx
sar eax, 1
push eax
push str.QQPCFIX.DLL
lea ecx, [ebp - 0x688]
call fcn.004029b0
mov eax, dword [ebp - 0x684]
mov edi, 8
cmp dword [ebp - 0x670], edi
mov byte [ebp - 0x6c1], bl
jae 0x401e9f
lea eax, [ebp - 0x684]
push ebx
push eax
call fcn.00404154
add esp, 8
test eax, eax
jne 0x40214c
cmp dword [ebp - 0x670], edi
mov eax, dword [ebp - 0x684]
jae 0x401ec5
lea eax, [ebp - 0x684]
push eax
call fcn.00401140
add esp, 4
push ebx
push 0x40e354
lea ecx, [ebp - 0x6c0]
mov esi, eax
mov dword [ebp - 0x6a8], 7
mov dword [ebp - 0x6ac], ebx
mov word [ebp - 0x6bc], bx
call fcn.004028b0
cmp esi, ebx
mov byte [ebp - 4], 2
jne 0x4020ee
push 0x206
lea eax, [ebp - 0x66a]
push ebx
push eax
mov word [ebp - 0x66c], bx
call fcn.00403430
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x66c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x66c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401f40
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x66c]
push edx
lea ecx, [ebp - 0x6c0]
call fcn.004028b0
push 1
push 0xffffffffffffffff
push 0x40e358
lea ecx, [ebp - 0x6c0]
call fcn.00402380
cmp eax, 0xffffffff
jne 0x401fa5
mov eax, 0x412258
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401f83
sub eax, edx
sar eax, 1
push eax
push 0x412258
lea ecx, [ebp - 0x6c0]
call fcn.004028b0
jmp 0x401fe7
push eax
push ebx
lea eax, [ebp - 0x6e4]
push eax
lea ecx, [ebp - 0x6c0]
call fcn.00402ad0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x6c0]
mov byte [ebp - 4], 3
call fcn.004027a0
cmp dword [ebp - 0x6cc], edi
mov byte [ebp - 4], 2
jb 0x401fe7
mov ecx, dword [ebp - 0x6e0]
push ecx
call fcn.00403112
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x3e
lea edx, [ebp - 0x4e]
push ebx
push edx
mov esi, eax
mov word [ebp - 0x50], bx
call fcn.00403430
push 0xa
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.004040a5
add esp, 0x18
push 1
push 0x40e35c
lea ecx, [ebp - 0x6c0]
call fcn.004029b0
lea eax, [ebp - 0x50]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x402026
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x6c0]
call fcn.004029b0
mov eax, str..dat
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x402050
sub eax, edx
sar eax, 1
push eax
push str..dat
lea ecx, [ebp - 0x6c0]
call fcn.004029b0
cmp dword [ebp - 0x6a8], edi
mov ecx, dword [ebp - 0x6bc]
jae 0x402084
lea ecx, [ebp - 0x6bc]
cmp dword [ebp - 0x670], edi
mov eax, dword [ebp - 0x684]
jae 0x402098
lea eax, [ebp - 0x684]
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [ebp - 0x6a8], edi
mov eax, dword [ebp - 0x6bc]
jae 0x4020b6
lea eax, [ebp - 0x6bc]
push ebx
push eax
call fcn.00404154
add esp, 8
test eax, eax
jne 0x402131
cmp dword [ebp - 0x6a8], edi
mov eax, dword [ebp - 0x6bc]
mov byte [ebp - 0x6c1], 1
jae 0x4020df
lea eax, [ebp - 0x6bc]
push eax
call fcn.00401140
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x402116
push str.MainFlow
push esi
call fcn.004011d0
add esp, 8
cmp eax, ebx
je 0x402107
push str._svc
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [ebp - 0x6c1], bl
je 0x402131
cmp dword [ebp - 0x6a8], edi
mov eax, dword [ebp - 0x6bc]
jae 0x40212a
lea eax, [ebp - 0x6bc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x6a8], edi
mov byte [ebp - 4], 1
jb 0x40214c
mov edx, dword [ebp - 0x6bc]
push edx
call fcn.00403112
add esp, 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push str.kernel32.dll
call fcn.00401140
add esp, 4
cmp eax, ebx
je 0x402199
push str.TerminateProcess
push eax
call fcn.004011d0
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x402199
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x68c], edi
jb 0x4021b0
mov eax, dword [ebp - 0x6a0]
push eax
call fcn.00403112
add esp, 4
cmp dword [ebp - 0x670], edi
mov dword [ebp - 0x68c], 7
mov dword [ebp - 0x690], ebx
mov word [ebp - 0x6a0], bx
jb 0x4021de
mov ecx, dword [ebp - 0x684]
push ecx
call fcn.00403112
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403418
mov esp, ebp
pop ebp
ret 8