Function at 0x4018b7
Capabilities:
Get common file path
Hide graphical window
Persist via run registry key
Query or enumerate registry value
Query service configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x240
mov eax, dword [0x47e01c]
mov dword [ebp - 0x230], 3
mov dword [ebp - 0x22c], 0x4011d6
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], eax
call dword [sym.imp.KERNEL32.DLL_GetVersion]
xor ecx, ecx
mov dword [0x47e160], 0x403400
mov edx, eax
and eax, 0x80000000
mov dword [ebp - 0x23c], eax
mov eax, 0x403400
mov esi, eax
cmp eax, str._html__head__n_style__nfont.hfont_size:9pt__line_height:10pt_nfont.f4afont_size:6pt__line_height:8pt__nfont.f5font_size:16pt__line_height:18pt__nfont.f_font_size:9pt__line_height:10pt__n_n__style__n_meta_name_keywords__content_smtp_dns_web_server_cgi_ssi_isapi_http_server_smtp_server_dns_server_web_server_server_ftp_server_pop3_server_DHCP_server__mail_server___n_meta_name_description__content_Description_for_the_program_Small_HTTPserver._About_HTTP__FTP__DNS__DHCP__Mail_and_proxy_servers.___n_n_script_type_text_javascript_______n_nvar_ism0__nvar_ovp0__n_nfunction_mhide___nif__ism___n_if___ovp____n__ism__0__n___ovp__0__n___document.getElementById_mn_.style.display___none____n___return_true___n___n__return_true___n__n_return_false__n_nfunction__mshow___ndocument.getElementById_mn_.style.display______n_ism__1__n_return_false___n_n_nfunction_E_s_a_b_c__nvar_x_z_l_t__n_xa__c__b__64___h__e__n_zcb__l_____t_a___n_document.write__b_s__b_:_lt__hrefm_t_ilto_z_58__x____xl___t___br_____n__n_n_______script__n_n_n_n__head__body_bgcolorffffff_text000000__n____include_virtual_menue.htm_____________n_n_center__h1_Small_HTTP_server__h1__Description_for_Windows_version___center__n_n_p__a_nameC___a__H3_Contents__h3__table_cellspacing3_cellpadding8_border0_width100___tr_valigntop__td__n_ul__li__a_hrefW_Whats_this___a__n_li__a_hrefl1.shtml__License.__a__n_li__a_hrefW1_Capabilities__a__n_li__a_hrefh_How_to...___a__n_li__a_hrefh1_Directories_and_files_names__a__n_li__a_hrefh2_Options_and_command_line_parameters__a__n_li__a_hrefip_Allowed__and_denied_IP_ranges.__a__n_li__a_hrefli_Limits.__a__n_n_li__a_hrefh3_Running_scripts__a__n_li__a_hrefS_Server_Side_Includes__SSI___a__n_li__a_hrefre_Regular_expressions__a__n_li__a_hrefcf_Countries_features__a__n_n_li__a_hrefI_Internet_Server_Applications__ISAPI___a__n_li__a_hrefP_Proxy_server__a__n_li__a_hrefD_DNS_server__a__n_li__a_hrefM_SMTP_server__a__n_li__a_hrefP_POP3_server__proxy__a__n_li__a_hrefF_FTP_server__proxy__a__n_li__a_hrefT_TLS_SSL_server__a__n_li__a_hrefL_Conclusion.__a__n__ul___td__td__ul__ul__ul_nbsp____ul___ul___ul___td__n_td_alignleft_bgcolore0fff0_width20___center__h4_If_server_works_its_available:__h4___center__n_font_size2_classh__b__n_a_hrefhttp:__127.0.0.1___admin__conf_Setting___Current_state__a__br__n_a_hrefhttp:__127.0.0.1___admin__host_Users__Virtual_Hosts__a__br__n_a_hrefhttp:__127.0.0.1___admin__state_Current_statistics__a__n_hr__center_Online:__center__n_a_hrefhttp:__smallsrv.com_index.htmnew_Whats_new___a__br___b__Last_version__Forum__etc.__br__n_b__a_hrefhttp:__smallsrv.com_webmail.exe_Download_Web_Mail__a__br___b_An_external_script_gives_Web_intrface_for_working_with_mail__sup__br__n_b__a_hrefhttp:__smallsrv.com_sendmail.exe_Download_Sendmail_emulator__a__br___b___sup__br__n_b__a_hrefhttp:__smallsrv.com_donation.shtml_Donation__a__br__n__b__n_hr__n_B_Contacts:_BR___b__n_script_languageJavascript________nvar_h__smallsrv___nvar_e_.com___nfunction_E_s_a_b_c__nvar_x_z_l_t__n_xa__c__b__64___h__e__n_zcb__l_____t_a___n_document.write__b_s__b_:_lt__hrefm_t_ilto_z_58__x____xl___t___br_____n__nE__Author___max__________nh__smallsrv___ne_.com___nE__Author___max__________nE__Support___support__________nE__Sales___sales__________n_n_______n__script__n_noscript__max__press_Shift_and__2___smallsrv.com__noscript__n__font__n_hr__n_n__td___tr___table__n_n_br__hr__a_nameW___a__center__br__h2_Whats_this___h2___center__n_p__This_very_small_utility_turns_your_computer_into_a_fully_functional_nWeb_server__Mail_server__DNS_server__FTP_server__DHCP_server._The_program_itself_requires_a_minimal_set_of_system_resources__so_nthe_servers_functioning_doesnt_influence_your_computers_performance._This_nserver_can_function_under_a_LAN_networking_or_even_under_a_Dial_Up_nnetworking._Webmasters_can_run_this_utility_on_their_local_computers_and_ndebug_their_CGI_scripts_without_going_on_line._n_a_nameW1__p___a__p__This_is_pr
