Function at 0x40cc40
Capabilities:
Check mutex on windows
Check os version
Create process on windows
Modify service
Query service status
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x40f3b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x550
mov eax, dword [0x418110]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
push esi
lea ecx, [esp + 0x88]
mov dword [esp + 0x558], eax
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
xor ebx, ebx
push str.wWinMain
mov dword [esp + 0x568], ebx
call fcn.00401ef0
add esp, 4
test eax, eax
jne 0x40cce8
push esi
push str.lpstrCmdLine_
push ebx
push str.wWinMain
call fcn.004055f0
add esp, 8
mov ecx, eax
call fcn.00402bb0
mov ecx, eax
call fcn.00401290
push 1
mov esi, eax
push ebx
mov dword [0x418140], ebx
mov eax, dword [esi + 0x240]
push ebx
push eax
push ebx
mov ecx, esi
mov dword [esi + 0x248], ebx
call fcn.00405bc0
add esi, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [esp + 0x13]
push ecx
sub esp, 0x1c
lea edx, [esp + 0xa4]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
mov byte [esp + 0x37], bl
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
call fcn.0040c420
add esp, 0x20
cmp al, bl
je 0x40d041
xor eax, eax
mov word [esp + 0x1b8], bx
mov ecx, 0xe5
lea edi, [esp + 0x1ba]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0x1bc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.MSVCR71.dll_wcsncat]
push 1
lea ecx, [esp + 0x1bc]
push 0x4131b0
push ecx
call esi
mov edx, dword [ebp + 0x10]
push 0xc7
push edx
lea eax, [esp + 0x1cc]
push eax
call esi
xor eax, eax
mov ecx, 0x44
lea edi, [esp + 0xbc]
rep stosd dword es:[edi], eax
add esp, 0x18
lea ecx, [esp + 0xa0]
push ecx
mov dword [esp + 0xa4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push str.xlgameacc_app_mutex
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x1c], eax
call edi
cmp eax, 0xb7
jne 0x40ce5c
cmp byte [esp + 0x13], bl
jne 0x40ce5c
push str.wWinMain
call fcn.00401ef0
add esp, 4
test eax, eax
jne 0x40cdff
push 3
push str.xl_gameacc_already_started
push ebx
push str.wWinMain
call fcn.004055f0
add esp, 8
mov ecx, eax
call fcn.00401290
mov ecx, eax
call fcn.004060e0
push ebx
push str.XunLei_XLGameACC_Win32SSHELL_Window
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
cmp esi, ebx
je 0x40d041
push str.wWinMain
call fcn.00401ef0
add esp, 4
test eax, eax
jne 0x40ce49
push 1
push str.cant_find_the_last_window
push ebx
push str.wWinMain
call fcn.004055f0
add esp, 8
mov ecx, eax
call fcn.00402bb0
mov ecx, eax
call fcn.004060e0
push ebx
push ebx
push 0x464
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x40d041
cmp dword [esp + 0xa4], 6
jb 0x40d11e
cmp dword [esp + 0xb0], 2
jne 0x40d11e
push 1
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [esp + 0x24], esi
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x40d060
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x18]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareXLacc
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push str.wWinMain
mov esi, eax
call fcn.00401ef0
add esp, 4
test eax, eax
jne 0x40cef7
push 1
push esi
push str.chenyi_RegCreateKeyEx_dwRet
push ebx
push str.wWinMain
call fcn.004055f0
add esp, 8
mov ecx, eax
call fcn.00402bb0
mov ecx, eax
call fcn.00401170
mov ecx, eax
call fcn.004060e0
mov edx, dword [esp + 0x14]
push 0x104
lea ecx, [esp + 0x1bc]
push ecx
push 1
push ebx
push str.CurrentPath
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.wWinMain
mov esi, eax
call fcn.00401ef0
add esp, 4
test eax, eax
jne 0x40cf55
push 1
push esi
push str.chenyi_RegSetValueEx_dwRet
push ebx
push str.wWinMain
call fcn.004055f0
add esp, 8
mov ecx, eax
call fcn.00402bb0
mov ecx, eax
call fcn.00401170
mov ecx, eax
call fcn.004060e0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x24]
push 0x100
push str.XLaccService
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [esp + 0x1c]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push str._startup
lea ecx, [esp + 0x8c]
call dword [sym.imp.MSVCP71.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_wchar_t_const___unsigned_int_const]
mov edx, dword [sym.imp.MSVCP71.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
cmp eax, dword [edx]
je 0x40cfb2
lea eax, [esp + 0x2c]
push eax
push 0x86
jmp 0x40cfbc
lea ecx, [esp + 0x2c]
push ecx
push 0x85
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp eax, ebx
jne 0x40d031
push 0x104
lea edx, [esp + 0x1bc]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 0x48]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0x10]
lea edx, [esp + 0x48]
lea eax, [esp + 0x1b8]
push edx
mov dword [esp + 0x4c], 0x3c
mov dword [esp + 0x50], 0x40
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], str.runas
mov dword [esp + 0x5c], eax
mov dword [esp + 0x64], ebx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x68], 5
mov dword [esp + 0x6c], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov eax, dword [esp + 0x24]
push eax
call esi
lea ecx, [esp + 0x84]
mov dword [esp + 0x564], 0xffffffff
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor eax, eax
jmp 0x40d2e8
push 0xf01ff
push str.XLaccService
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp esi, ebx
jne 0x40d081
call fcn.00408980
jmp 0x40d10e
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x40d0e6
call edi
cmp eax, 0x7a
jne 0x40d0ab
mov edx, dword [esp + 0x14]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
jmp 0x40d0af
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x14]
push eax
push ecx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x40d0e6
cmp dword [edi + 4], 2
je 0x40d0df
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea edx, [esp + 0x14]
push edx
push 0x24
lea eax, [esp + 0x50]
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x40d10e
cmp dword [esp + 0x4c], 1
jne 0x40d10e
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov ecx, dword [esp + 0x24]
push ecx
call esi
call fcn.004091c0
call fcn.0040c2b0
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
lea ecx, [esp + 0x18]
call fcn.00406970
lea ecx, [esp + 0x18]
mov byte [esp + 0x564], 1
call fcn.00406980
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1bc]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x28], ebx
call fcn.00406ab0
push str.wWinMain
mov esi, eax
call fcn.00401ef0
add esp, 4
test eax, eax
jne 0x40d1d4
mov ecx, dword [esp + 0x20]
push 1
push ecx
push str.bEnable_
push esi
push str.nRet
lea edx, [esp + 0x1cc]
push edx
push str.firewall.IsAppEnabled_modulePath__bEnable_
push ebx
push str.wWinMain
call fcn.004055f0
add esp, 8
mov ecx, eax
call fcn.00401290
mov ecx, eax
call fcn.00401290
mov ecx, eax
call fcn.00401290
mov ecx, eax
call fcn.00408c10
mov ecx, eax
call fcn.00401290
mov ecx, eax
call fcn.00408c10
mov ecx, eax
call fcn.004060e0
cmp dword [esp + 0x20], ebx
jne 0x40d261
push 0x412fe0
lea ecx, [esp + 0x4c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea ecx, [esp + 0x48]
mov byte [esp + 0x564], 2
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
lea eax, [esp + 0x1bc]
push eax
lea ecx, [esp + 0x20]
call fcn.00406c10
push str.wWinMain
mov esi, eax
call fcn.00401ef0
add esp, 4
test eax, eax
jne 0x40d24f
push 1
push esi
push str.AddApplication_Result_
push ebx
push str.wWinMain
call fcn.004055f0
add esp, 8
mov ecx, eax
call fcn.00401290
mov ecx, eax
call fcn.00408c10
mov ecx, eax
call fcn.004060e0
lea ecx, [esp + 0x48]
mov byte [esp + 0x564], 1
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x18]
call fcn.00406a90
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [ebp + 8]
push ebx
push ecx
push ebx
mov ecx, 0x418adc
call fcn.00408fc0
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push edx
push eax
call fcn.0040c150
add esp, 8
mov ecx, 0x418adc
mov esi, eax
call fcn.00409630
call dword [sym.imp.ole32.dll_OleUninitialize]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x418ad8]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x18]
mov byte [esp + 0x564], bl
call fcn.00406e30
lea ecx, [esp + 0x84]
mov dword [esp + 0x564], 0xffffffff
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x55c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x554]
call fcn.0040e783
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10