Function at 0x401000
Capabilities:
Set environment variable
Start service

Disassembly:
call sub.kernel32.dll_GetUserDefaultLCID
cmp eax, 0xfffffef7
jne 0x401075
call sub.user32.dll_CharNextA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.user32.dll_CharNextA
call sub.advapi32.dll_StartServiceA
call sub.advapi32.dll_StartServiceA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.user32.dll_CharNextA
call sub.advapi32.dll_StartServiceA
call sub.advapi32.dll_StartServiceA
call sub.user32.dll_CharNextA
call sub.user32.dll_CharNextA
call sub.advapi32.dll_StartServiceA
call sub.user32.dll_CharNextA
ret
call sub.user32.dll_GetProcessWindowStation
cmp eax, 0xffffff1b
jne 0x4010ea
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.advapi32.dll_StartServiceA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.user32.dll_CharNextA
call sub.advapi32.dll_StartServiceA
call sub.user32.dll_CharNextA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.user32.dll_CharNextA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.advapi32.dll_StartServiceA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.advapi32.dll_StartServiceA
call sub.advapi32.dll_StartServiceA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.user32.dll_CharNextA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.advapi32.dll_StartServiceA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
ret
call sub.kernel32.dll_GetUserDefaultLCID
cmp eax, 0xffffff30
jne 0x401196
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.advapi32.dll_StartServiceA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.advapi32.dll_StartServiceA
call sub.user32.dll_CharNextA
call sub.user32.dll_CharNextA
call sub.advapi32.dll_StartServiceA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.advapi32.dll_StartServiceA
call sub.advapi32.dll_StartServiceA
call sub.advapi32.dll_StartServiceA
call sub.user32.dll_CharNextA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.user32.dll_CharNextA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.user32.dll_CharNextA
call sub.advapi32.dll_StartServiceA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.user32.dll_CharNextA
ret
call sub.kernel32.dll_GetVersion
cmp eax, 0xfffffedf
jne 0x40123d
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.user32.dll_CharNextA
call sub.advapi32.dll_StartServiceA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.advapi32.dll_StartServiceA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.advapi32.dll_StartServiceA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.advapi32.dll_StartServiceA
call sub.user32.dll_CharNextA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.advapi32.dll_StartServiceA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.advapi32.dll_StartServiceA
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.ntdll.dll_RtlTimeToElapsedTimeFields
call sub.user32.dll_CharNextA
call sub.user32.dll_CharNextA
call sub.advapi32.dll_StartServiceA
call sub.user32.dll_CharNextA
call sub.kernel32.dll_SetEnvironmentVariableA
ret
jmp 0x49858a
mov ebx, edi
not edi
sub ebx, 0xe24e451f
xchg ecx, edx
mov edi, edx
jmp 0x49a091
push 0xe25ca72d
or ebx, edx
mov ebx, esi
or ebx, edx
xchg esi, edi
xor esi, 0xe6237ee8
mov edx, ebx
shl esi, 1
sub esi, ebx
sub edx, 0xe6252120
add esi, ebx
inc edi
mov edx, ebx
jmp 0x49a6e7
jmp loc.004a0000
call ecx
bswap esi
or edx, ebx
bswap edi
sub esi, 0xe715fa91
sub esi, edi
add edi, esi
sub edx, esi
and ebx, edx
xor edx, edi
sub ebx, edx
or esi, edx
and edi, ebx
add edx, edi
and edx, esi
jmp 0x49986d
pop ecx
xor ebx, 0xe73a4e63
and ebx, edx
add edi, ebx
xchg edi, esi
sub edx, esi
sub esi, ebx
add ebx, edi
sub edi, ebx
shr ebx, 5
or edx, esi
mov ebx, 0xe73eb923
sub edi, ebx
add esi, edx
sub ebx, 0xe73fe71d
jmp 0x49a6aa
mov ecx, 0x123b2f04
add edx, ebx
or ebx, edx
mov esi, ebx
mov edi, ebx
and ebx, 0xe76422f6
xchg ebx, edi
xchg esi, edx
shr ebx, 0xa
and ebx, 0xe765d670
mov edi, ebx
xor edx, esi
xchg esi, edx
shr edi, 1
or edi, ebx
sub edx, ebx
jmp 0x498c72
push 0xe256cce4
and esi, ebx
or esi, edi
or ebx, 0xe7842e0a
mov esi, edi
or ebx, edx
or esi, 0xe7859b35
or edi, 0xe785fddd
xor ebx, edx
xchg edi, ebx
sub edi, 0xe787802a
or esi, 0xe787fff9
mov ebx, esi
add edi, 0xe788cc5c
jmp 0x49a9b0
call fcn.00499480
xchg edi, edx
xor edx, esi
sub ebx, edi
or edi, ebx
xor edi, esi
mov edi, esi
xchg esi, edi
inc esi
sub edi, edx
sub ebx, esi
and esi, 0xe7c35b0c
jmp 0x498cf0
pop ecx
xor edi, ebx
xor edx, ebx
sub edi, esi
and ebx, esi
and esi, edx
and esi, edi
or esi, edi
and edx, edi
jmp 0x499a55
pop ecx
add esi, 0xe87be557
xor edi, 0xe87c55ff
and esi, ebx
sub ebx, esi
or ebx, esi
and esi, edi
rol edi, 0x16
jmp 0x498614
call fcn.00499480
or edi, 0xe87f15e3
xor esi, edx
add esi, edi
and esi, 0xe8804f8d
xchg esi, edi
or edi, esi
inc esi
mov esi, edi
jmp 0x49af34
mov ecx, 0x123b2f04
xor edi, ebx
shl edi, 6
mov esi, 0xe883439b
mov edi, edx
shl edi, 6
add edi, ebx
shl ebx, 0x1d
and edx, 0xe887791f
and edx, ebx
mov ebx, edx
jmp 0x499744
pop ecx
bswap edx
dec ebx
jmp 0x49af06
pop ecx
sub edi, ebx
bswap esi
mov edi, 0xe91ccaeb
sub ebx, edx
xor esi, edi
mov esi, 0xe9418105
or edi, ebx
sub ebx, edx
and esi, ebx
xchg edi, esi
add edi, edx
or ebx, esi
sub ebx, edi
xchg edx, ebx
sub edi, 0xe94bb833
jmp 0x498de0
mov ecx, 0x2774562b
neg ebx
rol edi, 0x13
or edx, edi
and edi, 0xe96e3e23
add edx, edi
or edi, esi
xchg esi, edx
jmp 0x499192
push 0xe2576adf
dec edi
neg edx
or edx, ebx
add ebx, edx
shr ebx, 0x1e
or esi, 0xe9b6cd2b
mov esi, edx
and edi, edx
add edx, esi
dec esi
jmp 0x49a2ff
push 0xe254dba8
sub ebx, 0xea1779cd
add ebx, 0xea1b7a32
xchg esi, edi
and edi, 0xea1c4cf9
shl esi, 0xd
xchg esi, edx
or edi, esi
mov edi, edx
add esi, edx
xor esi, ebx
mov edi, esi
bswap edi
sub esi, ebx
or edx, esi
neg edx
add esi, edx
jmp 0x499b84
push 0xe257b5a0
and edi, esi
xor ebx, edx
mov esi, ebx
neg ebx
sub edx, esi
shl edi, 9
mov esi, edx
ror edi, 0x13
xchg edi, esi
jmp 0x499765
pop ecx
not ebx
shl ebx, 0x1b
sub edi, edx
add esi, 0xeafb2ba5
mov edx, edi
xor esi, ebx
add edx, esi
and esi, 0xeafcd94a
inc esi
jmp 0x499727
push 0xe25cf0fb
inc ebx
xchg ebx, esi
sub edi, ebx
sub esi, edi
xor edx, 0xeb02ba52
xchg esi, ebx
xor ebx, 0xeb0386fc
shr edx, 6
bswap ebx
and esi, edi
jmp 0x49ac59
push 0xe2571c68
and esi, ebx
sub esi, ebx
and edx, ebx
bswap edi
shl edx, 6
or esi, edi
bswap edx
sub ebx, edi
shl edx, 0xa
sub esi, edx
sub ebx, esi
xor edx, esi
jmp 0x499db3
push 0xe25d467b
sub edx, edi
neg ebx
mov ebx, esi
xor edx, 0xebbb000e
sub esi, edx
jmp 0x498efa
push 0xe2568215
or esi, edi
bswap edi
inc ebx
add esi, edi
jmp 0x498fd3
call ecx
add ebx, esi
or ebx, 0xec1e42f5
mov edx, 0xec1ea90b
or edx, esi
or esi, edx
and esi, 0xec200917
xchg edx, esi
jmp 0x499599