Function at 0x462fe4
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf4e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x154
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x463118
mov dword [ebp - 0x80], 0x534
mov dword [ebp - 0x98], str.mzbtmvy_rlgsqxq_hzbpv_nsxetv_yswg_amtpxiy_ergqrct_kqybmraw_bafzuy_lpmrnc_pfshgtcc_eir
cmp dword [ebp - 0x80], 0x68a
jle 0x4630c6
and dword [ebp - 0x30], 0
jmp 0x463040
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x1309
jge 0x4630c6
and dword [ebp - 0x48], 0
jmp 0x463056
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x332f
jge 0x4630c1
and dword [ebp - 0x24], 0
jmp 0x46306c
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x585a
jge 0x4630bf
mov eax, dword [ebp - 0x30]
and eax, dword [ebp - 0x48]
and eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], edx
push dword [ebp - 0xc0]
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x14c]
call fcn.00401a1e
pop ecx
pop ecx
mov ecx, eax
call fcn.0043542e
push eax
call fcn.004a9457
pop ecx
lea ecx, [ebp - 0x14c]
call fcn.00435424
jmp 0x463065
jmp 0x46304f
jmp 0x463039
push 0x6705
push 1
call fcn.00463694
pop ecx
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x80], 0x1f2
jge 0x4630ed
push dword [ebp - 0x98]
call fcn.004a9457
pop ecx
jmp 0x463109
or dword [ebp - 4], 0xffffffff
jmp 0x463113
jmp 0x463683
mov eax, dword [ebp + 8]
mov dword [ebp - 0xbc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
movzx eax, byte [eax]
test eax, eax
je 0x4632be
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x20], 0x1509cf13
push 2
lea ecx, [ebp - 0xd0]
call fcn.0043557d
mov dword [ebp - 0x40], 0
jmp 0x46316d
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x463186
push dword [ebp - 0x40]
lea ecx, [ebp - 0xd0]
call fcn.0043566b
or dword [eax], 0xffffffff
jmp 0x463166
mov dword [ebp - 0x18], 0
jmp 0x463196
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff2
jle 0x463281
mov dword [ebp - 0x38], 0
jmp 0x4631b0
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x4631c6
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x84], 0
jmp 0x4631a9
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x74], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84]
cmp eax, dword [ebp - 0x74]
je 0x4631e7
mov dword [ebp - 0x5c], 1
jmp 0x4631eb
and dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x5c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x84]
jl 0x46320a
mov dword [ebp - 0x64], 1
jmp 0x46320e
and dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x64]
cmp eax, 1
ja 0x463222
mov dword [ebp - 0x7c], 1
jmp 0x463226
and dword [ebp - 0x7c], 0
mov eax, dword [ebp - 0x7c]
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x20]
jg 0x46323a
mov dword [ebp - 0x6c], 1
jmp 0x46323e
and dword [ebp - 0x6c], 0
push 1
lea ecx, [ebp - 0xd0]
call fcn.0043566b
mov ecx, dword [ebp - 0x6c]
mov dword [eax], ecx
mov dword [ebp - 0x20], 0
jmp 0x463260
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jg 0x46327c
mov byte [ebp - 0x19], 0
movzx eax, byte [ebp - 0x19]
test eax, eax
je 0x46327a
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
jmp 0x463259
jmp 0x46318f
lea ecx, [ebp - 0xd0]
call fcn.0043564f
push 0x63bc
push 0x3ca3
push 0x7ff0
push 0
push 0x17a
push 0x45a8
push 0x3227
push 0x6f04
call fcn.0045f9ed
add esp, 0x20
jmp 0x463683
mov dword [ebp - 0x44], 0x7e17f75
mov dword [ebp - 0x4c], 0xbb0cb8ce
mov dword [ebp - 0x60], 0xfffffffb
mov dword [ebp - 0xac], 1
mov dword [ebp - 0xe0], 0x4da86284
mov dword [ebp - 0xd8], 0x64f6cbcb
mov dword [ebp - 0xdc], 0x82e77e81
mov dword [ebp - 0xe4], 0x5ebda184
mov dword [ebp - 0x8c], 0x5b55
mov dword [ebp - 0x9c], str.kfwez_wxjbclfq_wsjjzdb
