Function at 0x401000
Capabilities:
Accept command line arguments
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Copy file
Create directory
Create service
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Inspect section memory permissions
Modify service
Parse pe header
Persist via windows service
Query environment variable
Query or enumerate registry value
Query service status
Read file on windows
Set file attributes
Set registry value
Start service
Stop service
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3d4
push esi
mov dword [ebp - 0x130], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x128], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
je 0x401119
mov eax, dword [ebp - 0x234]
xor ecx, ecx
mov cx, word [eax]
test ecx, ecx
je 0x4010e9
mov edx, dword [ebp - 0x234]
xor eax, eax
mov ax, word [edx]
cmp eax, 0x22
jne 0x4010bd
xor ecx, ecx
cmp dword [ebp - 0x248], 0
sete cl
mov dword [ebp - 0x248], ecx
mov edx, dword [ebp - 0x234]
xor eax, eax
mov ax, word [edx]
cmp eax, 0x20
jne 0x4010d8
cmp dword [ebp - 0x248], 0
jne 0x4010d8
jmp 0x4010e9
mov ecx, dword [ebp - 0x234]
add ecx, 2
mov dword [ebp - 0x234], ecx
jmp 0x40108c
mov edx, dword [ebp - 0x234]
xor eax, eax
mov ax, word [edx]
cmp eax, 0x20
jne 0x401119
mov ecx, dword [ebp - 0x234]
xor edx, edx
mov dx, word [ecx]
test edx, edx
je 0x401119
mov eax, dword [ebp - 0x234]
add eax, 2
mov dword [ebp - 0x234], eax
jmp 0x4010e9
mov dword [ebp - 0x244], 0
mov ecx, dword [ebp - 0x234]
xor edx, edx
mov dx, word [ecx]
test edx, edx
je 0x40154b
mov eax, dword [ebp - 0x234]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x2f
jne 0x40154b
mov dword [ebp - 0x35c], 0
mov edx, dword [ebp - 0x234]
add edx, 2
mov dword [ebp - 0x234], edx
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x234]
xor edx, edx
mov dx, word [ecx]
test edx, edx
je 0x4011c2
mov eax, dword [ebp - 0x234]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x20
je 0x4011c2
mov edx, dword [ebp - 0x35c]
mov eax, dword [ebp - 0x234]
mov cl, byte [eax]
mov byte [edx + 0x4135f0], cl
mov edx, dword [ebp - 0x35c]
add edx, 1
mov dword [ebp - 0x35c], edx
mov eax, dword [ebp - 0x234]
add eax, 2
mov dword [ebp - 0x234], eax
jmp 0x40116f
mov ecx, dword [ebp - 0x35c]
mov byte [ecx + 0x4135f0], 0
mov edx, dword [ebp - 0x130]
xor eax, eax
mov ax, word [edx]
mov dword [ebp - 0x3d4], eax
mov ecx, dword [ebp - 0x3d4]
sub ecx, 0x3f
mov dword [ebp - 0x3d4], ecx
cmp dword [ebp - 0x3d4], 0x38
ja case.0x40120a.9
mov eax, dword [ebp - 0x3d4]
xor edx, edx
mov dl, byte [eax + 0x402c4a]
jmp dword [edx*4 + 0x402c22]
mov ecx, dword [ebp - 0x35c]
push ecx
push 0x410030
mov edx, dword [ebp - 0x130]
push edx
call fcn.00404320
add esp, 0xc
test eax, eax
je 0x401239
mov dword [ebp - 0x14], 1
jmp 0x401261
cmp dword [ebp - 0x254], 0
jne 0x40124b
cmp dword [ebp - 0x24c], 0
je 0x40125a
mov eax, dword [ebp - 0x244]
add eax, 1
mov dword [ebp - 0x244], eax
mov dword [ebp - 8], 1
jmp 0x401497
mov ecx, dword [ebp - 0x35c]
push ecx
push 0x41003c
mov edx, dword [ebp - 0x130]
push edx
call fcn.00404320
add esp, 0xc
test eax, eax
je 0x40128e
mov dword [ebp - 0x14], 1
jmp 0x401298
mov dword [ebp - 0x250], 1
jmp 0x401497
mov eax, dword [ebp - 0x35c]
push eax
push 0x410048
mov ecx, dword [ebp - 0x130]
push ecx
call fcn.00404320
add esp, 0xc
test eax, eax
je 0x4012c5
mov dword [ebp - 0x14], 1
jmp 0x4012f6
cmp dword [ebp - 8], 0
jne 0x4012dd
cmp dword [ebp - 0x24c], 0
jne 0x4012dd
cmp dword [ebp - 0x124], 0
je 0x4012ec
mov edx, dword [ebp - 0x244]
add edx, 1
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x254], 1
jmp 0x401497
mov eax, dword [ebp - 0x35c]
push eax
push 0x410050
mov ecx, dword [ebp - 0x130]
push ecx
call fcn.00404320
add esp, 0xc
test eax, eax
je 0x401323
mov dword [ebp - 0x14], 1
jmp 0x40132a
mov dword [ebp - 0x10], 1
jmp 0x401497
mov edx, dword [ebp - 0x35c]
push edx
push 0x41005c
mov eax, dword [ebp - 0x130]
push eax
call fcn.00404320
add esp, 0xc
