Function at 0x402ce3
Capabilities:
Accept command line arguments
Delete registry key
Get disk information
Set file attributes
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41b466
mov eax, dword fs:[0]
push eax
sub esp, 0xe44
mov eax, dword [0x42635c]
xor eax, esp
mov dword [esp + 0xe3c], eax
push esi
push edi
mov eax, dword [0x42635c]
xor eax, esp
push eax
lea eax, [esp + 0xe50]
mov dword fs:[0], eax
push 0x4e38968
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp eax, 0x29962
jne 0x402ef0
mov esi, 0x4363f0
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402d42
sub ecx, edx
cmp ecx, 0xd23e4
jne 0x402ef0
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
call esi
cmp eax, 0x7c80b
jne 0x402ef0
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
xor eax, eax
push eax
push eax
push eax
lea eax, [esp + 0xa50]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorSacl]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0
call dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
push 0
call dword [sym.imp.KERNEL32.DLL_IsValidCodePage]
push 0
call esi
lea eax, [esp + 0x12c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
and dword [esp + 0x104], 0
lea edi, [esp + 0x108]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x104]
push eax
push 0
call dword [sym.imp.USER32.dll_GetIconInfo]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DefDlgProcA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_mouse_event]
lea eax, [esp + 0x24]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov eax, dword [0x4e41278]
cmp eax, 0xc7f
jne 0x402e46
push 0
lea eax, [esp + 0x248]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetVolumeNameForVolumeMountPointA]
mov eax, dword [0x4e41278]
cmp eax, 0xe7
jne 0x402e6f
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_OpenSemaphoreA]
push 0
lea eax, [esp + 0x248]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_QueryDosDeviceA]
mov eax, dword [0x4e41278]
cmp eax, 0x324
jne 0x402e81
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_OpenJobObjectA]
lea ecx, [esp + 0x10]
call fcn.0040346c
and dword [esp + 0xe58], 0
lea ecx, [esp + 0x10]
call fcn.0040347e
push str.__s__d__f
call fcn.00405afc
push ecx
lea ecx, [esp + 0x5c]
call fcn.00403493
mov byte [esp + 0xe58], 1
push str.xozuxexayigogotinaha
push str.diyegokabozonazo__f
push 0x4363f0
call fcn.004052fd
add esp, 0xc
mov byte [esp + 0xe58], 0
lea ecx, [esp + 0x54]
call fcn.00402fc1
or dword [esp + 0xe58], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00403479
xor esi, esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTimeAdjustment]
cmp dword [0x4e41278], 0x157
jne 0x402f3e
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_BindIoCompletionCallback]
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
push 0
lea eax, [esp + 0x248]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetAtomNameW]
push 0
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea eax, [esp + 0x104]
push eax
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
lea eax, [esp + 0x10]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetThreadSelectorEntry]
cmp esi, 0x369c89
jle 0x402f88
cmp dword [esp + 0xc], 0x8e9097c
je 0x402f88
cmp dword [esp + 0x118], 0x7e5d3705
je 0x402f88
movzx eax, byte [esp + 0x15]
cmp eax, 0x610daa37
jne 0x402f95
inc esi
cmp esi, 0x1765b6ba
jl 0x402ef2
call fcn.0040288f
xor eax, eax
mov ecx, dword [esp + 0xe50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0xe3c]
xor ecx, esp
call fcn.0040526a
mov esp, ebp
pop ebp
ret 0x10