cmp dword [ebp - 0x8c], 0x5c32
jle 0x4633fa
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
and dword [ebp - 0x28], 0
jmp 0x463342
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x34c1
jge 0x4633f2
and dword [ebp - 0x2c], 0
jmp 0x46335c
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x137e
jge 0x4633ed
and dword [ebp - 0x34], 0
jmp 0x463376
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xd50
jge 0x4633e8
and dword [ebp - 0x3c], 0
jmp 0x46338c
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x68ee
jge 0x4633e6
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
shl eax, cl
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x3c]
or eax, ecx
cdq
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], edx
push dword [ebp - 0xa0]
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x164]
call fcn.00401a1e
pop ecx
pop ecx
mov ecx, eax
call fcn.0043542e
push eax
call fcn.004a9457
pop ecx
lea ecx, [ebp - 0x164]
call fcn.00435424
jmp 0x463385
jmp 0x46336f
jmp 0x463355
jmp 0x46333b
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x108], 0xffffffff
mov dword [ebp - 4], 2
cmp dword [ebp - 0x8c], 0x5893
jge 0x463423
push dword [ebp - 0x9c]
call fcn.004a9457
pop ecx
jmp 0x46343f
or dword [ebp - 4], 0xffffffff
jmp 0x463449
mov dword [ebp - 0xd4], 1
mov dword [ebp - 0x104], 0x59ec1348
mov dword [ebp - 0xe8], 0x580090ae
mov dword [ebp - 0xfc], 0x225189d9
mov dword [ebp - 0x118], 0x95dbc2a4
mov dword [ebp - 0x114], 0x95dbc2a4
mov dword [ebp - 0x110], 0x95dbc2a4
mov dword [ebp - 0x10c], 0x95dbc2a4
mov dword [ebp - 0x70], 2
cmp dword [ebp - 0x44], 0
je 0x4634b5
cmp dword [ebp - 0x4c], 0
je 0x4634b5
mov dword [ebp - 0x58], 1
jmp 0x4634b9
and dword [ebp - 0x58], 0
cmp dword [ebp - 0x44], 1
jbe 0x4634cb
mov dword [ebp - 0xb4], 1
jmp 0x4634d2
and dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x4c]
jg 0x4634e6
mov dword [ebp - 0x54], 1
jmp 0x4634ea
and dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x54]
cmp eax, 0xfffffff6
ja 0x4634fe
mov dword [ebp - 0x68], 1
jmp 0x463502
and dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
imul eax, dword [ebp - 0x60], 0xffffffff
sub eax, dword [ebp - 0x68]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xb0], eax
push 4
lea ecx, [ebp - 0xf4]
call fcn.0043557d
mov dword [ebp - 0xf8], 1
mov dword [ebp - 0x100], 0x398070a
mov dword [ebp - 0x78], 0xffff
mov dword [ebp - 0x14], 0
jmp 0x463560
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x463579
push dword [ebp - 0x14]
lea ecx, [ebp - 0xf4]
call fcn.0043566b
and dword [eax], 0
jmp 0x463559
mov dword [ebp - 0x14], 0
jmp 0x463589
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x46359f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x134], 0xffffffff
jmp 0x463582
mov dword [ebp - 0x14], 0
jmp 0x4635af
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x4635c5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x128], 0x9796
jmp 0x4635a8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x128]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x128], eax
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
lea ecx, [ebp - 0xf4]
call fcn.0043564f
mov dword [ebp - 0x94], 0x73eb
mov dword [ebp - 0x50], 0x111738ab
mov dword [ebp - 0x90], 0x6d2e8588
mov dword [ebp - 0xa8], 1
mov byte [ebp - 0x1a], 0
movzx eax, byte [ebp - 0x1a]
test eax, eax
je 0x46362d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x46364c
push 3
pop eax
test eax, eax
jne 0x46364c
and dword [ebp - 0x88], 0
jmp 0x463656
mov dword [ebp - 0x88], 1
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xa8], eax
push dword [ebp - 0xb0]
push 0x37bb
push 0
call fcn.004528a7
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret