Function at 0x42501c
Capabilities:
Accept command line arguments
Create thread
Get session user name
Query service status

Disassembly:
push 0x270
mov eax, 0x4aa446
call fcn.00473acf
mov eax, dword [ebp + 0x10]
push 0x41e8f0
mov dword [ebp - 0x23c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
call fcn.004342da
cmp eax, 0xd
jge 0x425087
push 0x40
push ecx
mov eax, esp
mov dword [ebp - 0x238], esp
push ecx
mov dword [eax], 0x4c11b0
mov eax, esp
mov dword [ebp - 0x238], esp
mov dword [eax], 0x4c11c0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call fcn.0041b1e7
add esp, 0x10
xor eax, eax
jmp 0x42549f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.0041fc89
pop ecx
test eax, eax
jne 0x4252c7
or dword [ebp - 0x250], 0xffffffff
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x250], 2
jne 0x425200
push 0x4c11f8
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x425200
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x238], eax
cmp eax, ebx
je 0x425200
push 0xf01ff
push 0x4c1210
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x248], esi
cmp esi, ebx
je 0x4251f4
lea eax, [ebp - 0x234]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4251e8
cmp dword [ebp - 0x230], 4
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
je 0x4251e4
lea eax, [ebp - 0x240]
push eax
push ebx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov dword [ebp - 0x240], ebx
call esi
test eax, eax
jne 0x4251e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4251e4
push dword [ebp - 0x240]
call fcn.00474aa6
pop ecx
mov ebx, eax
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 0x240]
mov dword [ebp - 0x244], ebx
push ebx
push dword [ebp - 0x248]
call esi
test eax, eax
je 0x4251d9
cmp dword [ebx + 4], 2
jne 0x4251d9
mov esi, 0xc8
push esi
xor ebx, ebx
call edi
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x248]
inc ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4251cb
cmp dword [ebp - 0x230], 4
je 0x4251d3
push esi
call edi
cmp ebx, 0xa
jle 0x4251aa
mov ebx, dword [ebp - 0x244]
test ebx, ebx
je 0x4251e4
push ebx
call fcn.00474a9b
pop ecx
push 0x64
call edi
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x278]
call fcn.0042d1df
mov dword [ebp - 4], 1
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x238], esp
push dword [ebp - 0x23c]
call fcn.00418464
mov byte [ebp - 4], 2
push ecx
mov eax, esp
mov dword [ebp - 0x244], esp
push eax
lea ecx, [ebp - 0x27c]
call fcn.0043302f
mov byte [ebp - 4], 3
mov byte [ebp - 4], 1
call fcn.0041e3a0
add esp, 0xc
test eax, eax
jne 0x4252b3
push dword [ebp - 0x23c]
lea ecx, [ebp - 0x23c]
call fcn.00418464
mov byte [ebp - 4], 4
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x27c]
call fcn.0043302f
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x23c]
push ecx
push eax
call fcn.0041cbf6
pop ecx
pop ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x238]
add ecx, 0xfffffff0
call fcn.00409a10
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x23c]
add ecx, 0xfffffff0
call fcn.00409a10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x278]
call fcn.0042d237
jmp 0x425080
call fcn.0041fced
call ebx
call fcn.0041f7a2
test eax, eax
je 0x425080
call ebx
xor esi, esi
cmp byte [0x4fae51], 0
je 0x425308
push esi
push esi
push esi
push 0x423e2c
push esi
push esi
mov byte [0x4fae52], 1
call fcn.00478972
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov ecx, esp
mov dword [ebp - 0x238], esp
push str._PCMaster_NoUseClassName
call fcn.00418464
mov dword [ebp - 4], 9
push ecx
mov ecx, esp
mov dword [ebp - 0x244], esp
push str._PCMaster_Tray
call fcn.00418464
mov byte [ebp - 4], 0xa
or dword [ebp - 4], 0xffffffff
call fcn.0041cd00
pop ecx
pop ecx
cmp eax, esi
jne 0x425382
push 1
call fcn.0041dfbc
pop ecx
test eax, eax
je 0x425390
push 0x40
push 0x4c12e8
push 0x4c12f0
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x425080
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
inc esi
cmp eax, 0x1770
jg 0x425080
cmp byte [0x4fae52], 0
jne 0x42536c
jmp 0x425080
call ebx
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DefWindowProcW]
call ebx
push 4
call fcn.0041b03e
pop ecx
call ebx
push esi
push dword [ebp + 8]
mov ecx, 0x4fb2dc
push esi
call fcn.00427ca5
cmp byte [0x4fae51], 0
je 0x425434
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x238], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea edi, [ebp - 0x218]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x4253ee
push 5
pop ecx
mov esi, 0x4c13cc
rep movsd dword es:[edi], dword [esi]
xor esi, esi
lea eax, [ebp - 0x218]
push eax
push 0
push 1
inc esi
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
jne 0x42542b
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x78
jle 0x425406
jmp 0x425432
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
call ebx
push esi
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x24c]
push eax
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x260], 1
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], esi
mov dword [ebp - 0x254], esi
call sub.gdiplus.dll_GdiplusStartup
call ebx
push dword [ebp + 0x14]
push dword [ebp - 0x23c]
call fcn.004237ce
pop ecx
pop ecx
mov esi, eax
call ebx
push dword [ebp - 0x24c]
call sub.gdiplus.dll_GdiplusShutdown
mov ecx, 0x4fb2dc
call fcn.0042eebc
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
call fcn.00473b52
ret 0x10