jb 0x40192d
test cl, cl
je 0x401945
mov dword [0x47e160], eax
jmp 0x401945
inc eax
cmp dword [eax - 1], 0x25fc2488
je 0x40193b
mov cl, 1
jmp 0x401919
test cl, cl
je 0x401945
mov dword [0x47e160], esi
test edx, edx
js 0x4019f3
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [0x47e048], eax
pop edx
test eax, eax
je 0x4019df
push ecx
push 0xf01ff
push 0x47b8a1
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [0x47e044], eax
pop esi
test eax, eax
je 0x4019d3
lea edx, [ebp - 0x23c]
push edx
push 0x24
push 0x47e020
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
mov eax, dword [0x47e02c]
test eax, eax
je 0x4019b1
push edx
push edx
push eax
push str.c:_shttps
call fcn.00401e74
add esp, 0x10
push edi
push edi
push 0x5c
push str.c:_shttps
call fcn.00401d92
add esp, 0x10
test eax, eax
je 0x4019c9
mov byte [eax], 0
and dword [0x47b588], 0xf7ffffff
and dword [0x47b668], 0xf7ffffff
jmp 0x4019f3
push 0
push str.Error
push str.Cant_open_SCM
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push ecx
push ecx
push 0x1f6
push dword [0x47e01c]
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
mov dword [ebp - 0x21c], eax
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x214], 0x10
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x230]
push esi
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x20c], str.FMform
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
mov edx, eax
add esp, 0xc
xor eax, eax
test dx, dx
je 0x401c33
mov dword [ebp - 0x23c], 2
push eax
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x23c]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
pop edx
test eax, eax
jne 0x401b07
lea esi, [ebp - 0x208]
push edx
push edx
push esi
push dword [ebp - 0x234]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
sub esp, 0xc
push esi
push str._sSmall_HTTP_serverSmall_HTTP_server.lnk
push 0x47e060
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push 0x47e060
call dword [sym.imp.KERNEL32.DLL__lopen]
pop ecx
pop edi
mov dword [ebp - 0x238], eax
test eax, eax
jle 0x401b07
push 0
xor edi, edi
push 0
push section..bss
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileTime]
push eax
push 0x200
push esi
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.DLL__hread]
mov dword [ebp - 0x23c], eax
push eax
push eax
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.DLL__lclose]
add esp, 0xc
jmp 0x401b2a
cmp dword [ebp - 0x23c], 0x17
je 0x401b9a
mov dword [ebp - 0x23c], 0x17
jmp 0x401a65
cmp byte [esi + edi], 0x3a
je 0x401b34
inc edi
cmp dword [ebp - 0x23c], edi
ja 0x401b23
jmp 0x401b9a
cmp byte [ebp + edi - 0x207], 0x5c
jne 0x401b29
push eax
push eax
lea eax, [esi + edi]
push 0x47c00f
push eax
call fcn.00401dd5
add esp, 0x10
mov edx, eax
test eax, eax
je 0x401b29
mov ecx, 1
sub edx, esi
lea esi, [esi + edi - 1]
mov eax, ecx
sub eax, edi
mov edi, str.c:_shttps
lea ecx, [eax + edx]
mov eax, 0xff
cmp ecx, 0xff
cmova ecx, eax
mov dword [ebp - 0x23c], ecx
jecxz 0x401b90
cld
inc ecx
lodsb al, byte [esi]
stosb byte es:[edi], al
or al, al
loopne 0x401b86
mov byte [edi - 1], 0
and dword [0x47b588], 0xf7ffffff
push eax
push 0x47e018
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
pop eax
test byte [0x47b58b], 8
je 0x401c01
mov eax, dword [0x47e018]
test eax, eax
je 0x401c01
lea edx, [ebp - 0x238]
push edx
push str.c:_shttps
push str.http.exe
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x401c01
push edi
push edi
push 0x5c
push str.c:_shttps
call fcn.00401d92
add esp, 0x10
test eax, eax
je 0x401bf7
mov byte [eax], 0
and dword [0x47b588], 0xf7ffffff
sub esp, 0xc
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push edx
push edx
push eax
push 0
push 0x47b560
call fcn.00401005
add esp, 0x18
push 1
mov dword [0x47e04c], eax
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop ecx
pop esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret