Function at 0x425871
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x4259e1
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x16c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x1a0], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x184], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
movzx eax, byte [eax]
test eax, eax
je 0x425915
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
movzx eax, byte [eax]
test eax, eax
je 0x4258f2
mov byte [ebp - 0xb], 0
movzx eax, byte [ebp - 0xb]
test eax, eax
je 0x4258f0
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
jmp 0x425910
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x425910
push 0
push 0x74f
push 0xca9
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
jmp 0x4259dc
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0xf8]
movzx eax, byte [eax]
test eax, eax
je 0x425979
mov byte [ebp - 0xa], 0
movzx eax, byte [ebp - 0xa]
test eax, eax
je 0x425977
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1fa2
push 0x36d
push 0x1730
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x4259dc
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x24]
mov dword [eax], 0
jmp 0x4259bc
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov eax, dword [ebp - 0x24]
cmp dword [eax], 1
jge 0x4259dc
mov eax, dword [ebp - 0x24]
push dword [eax]
mov ecx, dword [ebp - 0x18c]
call fcn.0042f4bd
mov dword [eax], 0x83398963
jmp 0x4259b1
jmp 0x42655b
lea eax, [ebp + 0x28]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x17c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x110], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x110]
movzx eax, byte [eax]
test eax, eax
je 0x426514
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
movzx eax, byte [eax]
test eax, eax
je 0x426240
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x178], 0xfffffff8
mov dword [ebp - 0x148], 1
mov dword [ebp - 0x1c8], 0x14ab653b
mov dword [ebp - 0x154], 0xfffffff8
mov dword [ebp - 0x170], 1
mov dword [ebp - 0x180], 0xdd93ba6a
mov dword [ebp - 0x140], 0xffffffff
mov dword [ebp - 0x138], 0xfffffffd
mov dword [ebp - 0x188], 0xffffffff
mov dword [ebp - 0x130], 0xfffffff7
mov dword [ebp - 0x150], 0x1dd2e91c
push 1
lea ecx, [ebp - 0x1b8]
call fcn.0042f3cf
mov dword [ebp - 0x190], 0xa3418eb
mov dword [ebp - 0x198], 0
push 1
push 0x314a
push 0x655c
lea eax, [ebp - 0x1b8]
push eax
push 0x19b5
push 0x4ad1
push 0x5b4a
push 0x753c
push 1
push 0x3c9d
push 0x7b5a
lea eax, [ebp - 0x1f0]
push eax
push 0x4fa1
push 0x5a40
push 1
push 1
push 0x2da9
push 0x53e0
call fcn.00422532
add esp, 0x48
push 0x4e36
push 1
push 0x6f5c
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x138]
push eax
push 0x90
push 0x98f
lea eax, [ebp - 0x178]
push eax
push 1
push 0x3d19
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x180]
push eax
push 1
push 0x2e96
push 0x12ac
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x150]
push eax
push 1
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x198]
push eax
call fcn.00420212
add esp, 0x60
lea ecx, [ebp - 0x1b8]
call fcn.0042f4a1
push 4
push 0x2000
mov eax, dword [ebp - 0x38]
push dword [eax + 0x50]
mov eax, dword [ebp - 0x38]
push dword [eax + 0x34]
push 0x679
push 0x559
call fcn.004072ea
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xa8]
call fcn.0042f3cf
mov dword [ebp - 0xec], 0xffffffff
push 0
push 0x1099
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x5dcb
call fcn.00423ec7
add esp, 0x14
mov dword [ebp - 0x20], 0
jmp 0x425c59
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x425c6f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x200], 0x14e76493
jmp 0x425c52
push 0
lea ecx, [ebp - 0xa8]
call fcn.0042f4bd
and dword [eax], 0
jmp 0x425ca5
push 0
lea ecx, [ebp - 0xa8]
call fcn.0042f4bd
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xdc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa8]
call fcn.0042f4bd
cmp dword [eax], 0xffffffee
jle 0x425e94
mov dword [ebp - 0x18], 0x4a2a4f40
mov dword [ebp - 0x48], 1
push 4
lea ecx, [ebp - 0x1ec]
call fcn.0042f3cf
push 1
push 1
lea eax, [ebp - 0x1ec]
push eax
push 0
push 0x4384
push 0x1802
push 0x7257
push 0x7886
lea eax, [ebp - 0x1e0]
push eax
push 0x1efb
push 0x74ef
call fcn.0042bbdb
add esp, 0x2c
mov dword [ebp - 0x18], 0
jmp 0x425d20
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x425e55