test eax, eax
je 0x401357
mov dword [ebp - 0x14], 1
jmp 0x401385
cmp dword [ebp - 8], 0
jne 0x40136f
cmp dword [ebp - 0x24c], 0
jne 0x40136f
cmp dword [ebp - 0x124], 0
je 0x40137e
mov ecx, dword [ebp - 0x244]
add ecx, 1
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x18], 1
jmp 0x401497
mov edx, dword [ebp - 0x35c]
push edx
push 0x410068
mov eax, dword [ebp - 0x130]
push eax
call fcn.00404320
add esp, 0xc
test eax, eax
je 0x4013b2
mov dword [ebp - 0x14], 1
jmp 0x4013da
cmp dword [ebp - 8], 0
jne 0x4013c1
cmp dword [ebp - 0x254], 0
je 0x4013d0
mov ecx, dword [ebp - 0x244]
add ecx, 1
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x24c], 1
jmp 0x401497
mov edx, dword [ebp - 0x35c]
push edx
push 0x410074
mov eax, dword [ebp - 0x130]
push eax
call fcn.00404320
add esp, 0xc
test eax, eax
je 0x401407
mov dword [ebp - 0x14], 1
jmp 0x401429
cmp dword [ebp - 0x254], 0
je 0x40141f
mov ecx, dword [ebp - 0x244]
add ecx, 1
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x124], 1
jmp 0x401497
mov edx, dword [ebp - 0x35c]
push edx
push 0x410080
mov eax, dword [ebp - 0x130]
push eax
call fcn.00404320
add esp, 0xc
test eax, eax
je 0x401453
mov dword [ebp - 0x14], 1
jmp 0x401472
cmp dword [ebp - 0x254], 0
je 0x40146b
mov ecx, dword [ebp - 0x244]
add ecx, 1
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0xc], 1
jmp 0x401497
push 0x40
push 0x410178
push 0x410180
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0
je 0x401516
push 0x4135f0
call fcn.004042a0
add esp, 4
mov esi, eax
push 0x410090
call fcn.004042a0
add esp, 4
lea edx, [esi + eax + 2]
push edx
call fcn.00402f10
add esp, 4
mov dword [ebp - 0x360], eax
push 0x4135f0
push 0x410090
mov eax, dword [ebp - 0x360]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x1010
push 0x4101e4
mov ecx, dword [ebp - 0x360]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [ebp - 0x360]
push edx
call fcn.00403340
add esp, 4
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x234]
xor ecx, ecx
mov cx, word [eax]
test ecx, ecx
je 0x401546
mov edx, dword [ebp - 0x234]
xor eax, eax
mov ax, word [edx]
cmp eax, 0x20
jne 0x401546
mov ecx, dword [ebp - 0x234]
add ecx, 2
mov dword [ebp - 0x234], ecx
jmp 0x401516
jmp 0x401123
cmp dword [ebp - 0x244], 0
je 0x40156a
mov edx, dword [ebp - 0x250]
push edx
push 0xffffffffffffffff
push 0x4101ec
call fcn.00402c83
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x40165c
push 0x410244
push 0x410250
push 0x410274
push 0x413b40
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x413dc8
push 0x20019
push 0
push 0x413b40
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4015c7
mov eax, dword [ebp - 0x250]
push eax
push 0xffffffffffffffff
push 0x41027c
call fcn.00402c83
add esp, 0xc
mov dword [ebp - 0x238], 4
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x23c]
push edx
lea eax, [ebp - 0x12c]
push eax
push 0
push 0x4102ac
mov ecx, dword [0x413dc8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401614
mov edx, dword [ebp - 0x250]
push edx
push 0xffffffffffffffff
push 0x4102b4
call fcn.00402c83
add esp, 0xc
cmp dword [ebp - 0x23c], 1
je 0x401645
cmp dword [ebp - 0x23c], 0
je 0x401645
cmp dword [ebp - 0x23c], 2
je 0x401645
mov eax, dword [ebp - 0x250]
push eax
push 0xffffffffffffffff
push 0x4102ec
call fcn.00402c83
add esp, 0xc
mov ecx, dword [0x413dc8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x413dc8], 0
mov edx, dword [ebp - 0x234]
xor eax, eax
mov ax, word [edx]
cmp eax, 0x22
jne 0x401687
mov dword [ebp - 0x248], 1
mov ecx, dword [ebp - 0x234]
add ecx, 2
mov dword [ebp - 0x234], ecx
jmp 0x401691
mov dword [ebp - 0x248], 0
mov dword [0x413dc0], 0x413a20
mov edx, dword [ebp - 0x234]
mov dword [ebp - 0x138], edx
jmp 0x4016b8
mov eax, dword [ebp - 0x138]
add eax, 2
mov dword [ebp - 0x138], eax
mov ecx, dword [ebp - 0x138]
xor edx, edx
mov dx, word [ecx]
test edx, edx
je 0x401717
cmp dword [ebp - 0x248], 1
jne 0x4016e0
mov eax, dword [ebp - 0x138]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x22
je 0x4016f9
cmp dword [ebp - 0x248], 0
jne 0x401715
mov edx, dword [ebp - 0x138]
xor eax, eax
mov ax, word [edx]
cmp eax, 0x20
jne 0x401715
mov ecx, dword [ebp - 0x138]
mov word [ecx], 0
mov edx, dword [ebp - 0x138]
add edx, 2
mov dword [ebp - 0x138], edx
jmp 0x401717
jmp 0x4016a9
push 0x410330
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x413dd4], eax
cmp dword [0x413dd4], 0
jne 0x40174a
mov eax, dword [ebp - 0x250]
push eax
push 0xffffffffffffffff
push 0x410340
call fcn.00402c83
add esp, 0xc
push 0xffffffffffffffff
mov ecx, dword [0x413dd4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x254], 0
jne 0x40195f
push 0x20000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [0x413dc4], eax
cmp dword [0x413dc4], 0
jne 0x401799
mov edx, dword [ebp - 0x250]
push edx
push 0xffffffffffffffff
push 0x41035c
call fcn.00402c83
add esp, 0xc
mov dword [ebp - 0x120], 1
jmp 0x4017b4
mov eax, dword [ebp - 0x120]
add eax, 1
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x3e5
jge 0x40195f
mov ecx, dword [ebp - 0x120]
push ecx
push 0x410384
push 0x413900
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp eax, 0x104
jl 0x4017f6
push 0
push 0xffffffffffffffff
push 0x410390
call fcn.00402c83
add esp, 0xc
push 0x413900
push 0x4103ac
push 0x4103d0
push 0x413b40
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
cmp eax, 0x126
jb 0x40182b
push 0
push 0xffffffffffffffff
push 0x4103d8
call fcn.00402c83
add esp, 0xc
push 0x413dc8
push 0x20019
push 0
push 0x413b40
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401861
mov edx, dword [ebp - 0x250]
push edx
push 0xfffffffffffffffd
push 0x4103f4
call fcn.00402c83
add esp, 0xc
mov dword [ebp - 0x238], 4
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x23c]
push ecx
lea edx, [ebp - 0x12c]
push edx
push 0
push 0x410420
mov eax, dword [0x413dc8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4018ad
mov ecx, dword [ebp - 0x250]
push ecx
push 0xffffffffffffffff
push 0x410428
call fcn.00402c83
add esp, 0xc
mov edx, dword [0x413dc8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x413dc8], 0
cmp dword [ebp - 0x23c], 2
je 0x4018df
cmp dword [ebp - 0x23c], 0
je 0x4018df
cmp dword [ebp - 0x23c], 1
jne 0x4018e4
jmp 0x4017a5
push 0xf01ff
push 0x413900
mov eax, dword [0x413dc4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [0x413dcc], eax
cmp dword [0x413dcc], 0
jne 0x40190d
jmp 0x4017a5
push 0x413da0
mov ecx, dword [0x413dcc]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x401939
mov edx, dword [ebp - 0x250]
push edx
push 0xffffffffffffffff
push 0x410454
call fcn.00402c83
add esp, 0xc
cmp dword [0x413da4], 1
jne 0x401944
jmp 0x40195f
mov eax, dword [0x413dcc]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [0x413dcc], 0
jmp 0x4017a5
mov ecx, dword [ebp - 0x234]
xor edx, edx
mov dx, word [ecx]
test edx, edx
jne 0x4019ac
mov eax, dword [0x413dc8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x413dd4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 0x250], 0
jne 0x4019a4
push 0x20
push 0x41046c
push 0x410474
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0
push 0x104
lea edx, [ebp - 0x11c]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp - 0x234]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [ebp - 0x254], 0
je 0x401b29
mov dword [ebp - 4], 0x410170
lea ecx, [ebp - 0x11c]
push ecx
call fcn.004042a0
add esp, 4
mov dword [ebp - 0x240], eax
mov edx, dword [ebp - 0x240]
movsx eax, byte [ebp + edx - 0x11c]
cmp eax, 0x2e
je 0x401a25
cmp dword [ebp - 0x240], 0
jle 0x401a25
mov ecx, dword [ebp - 0x240]
sub ecx, 1
mov dword [ebp - 0x240], ecx
jmp 0x4019f8
cmp dword [ebp - 0x240], 0
je 0x401b24
mov edx, dword [ebp - 0x240]
movsx eax, byte [ebp + edx - 0x11b]
cmp eax, 0x72
je 0x401a5c
mov ecx, dword [ebp - 0x240]
movsx edx, byte [ebp + ecx - 0x11b]
cmp edx, 0x52
jne 0x401af4
mov eax, dword [ebp - 0x240]
movsx ecx, byte [ebp + eax - 0x11a]
cmp ecx, 0x74
je 0x401a82
mov edx, dword [ebp - 0x240]
movsx eax, byte [ebp + edx - 0x11a]
cmp eax, 0x54
jne 0x401af4
mov ecx, dword [ebp - 0x240]
movsx edx, byte [ebp + ecx - 0x119]
cmp edx, 0x64
je 0x401aa8
mov eax, dword [ebp - 0x240]
movsx ecx, byte [ebp + eax - 0x119]
cmp ecx, 0x44
jne 0x401af4
mov edx, dword [ebp - 0x240]
movsx eax, byte [ebp + edx - 0x118]
cmp eax, 0x6c
je 0x401ace
mov ecx, dword [ebp - 0x240]
movsx edx, byte [ebp + ecx - 0x118]
cmp edx, 0x4c
jne 0x401af4
mov eax, dword [ebp - 0x240]
movsx ecx, byte [ebp + eax - 0x117]
cmp ecx, 0x6c
je 0x401b24
mov edx, dword [ebp - 0x240]
movsx eax, byte [ebp + edx - 0x117]
cmp eax, 0x4c
je 0x401b24
mov ecx, dword [ebp - 0x234]
push ecx
push 0x410504
push 0x413c80
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edx, dword [ebp - 0x250]
push edx
push 0xfffffffffffffffc
push 0x413c80
call fcn.00402c83
add esp, 0xc
jmp 0x401c47
mov dword [ebp - 4], 0x410168
lea eax, [ebp - 0x11c]
push eax
call fcn.004042a0
add esp, 4
mov dword [ebp - 0x240], eax
mov ecx, dword [ebp - 0x240]
movsx edx, byte [ebp + ecx - 0x11c]
cmp edx, 0x2e
je 0x401b72
cmp dword [ebp - 0x240], 0
jle 0x401b72
mov eax, dword [ebp - 0x240]
sub eax, 1
mov dword [ebp - 0x240], eax
jmp 0x401b45
cmp dword [ebp - 0x240], 0
je 0x401c47
mov ecx, dword [ebp - 0x240]
movsx edx, byte [ebp + ecx - 0x11b]
cmp edx, 0x72
je 0x401ba5
mov eax, dword [ebp - 0x240]
movsx ecx, byte [ebp + eax - 0x11b]
cmp ecx, 0x52
jne 0x401c17
mov edx, dword [ebp - 0x240]
movsx eax, byte [ebp + edx - 0x11a]
cmp eax, 0x74
je 0x401bcb
mov ecx, dword [ebp - 0x240]
movsx edx, byte [ebp + ecx - 0x11a]
cmp edx, 0x54
jne 0x401c17
mov eax, dword [ebp - 0x240]
movsx ecx, byte [ebp + eax - 0x119]
cmp ecx, 0x73
je 0x401bf1
mov edx, dword [ebp - 0x240]
movsx eax, byte [ebp + edx - 0x119]
cmp eax, 0x53
jne 0x401c17
mov ecx, dword [ebp - 0x240]
movsx edx, byte [ebp + ecx - 0x118]
cmp edx, 0x73
je 0x401c47
mov eax, dword [ebp - 0x240]
movsx ecx, byte [ebp + eax - 0x118]
cmp ecx, 0x53
je 0x401c47
mov edx, dword [ebp - 0x234]
push edx
push 0x410548
push 0x413c80
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp - 0x250]
push eax
push 0xfffffffffffffffc
push 0x413c80
call fcn.00402c83
add esp, 0xc
push 0x413dc0
push 0x413a20
push 0x104
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x11c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne 0x401c9d
mov eax, dword [ebp - 0x234]
push eax
push 0x410588
push 0x413c80
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [ebp - 0x250]
push ecx
push 0xfffffffffffffffc
push 0x413c80
call fcn.00402c83
add esp, 0xc
push 0x104
push 0x413c80
push 0x4105a0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x134], eax
mov edx, dword [ebp - 0x134]
mov dword [ebp - 0x238], edx
cmp dword [ebp - 0x238], 0
jne 0x401ce3
mov eax, dword [ebp - 0x250]
push eax
push 0xffffffffffffffff
push 0x4105ac
call fcn.00402c83
add esp, 0xc
push 0x4105e0
push 0x4105e8
mov ecx, dword [ebp - 0x238]
add ecx, 0x413c80
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edx, dword [ebp - 0x238]
add edx, eax
mov dword [ebp - 0x238], edx
cmp dword [ebp - 0x238], 0x104
jl 0x401d2e
push 0
push 0xffffffffffffffff
push 0x4105ec
call fcn.00402c83
add esp, 0xc
push 0x413c80
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffff
je 0x401d55
mov eax, dword [ebp - 0x23c]
and eax, 0x10
test eax, eax
jne 0x401d7c
push 0
push 0x413c80
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x401d7c
mov ecx, dword [ebp - 0x250]
push ecx
push 0xffffffffffffffff
push 0x410608
call fcn.00402c83
add esp, 0xc
cmp dword [ebp - 0x254], 0
je 0x401dcd
push 0x410634
mov edx, dword [ebp - 0x238]
add edx, 0x413c80
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov ecx, dword [ebp - 0x238]
add ecx, eax
mov dword [ebp - 0x238], ecx
cmp dword [ebp - 0x238], 0x104
jl 0x401dcb
push 0
push 0xffffffffffffffff
push 0x41063c
call fcn.00402c83
add esp, 0xc
jmp 0x401e19
mov edx, dword [ebp - 0x120]
push edx
push 0x410658
mov eax, dword [ebp - 0x238]
add eax, 0x413c80
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [ebp - 0x238]
add ecx, eax
mov dword [ebp - 0x238], ecx
cmp dword [ebp - 0x238], 0x104
jl 0x401e19
push 0
push 0xffffffffffffffff
push 0x410660
call fcn.00402c83
add esp, 0xc
push 0x413c80
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffff
je 0x401e40
mov edx, dword [ebp - 0x23c]
and edx, 0x10
test edx, edx
jne 0x401e6c
push 0
push 0x413c80
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x401e67
mov eax, dword [ebp - 0x250]
push eax
push 0xffffffffffffffff
push 0x41067c
call fcn.00402c83
add esp, 0xc
jmp 0x401f92
cmp dword [ebp - 0x254], 0
jne 0x401f92
push 0x4106ac
mov ecx, dword [ebp - 0x238]
add ecx, 0x413c80
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov edx, dword [ebp - 0x238]
add edx, eax
cmp edx, 0x104
jl 0x401eb5
push 0
push 0xffffffffffffffff
push 0x4106b0
call fcn.00402c83
add esp, 0xc
push 0x413de0
push 0x413c80
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [0x413dbc], eax
cmp dword [0x413dbc], 0xffffffff
je 0x401f92
push 0x413e0c
push 0x4106cc
mov eax, dword [ebp - 0x238]
add eax, 0x413c80
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [ebp - 0x238]
add ecx, eax
cmp ecx, 0x104
jl 0x401f17
push 0
push 0xffffffffffffffff
push 0x4106d0
call fcn.00402c83
add esp, 0xc
push 0x413c80
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x413de0
mov edx, dword [0x413dbc]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x401f85
push 0x413e0c
push 0x4106ec
mov eax, dword [ebp - 0x238]
add eax, 0x413c80
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [ebp - 0x238]
add ecx, eax
cmp ecx, 0x104
jl 0x401f78
push 0
push 0xffffffffffffffff
push 0x4106f0
call fcn.00402c83
add esp, 0xc
push 0x413c80
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x401f22
mov edx, dword [0x413dbc]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x254], 0
je 0x40217d
cmp dword [ebp - 0x250], 0
jne 0x40217d
push 0x41070c
mov eax, dword [ebp - 0x238]
add eax, 0x413c80
push eax
call fcn.00402e10
add esp, 8
push 0x413de0
push 0x413c80
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [0x413dbc], eax
cmp dword [0x413dbc], 0xffffffff
je 0x40217d
push 0x413e0c
mov ecx, dword [0x413dc0]
push ecx
call fcn.00402d80
add esp, 8
test eax, eax
jne 0x40209d
mov edx, dword [0x413dc0]
push edx
call fcn.004042a0
add esp, 4
mov esi, eax
push 0x410114
call fcn.004042a0
add esp, 4
lea eax, [esi + eax + 2]
push eax
call fcn.00402f10
add esp, 4
mov dword [ebp - 0x364], eax
mov ecx, dword [0x413dc0]
push ecx
push 0x410114
mov edx, dword [ebp - 0x364]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x1044
push 0x410710
mov eax, dword [ebp - 0x364]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x40208e
mov ecx, dword [ebp - 0x364]
push ecx
call fcn.00403340
add esp, 4
push 1
push 0
push 0x4136f4
call fcn.00402c83
add esp, 0xc
mov edx, dword [ebp - 0x364]
push edx
call fcn.00403340
add esp, 4
push 0x413de0
mov eax, dword [0x413dbc]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x402171
push 0x413e0c
mov ecx, dword [0x413dc0]
push ecx
call fcn.00402d80
add esp, 8
test eax, eax
jne 0x40216c
mov edx, dword [0x413dc0]
push edx
call fcn.004042a0
add esp, 4
mov esi, eax
push 0x410114
call fcn.004042a0
add esp, 4
lea eax, [esi + eax + 2]
push eax
call fcn.00402f10
add esp, 4
mov dword [ebp - 0x368], eax
mov ecx, dword [0x413dc0]
push ecx
push 0x410114
mov edx, dword [ebp - 0x368]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x1044
push 0x410718
mov eax, dword [ebp - 0x368]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x40215d
mov ecx, dword [ebp - 0x368]
push ecx
call fcn.00403340
add esp, 4
push 1
push 0
push 0x4136f8
call fcn.00402c83
add esp, 0xc
mov edx, dword [ebp - 0x368]
push edx
call fcn.00403340
add esp, 4
jmp 0x40209d
mov eax, dword [0x413dbc]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [0x413dc0]
push ecx
push 0x410720
mov edx, dword [ebp - 0x238]
add edx, 0x413c80
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [ebp - 0x238]
add ecx, eax
cmp ecx, 0x104
jl 0x4021c0
push 0
push 0xffffffffffffffff
push 0x410724
call fcn.00402c83
add esp, 0xc
push 0
push 0x413c80
push 0x413a20
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4022c9
push 0x413a20
call fcn.004042a0
add esp, 4
mov dword [ebp - 0x240], eax
mov edx, dword [ebp - 0x240]
movsx eax, byte [edx + 0x413a20]
cmp eax, 0x2e
je 0x402219
cmp dword [ebp - 0x240], 0
jle 0x402219
mov ecx, dword [ebp - 0x240]
sub ecx, 1
mov dword [ebp - 0x240], ecx
jmp 0x4021ed
cmp dword [ebp - 0x240], 0
jne 0x40229b
push 0x413a20
call fcn.004042a0
add esp, 4
mov dword [ebp - 0x240], eax
push 0x410740
push 0x410748
mov edx, dword [ebp - 0x240]
add edx, 0x413a20
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x413c80
push 0x413a20
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x402299
push 0x413a20
push 0x41074c
push 0x413c80
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp - 0x250]
push eax
push 0xffffffffffffffff
push 0x413c80
call fcn.00402c83
add esp, 0xc
jmp 0x4022c9
push 0x413a20
push 0x410768
push 0x413c80
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [ebp - 0x250]
push ecx
push 0xffffffffffffffff
push 0x413c80
call fcn.00402c83
add esp, 0xc
push 0x80
push 0x413c80
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x40230b
push 0x413c80
push 0x410784
push 0x413a20
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edx, dword [ebp - 0x250]
push edx
push 0xffffffffffffffff
push 0x413a20
call fcn.00402c83
add esp, 0xc
cmp dword [ebp - 0x254], 0
jne 0x402541
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x413c80
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0xffffffff
jne 0x402372
push 0x413c80
push 0x4107ac
push 0x413a20
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp - 0x250]
push eax
push 0xffffffffffffffff
push 0x413a20
call fcn.00402c83
add esp, 0xc
push 0
push 0
push 0
mov ecx, dword [ebp - 0x3b0]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4023b8
push 0x413c80
push 0x4107cc
push 0x413a20
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edx, dword [ebp - 0x250]
push edx
push 0xffffffffffffffff
push 0x413a20
call fcn.00402c83
add esp, 0xc
push 0
lea eax, [ebp - 0x36c]
push eax
push 0x40
lea ecx, [ebp - 0x3ac]
push ecx
mov edx, dword [ebp - 0x3b0]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x402409
push 0x413c80
push 0x4107f4
push 0x413a20
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp - 0x250]
push eax
push 0xffffffffffffffff
push 0x413a20
call fcn.00402c83
add esp, 0xc
cmp dword [ebp - 0x36c], 0x40
jne 0x402426
mov ecx, dword [ebp - 0x3ac]
and ecx, 0xffff
cmp ecx, 0x5a4d
je 0x402454
push 0x413c80
push 0x410814
push 0x413a20
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edx, dword [ebp - 0x250]
push edx
push 0xffffffffffffffff
push 0x413a20
call fcn.00402c83
add esp, 0xc
push 0
push 0
mov eax, dword [ebp - 0x370]
push eax
mov ecx, dword [ebp - 0x3b0]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40249f
push 0x413c80
push 0x41083c
push 0x413a20
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edx, dword [ebp - 0x250]
push edx
push 0xffffffffffffffff
push 0x413a20
call fcn.00402c83
add esp, 0xc
push 0
lea eax, [ebp - 0x36c]
push eax
push 0xf8
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x3b0]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4024f3
push 0x413c80
push 0x410864
push 0x413a20
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp - 0x250]
push eax
push 0xffffffffffffffff
push 0x413a20
call fcn.00402c83
add esp, 0xc
cmp dword [ebp - 0x36c], 0xf8
jne 0x402513
mov ecx, dword [ebp - 0x230]
and ecx, 0xffff
cmp ecx, 0x4550
je 0x402541
push 0x413c80
push 0x410884
push 0x413a20
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edx, dword [ebp - 0x250]
push edx
push 0xffffffffffffffff
push 0x413a20
call fcn.00402c83
add esp, 0xc
cmp dword [ebp - 0x254], 0
je 0x402716
push 0x40000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [0x413dc4], eax
cmp dword [0x413dc4], 0
jne 0x402581
mov eax, dword [ebp - 0x250]
push eax
push 0xffffffffffffffff
push 0x4108a8
call fcn.00402c83
add esp, 0xc
mov byte [ebp - 0x3b4], 0
mov ecx, dword [0x413dc0]
push ecx
call fcn.004042a0
add esp, 4
mov edx, dword [0x413dc0]
add edx, eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x2e
je 0x4025c3
mov edx, dword [ebp - 4]
cmp edx, dword [0x413dc0]
jbe 0x4025c3
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x4025a2
push 0x410170
mov ecx, dword [ebp - 4]
push ecx
call fcn.00402cf0
add esp, 8
test eax, eax
jne 0x4025e9
mov edx, dword [ebp - 4]
mov al, byte [edx]
mov byte [ebp - 0x3b4], al
mov ecx, dword [ebp - 4]
mov byte [ecx], 0
mov edx, dword [0x413dc0]
push edx
push 0x4108d0
push 0x413b40
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x104
jl 0x402626
push 0
push 0xffffffffffffffff
push 0x4108dc
call fcn.00402c83
add esp, 0xc
movsx eax, byte [ebp - 0x3b4]
test eax, eax
je 0x40263c
mov ecx, dword [ebp - 4]
mov dl, byte [ebp - 0x3b4]
mov byte [ecx], dl
mov eax, dword [0x413dc0]
push eax
push 0x410108
push 0x413900
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp eax, 0x104
jl 0x40266d
push 0
push 0xffffffffffffffff
push 0x4108f8
call fcn.00402c83
add esp, 0xc
push 0xf01ff
push 0x413900
mov ecx, dword [0x413dc4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [0x413dcc], eax
cmp dword [0x413dcc], 0
jne 0x402716
push 0
push 0
push 0
push 0
push 0
push 0x413c80
push 1
push 3
push 1
push 0xf01ff
push 0x413b40
push 0x413900
mov edx, dword [0x413dc4]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [0x413dcc], eax
cmp dword [0x413dcc], 0
jne 0x402716
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
push eax
push 0x413a20
push 0x410914
push 0x413c80
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ecx, dword [ebp - 0x250]
push ecx
push 0xffffffffffffffff
push 0x413c80
call fcn.00402c83
add esp, 0xc
mov edx, dword [ebp - 0x134]
add edx, 0x413c80
push edx
push 0x410940
push 0x413f20
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp eax, 0x104
jl 0x40274e
push 0
push 0xffffffffffffffff
push 0x410950
call fcn.00402c83
add esp, 0xc
push 0
push 0
push 0
push 0
push 0
push 0
push 0x413f20
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
neg eax
sbb eax, eax
add eax, 3
push eax
push 0xffffffffffffffff
mov ecx, dword [0x413dcc]
push ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x402795
mov edx, dword [ebp - 0x250]
push edx
push 0xffffffffffffffff
push 0x41096c
call fcn.00402c83
add esp, 0xc
push 0x413900
push 0x410990
push 0x4109b4
push 0x413b40
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x413dc8
push 0x20006
push 0
push 0x413b40
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4027e8
mov eax, dword [ebp - 0x250]
push eax
push 0xffffffffffffffff
push 0x4109bc
call fcn.00402c83
add esp, 0xc
push 0
push 0
push 0x104
lea ecx, [ebp - 0x358]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 0x138]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [0x413dc0]
mov dword [0x414024], eax
mov ecx, dword [0x414024]
movsx edx, byte [ecx]
test edx, edx
je 0x402840
mov eax, dword [0x414024]
movsx ecx, byte [eax]
cmp ecx, 0x20
je 0x402840
mov edx, dword [0x414024]
add edx, 1
mov dword [0x414024], edx
jmp 0x402815
mov eax, dword [0x414024]
movsx ecx, byte [eax]
test ecx, ecx
je 0x402874
lea edx, [ebp - 0x358]
push edx
mov eax, dword [0x413dc0]
push eax
push 0x4109ec
push 0x413c80
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov dword [ebp - 0x238], eax
jmp 0x40289b
lea ecx, [ebp - 0x358]
push ecx
mov edx, dword [0x413dc0]
push edx
push 0x4109f4
push 0x413c80
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x238]
push eax
push 0x413c80
push 1
push 0
push 0x4109fc
mov ecx, dword [0x413dc8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4028d7
mov edx, dword [ebp - 0x250]
push edx
push 0xffffffffffffffff
push 0x410a04
call fcn.00402c83
add esp, 0xc
push 0x410a34
mov eax, dword [0x413dc8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp - 0x24c], 0
je 0x402938
mov dword [ebp - 0x238], 4
mov ecx, dword [ebp - 0x238]
push ecx
lea edx, [ebp - 0x24c]
push edx
push 4
push 0
push 0x410a48
mov eax, dword [0x413dc8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x402938
mov ecx, dword [ebp - 0x250]
push ecx
push 0xffffffffffffffff
push 0x410a5c
call fcn.00402c83
add esp, 0xc
push 0x413dd0
push 0xf003f
push 0
push 0x410a98
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4029a1
mov dword [ebp - 0x238], 4
lea edx, [ebp - 0x238]
push edx
lea eax, [ebp - 0x128]
push eax
push 0
push 0
push 0x410ac0
mov ecx, dword [0x413dd0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x402994
mov dword [ebp - 0x128], 0
mov edx, dword [0x413dd0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x410acc
mov eax, dword [0x413dc8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp - 0x128], 1
jne 0x402a0a
cmp dword [ebp - 0xc], 0
jne 0x402a08
mov dword [ebp - 0x238], 4
mov ecx, dword [ebp - 0x238]
push ecx
lea edx, [ebp - 0x128]
push edx
push 4
push 0
push 0x410adc
mov eax, dword [0x413dc8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x402a08
mov ecx, dword [ebp - 0x250]
push ecx
push 0xffffffffffffffff
push 0x410aec
call fcn.00402c83
add esp, 0xc
jmp 0x402a65
cmp dword [ebp - 0x124], 0
je 0x402a65
mov dword [ebp - 0x128], 1
mov dword [ebp - 0x238], 4
mov edx, dword [ebp - 0x238]
push edx
lea eax, [ebp - 0x128]
push eax
push 4
push 0
push 0x410b24
mov ecx, dword [0x413dc8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x402a65
mov edx, dword [ebp - 0x250]
push edx
push 0xffffffffffffffff
push 0x410b34
call fcn.00402c83
add esp, 0xc
cmp dword [ebp - 0x254], 0
jne 0x402ac6
push 0x410b6c
mov eax, dword [0x413dc8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x238], 4
mov ecx, dword [ebp - 0x238]
push ecx
lea edx, [ebp - 0x1cc]
push edx
push 4
push 0
push 0x410b84
mov eax, dword [0x413dc8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x402ac6
mov ecx, dword [ebp - 0x250]
push ecx
push 0xffffffffffffffff
push 0x410b9c
call fcn.00402c83
add esp, 0xc
cmp dword [ebp - 0x254], 0
je 0x402b14
mov dword [ebp - 0x238], 4
mov edx, dword [ebp - 0x238]
push edx
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push 0x410bdc
mov ecx, dword [0x413dc8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x402b14
mov edx, dword [ebp - 0x250]
push edx
push 0xffffffffffffffff
push 0x410be8
call fcn.00402c83
add esp, 0xc
mov eax, dword [0x413dc8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x402b62
mov ecx, dword [0x413dc0]
push ecx
push 0x410c1c
push 0x413c80
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp dword [ebp - 0x250], 0
jne 0x402b5d
push 0x40
push 0x410c50
push 0x413c80
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x402bef
cmp dword [ebp - 0x254], 0
je 0x402b71
cmp dword [ebp - 0x10], 0
je 0x402bba
push 0
push 0
mov edx, dword [0x413dcc]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x402bba
cmp dword [ebp - 0x10], 0
je 0x402ba4
mov eax, dword [ebp - 0x250]
push eax
push 0xfffffffffffffffb
push 0x410c58
call fcn.00402c83
add esp, 0xc
jmp 0x402bba
mov ecx, dword [ebp - 0x250]
push ecx
push 0xfffffffffffffffb
push 0x410c84
call fcn.00402c83
add esp, 0xc
cmp dword [ebp - 0x10], 0
je 0x402bef
lea edx, [ebp - 0x3d0]
push edx
push 1
mov eax, dword [0x413dcc]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x402bef
mov ecx, dword [ebp - 0x250]
push ecx
push 0xfffffffffffffffb
push 0x410cb8
call fcn.00402c83
add esp, 0xc
mov edx, dword [0x413dcc]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [0x413dc4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [0x413dd4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 0x120]
pop esi
mov esp, ebp
pop ebp
ret 0x10