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0xe4], 0xfffffff6
push 0
lea ecx, [ebp - 0xa8]
call fcn.0042f4bd
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffff
jle 0x425d64
mov dword [ebp - 0x58], 1
jmp 0x425d68
and dword [ebp - 0x58], 0
cmp dword [ebp - 0x58], 0x54e3f157
jl 0x425d7d
mov dword [ebp - 0x98], 1
jmp 0x425d84
and dword [ebp - 0x98], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x98]
jg 0x425d98
mov dword [ebp - 0x60], 1
jmp 0x425d9c
and dword [ebp - 0x60], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x60]
imul eax, eax, 0x97b
cmp eax, dword [ebp - 0x34]
jle 0x425dbe
xor eax, eax
je 0x425dbe
mov dword [ebp - 0xc0], 1
jmp 0x425dc5
and dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x425df8
push 1
lea ecx, [ebp - 0xa8]
call fcn.0042f4bd
cmp dword [eax], 0
jne 0x425df8
push 0
lea ecx, [ebp - 0xa8]
call fcn.0042f4bd
cmp dword [eax], 0
je 0x425e0a
cmp dword [ebp - 0x48], 0
je 0x425e0a
mov dword [ebp - 0x168], 1
jmp 0x425e11
and dword [ebp - 0x168], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x200]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x18], eax
je 0x425e35
mov dword [ebp - 0x68], 1
jmp 0x425e39
and dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xe4], eax
push 1
push 1
push 1
call fcn.00423424
add esp, 0xc
jmp 0x425d19
push 1
push 0x7b22
push 1
lea eax, [ebp - 0xec]
push eax
push 0x3007
push 1
push 1
push 0x57e6
push 1
push 0x54b
push 1
call fcn.00420cbd
add esp, 0x2c
lea ecx, [ebp - 0x1ec]
call fcn.0042f4a1
jmp 0x425c81
lea ecx, [ebp - 0xa8]
call fcn.0042f4a1
mov eax, dword [ebp - 0x3c]
cmp dword [eax], 0
jne 0x42623b
push 2
lea ecx, [ebp - 0x1ac]
call fcn.0042f3cf
mov dword [ebp - 0x10], 0x622ba394
mov dword [ebp - 0x6c], 0xfffffffe
lea eax, [ebp - 0x1ac]
push eax
push 1
lea eax, [ebp - 0x1d4]
push eax
push 1
push 1
push 1
call fcn.00421122
add esp, 0x18
mov dword [ebp - 0x10], 1
jmp 0x425ef4
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x426209
mov dword [ebp - 4], 0x33efc07e
mov dword [ebp - 0x10c], 1
mov dword [ebp - 4], 1
jmp 0x425f1f
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x4261e6
mov dword [ebp - 8], 9
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x28], 0
jmp 0x425f47
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x425f5d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1c4], 0xa043
jmp 0x425f40
mov dword [ebp - 8], 1
jmp 0x425f6d
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x42618a
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0xfc], 0xc3efc167
mov dword [ebp - 0x2c], 0
jmp 0x425f98
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x425fae
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xf4], 0xec13
jmp 0x425f91
mov eax, 0x8edf
test eax, eax
je 0x425fc9
cmp dword [ebp - 4], 0
je 0x425fc9
mov dword [ebp - 0x90], 1
jmp 0x425fd0
and dword [ebp - 0x90], 0
push 1
lea ecx, [ebp - 0x1ac]
call fcn.0042f4bd
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 8], 0
jne 0x426002
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf4], 0
jne 0x426002
and dword [ebp - 0x50], 0
jmp 0x426009
mov dword [ebp - 0x50], 1
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x30]
je 0x42601d
mov dword [ebp - 0x70], 1
jmp 0x426021
and dword [ebp - 0x70], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x70], eax
jge 0x426035
mov dword [ebp - 0xd0], 1
jmp 0x42603c
and dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0xd0]
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x10]
jl 0x426053
mov dword [ebp - 0x78], 1
jmp 0x426057
and dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x78]
add eax, 0x778e
cmp eax, dword [ebp - 0x30]
jl 0x426070
mov dword [ebp - 0xb0], 1
jmp 0x426077
and dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0xb0], eax
je 0x42608e
mov dword [ebp - 0x80], 1
jmp 0x426092
and dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x80], eax
jl 0x4260a6
mov dword [ebp - 0xc8], 1
jmp 0x4260ad
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xc8], eax
jg 0x4260c4
mov dword [ebp - 0x88], 1
jmp 0x4260cb
and dword [ebp - 0x88], 0
cmp dword [ebp - 0x88], 0
jne 0x4260e0
mov dword [ebp - 0xb8], 1
jmp 0x4260e7
and dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xb8], eax
jle 0x426100
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c4], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x90], eax
jg 0x426117
mov dword [ebp - 0xd8], 1
jmp 0x42611e
and dword [ebp - 0xd8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1c4]
cmp dword [ebp - 0xd8], eax
jle 0x42613c
mov dword [ebp - 0x54], 1
jmp 0x426140
and dword [ebp - 0x54], 0
cmp dword [ebp - 0x54], 0x9a32
jle 0x426152
mov dword [ebp - 0x5c], 1
jmp 0x426156
and dword [ebp - 0x5c], 0
cmp dword [ebp - 0x5c], 0
jg 0x426168
mov dword [ebp - 0x104], 1
jmp 0x42616f
and dword [ebp - 0x104], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c4]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x6c], eax
jmp 0x425f66
push 0x7e8b
push 0x1fc7
push 0x6973
push 0x4ff6
lea eax, [ebp - 8]
push eax
push 0x4207
push 0x2403
lea eax, [ebp - 0x10c]
push eax
push 0x2d0c
push 0x7dfb
push 1
push 1
push 0x3b71
push 0
push 0x6a0
push 1
push 0x6a1a
push 0x5aa0
call fcn.00422cb7
add esp, 0x48
jmp 0x425f18
lea eax, [ebp - 4]
push eax
push 0xab8
push 0
push 0x4981
push 1
lea eax, [ebp - 0x6c]
push eax
call fcn.0042ade7
add esp, 0x18
jmp 0x425eed
lea ecx, [ebp - 0x1ac]
call fcn.0042f4a1
push 4
push 0x2000
mov eax, dword [ebp - 0x38]
push dword [eax + 0x50]
push 0
push 0x679
push 0x559
call fcn.004072ea
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
jmp 0x426512
mov dword [ebp - 0x4c], 0x57257ea0
mov dword [ebp - 0x7c], 0x14af12a8
push 3
lea ecx, [ebp - 0x164]
call fcn.0042f3cf
mov dword [ebp - 0x1d0], 0xfffffffe
mov dword [ebp - 0x1f4], 0x254e
mov dword [ebp - 0x1d8], 0x2e072305
mov dword [ebp - 0x124], 0x1d67a3d5
mov dword [ebp - 0x44], 0x2b5
mov dword [ebp - 0x9c], 9
mov dword [ebp - 0x11c], 0x426cefc6
mov dword [ebp - 0xac], 0xf74462d1
mov dword [ebp - 0x12c], 0xfffffffd
mov dword [ebp - 0xc4], 3
mov dword [ebp - 0x134], 3
mov dword [ebp - 0x13c], 0x4a13735c
mov dword [ebp - 0x1c], 0
jmp 0x4262e0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x4262f6
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x210], 0xffffffff
jmp 0x4262d9
push 0x3ffb
push 0x57c5
push 1
push 0x4357
lea eax, [ebp - 0x164]
push eax
push 0x2609
push 1
push 0x1082
push 0x6a2c
push 0x1f94
push 0x1584
push 0x1d14
push 0x3647
push 0x758d
push 0xe01
push 1
push 1
push 0x4d07
push 1
lea eax, [ebp - 0x1c]
push eax
call fcn.00418fd6
add esp, 0x50
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x42636a
cmp dword [ebp - 0x4c], 0
je 0x42636a
mov dword [ebp - 0x74], 1
jmp 0x42636e
and dword [ebp - 0x74], 0
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x44], eax
jle 0x42638f
mov dword [ebp - 0x84], 1
jmp 0x426396
and dword [ebp - 0x84], 0
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x84]
cmp eax, 0x6af83395
je 0x4263b3
mov dword [ebp - 0x114], 1
jmp 0x4263ba
and dword [ebp - 0x114], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x210], 0x56e2
mov eax, dword [ebp - 0x4c]
sub eax, 0x56e2
imul eax, eax, 0x38a8
cmp eax, 1
jg 0x4263ea
mov dword [ebp - 0x8c], 1
jmp 0x4263f1
and dword [ebp - 0x8c], 0
push 2
lea ecx, [ebp - 0x164]
call fcn.0042f4bd
mov ecx, dword [ebp - 0x8c]
cmp ecx, dword [eax]
jl 0x426414
mov dword [ebp - 0x94], 1
jmp 0x42641b
and dword [ebp - 0x94], 0
imul eax, dword [ebp - 0x94], 0xb47d
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x11c]
lea eax, [eax + ecx + 0xb39]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0xac], eax
jne 0x42645e
mov dword [ebp - 0xb4], 1
jmp 0x426465
and dword [ebp - 0xb4], 0
push 2
lea ecx, [ebp - 0x164]
call fcn.0042f4bd
mov ecx, dword [ebp - 0xb4]
sub ecx, dword [eax]
mov dword [ebp - 0x12c], ecx
xor eax, eax
inc eax
cmp eax, 0xcb933df
ja 0x426496
mov dword [ebp - 0xbc], 1
jmp 0x42649d
and dword [ebp - 0xbc], 0
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jg 0x4264be
mov dword [ebp - 0xcc], 1
jmp 0x4264c5
and dword [ebp - 0xcc], 0
imul eax, dword [ebp - 0xcc], 0x2a
cmp eax, 0x86e8
jg 0x4264df
mov dword [ebp - 0xd4], 1
jmp 0x4264e6
and dword [ebp - 0xd4], 0
mov esi, dword [ebp - 0x134]
add esi, dword [ebp - 0xd4]
push 0
lea ecx, [ebp - 0x164]
call fcn.0042f4bd
add esi, dword [eax]
mov dword [ebp - 0x13c], esi
lea ecx, [ebp - 0x164]
call fcn.0042f4a1
jmp 0x42655b
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
movzx eax, byte [eax]
test eax, eax
je 0x426540
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
jmp 0x42655b
mov byte [ebp - 9], 0
movzx eax, byte [ebp - 9]
test eax, eax
je 0x42655b
push 0x1c7e
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
pop esi
mov esp, ebp
pop ebp
ret