Function at 0x437be0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2ec4
mov eax, dword fs:[0]
push eax
sub esp, 0x358
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x348], ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34c], esi
cmp word [esi], 0
mov dword [ebp - 0x358], edi
mov dword [ebp - 0x360], eax
jne 0x437c3b
xor ecx, ecx
jmp 0x437c4f
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437c40
sub ecx, edx
sar ecx, 1
lea eax, [ebx + 4]
push ecx
push esi
mov ecx, eax
mov dword [ebp - 0x354], eax
call fcn.00402b90
cmp word [edi], 0
jne 0x437c6b
xor ecx, ecx
jmp 0x437c7f
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437c70
sub ecx, edx
sar ecx, 1
lea eax, [ebx + 0x1c]
push ecx
push edi
mov ecx, eax
mov dword [ebp - 0x364], eax
call fcn.00402b90
mov esi, dword [ebp - 0x360]
cmp word [esi], 0
jne 0x437ca1
xor ecx, ecx
jmp 0x437cb5
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437ca6
sub ecx, edx
sar ecx, 1
lea eax, [ebx + 0x34]
push ecx
push esi
mov ecx, eax
mov dword [ebp - 0x35c], eax
call fcn.00402b90
cmp dword [ebx + 0x5c], 0
jne 0x437cdc
push 0xd
push str.WnService.exe
lea ecx, [ebx + 0x4c]
call fcn.00402b90
call fcn.004538be
test al, al
je 0x437d00
xchg esi, eax
scasd eax, dword es:[edi]
push ebx
jge 0x437d5f
adc byte [ecx + ecx*8 + 0xb], bh
adc al, 0x46
cmp byte [ebx + 0x6cb85126], dh
in eax, dx
sbb al, 0x6a
pop esi
xor dh, byte [bp + si]
mov ah, 0xac
push es
call fcn.00453765
test al, al
je 0x437d27
push esp
xor eax, ebx
sbb eax, 0xe273d2dd
pop esi
pop edi
mov dh, 0x80
out 0x9b, al
std
push 0xffffffffffffffcc
shl dword [esi - 0x78], cl
retf
mov eax, dword [0x67d4e4]
test eax, eax
jne 0x437d65
push 0x15c
call fcn.0047045e
add esp, 4
mov dword [ebp - 0x350], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x437d57
mov ecx, eax
call fcn.00444f40
jmp 0x437d59
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x67d4e4], eax
jmp dword [ebx + 0x67d4e4]
mov ecx, eax
call fcn.00474b54
mov edx, eax
mov dword [ebp - 0x234], 7
xor eax, eax
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
cmp word [edx], ax
jne 0x437d94
xor ecx, ecx
jmp 0x437daf
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437da0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x248]
call fcn.00402b90
mov eax, dword [0x67d4e4]
mov dword [ebp - 4], 1
test eax, eax
jne 0x437dfb
push 0x15c
call fcn.0047045e
add esp, 4
mov dword [ebp - 0x350], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x437df0
mov ecx, eax
call fcn.00444f40
jmp 0x437df2
xor eax, eax
mov byte [ebp - 4], 1
mov dword [0x67d4e4], eax
mov ecx, eax
call fcn.00474b54
mov edx, eax
mov dword [ebp - 0x21c], 7
xor eax, eax
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp word [edx], ax
jne 0x437e2a
xor ecx, ecx
jmp 0x437e3f
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437e30
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x230]
call fcn.00402b90
push 0xd
push str.WnService.exe
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 3
call fcn.00405d30
mov eax, dword [ebp - 0x348]
lea ecx, [ebp - 0x248]
push 0xffffffffffffffff
push 0
add eax, 0x4c
push eax
call fcn.00405c20
call fcn.00453a17
test al, al
invalid
mov ebx, 0xc0840001
je 0x437e9b
shr dword [esi - 0x44], cl
fcmovnb st(0), st(3)
dec esi
dec ecx
inc eax
invalid
call fcn.004537aa
test al, al
je 0x437ebc
mov ebp, esi
das
bound ebx, qword [eax - 9]
jbe 0x437e7d
mov ah, 0xda
cli
daa
in al, dx
mov eax, dword [0xe289da6d]
jl 0x437eec
jb 0x437ec9
fsubp st(0)
jae 0x437e78
call fcn.00453834
add dword [eax], eax
test al, al
je 0x437edd
or al, 0xce
xor ch, byte [edi + eax*8 - 0x56]
in al, 0x49
pop ecx
test al, 0x25
jae 0x437e7d
invalid
pop dword [esi - 0x7e5f2e55]
adc bl, byte [eax - 0x7a745c22]
mov eax, 0x83fffffc
cmp byte [eax], al
mov eax, dword [ebp - 0x348]
cmp dword [eax], 0
jne 0x437f1f
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
call fcn.00466e50
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call fcn.00466e50
add esp, 8
invalid
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x437f64
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x6c
call fcn.00459c08
add esp, 8
xor esi, esi
jmp 0x438b12
call fcn.00453c3f
test al, al
je 0x437f7d
sbb eax, 0x1a67254e
ror dword [ecx + edi*4 + 0x19325885], 0x26
xor dword [eax - 0x383fcc13], esp
test dword [edi*8 + 0x7ffff], esp
add byte [eax], al
xor eax, eax
mov dword [ebp - 0x2dc], 7
push 0xffffffffffffffff
push eax
mov word [ebp - 0x2f0], ax
lea ecx, [ebp - 0x2f0]
lea eax, [ebp - 0x230]
mov dword [ebp - 0x2e0], 0
push eax
call fcn.00402a70
xor eax, eax
mov byte [ebp - 4], 4
push 0xffffffffffffffff
push eax
mov word [ebp - 0x2d8], ax
lea ecx, [ebp - 0x2d8]
lea eax, [ebp - 0x248]
mov dword [ebp - 0x2c4], 7
push eax
mov dword [ebp - 0x2c8], 0
call fcn.00402a70
lea eax, [ebp - 0x2f0]
mov byte [ebp - 4], 5
push eax
call fcn.0045dec0
lea eax, [ebp - 0x2d8]
push eax
call fcn.0045dec0
cmp dword [ebp - 0x2c4], 8
lea ecx, [ebp - 0x2d8]
push dword [ebp - 0x2c8]
cmovae ecx, dword [ebp - 0x2d8]
lea eax, [ebp - 0x2f0]
cmp dword [ebp - 0x2dc], 8
push ecx
cmovae eax, dword [ebp - 0x2f0]
push dword [ebp - 0x2e0]
push eax
call fcn.00403be0
add esp, 0x18
test eax, eax
je 0x438075
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x248]
lea eax, [ebp - 0x230]
cmovae ecx, dword [ebp - 0x248]
cmp dword [ebp - 0x21c], 8
push ecx
cmovae eax, dword [ebp - 0x230]
push eax
call fcn.00454bbd
add esp, 8
call fcn.00453b70
test al, al
je 0x438090
into
mov eax, 0xb2e08c22
sub ah, byte [esi - 0x7f7a49b3]
ret 0xe27f
xor eax, eax
mov dword [ebp - 0x24c], 7
mov dword [ebp - 0x250], 0
mov word [ebp - 0x260], ax
mov ebx, dword [ebp - 0x348]
mov byte [ebp - 4], 6
cmp dword [ebx], eax
je 0x43817b
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00483520
add esp, 0xc
lea ecx, [ebp - 0x32c]
call fcn.0046671d
lea ecx, [ebp - 0x32c]
mov byte [ebp - 4], 7
call fcn.004667e3
test eax, eax
lea eax, [ebp - 0x218]
push 0x104
push eax
je 0x438106
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x43810c
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp word [ebp - 0x218], 0
jne 0x43811a
xor ecx, ecx
jmp 0x438132
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x438123
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x260]
call fcn.00402b90
push 0x10
push str._svchost.exe__k
lea ecx, [ebp - 0x260]
call fcn.00405d30
push 0xffffffffffffffff
push 0
lea eax, [ebx + 0x7c]
push eax
lea ecx, [ebp - 0x260]
call fcn.00405c20
lea ecx, [ebp - 0x32c]
mov byte [ebp - 4], 6
call fcn.00466730
jmp 0x4381b5
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x260]
call fcn.00402a70
push 1
push 0x5eb8b0
lea ecx, [ebp - 0x260]
call fcn.00405d30
push 2
push 0x5ed578
lea ecx, [ebp - 0x260]
call fcn.00405d30
push 0x5e9978
push str.6f1ce
lea eax, [ebp - 0x290]
push 0x5e9c5c
push eax
call fcn.004686b4
push 0x5e9978
push str.d0417
lea eax, [ebp - 0x344]
mov byte [ebp - 4], 8
push 0x5e9c5c
push eax
call fcn.004686b4
add esp, 0x20
xor eax, eax
mov byte [ebp - 4], 9
push 0xffffffffffffffff
push eax
mov word [ebp - 0x2c0], ax
lea ecx, [ebp - 0x2c0]
lea eax, [ebp - 0x260]
mov dword [ebp - 0x2ac], 7
push eax
mov dword [ebp - 0x2b0], 0
call fcn.00402a70
xor eax, eax
mov byte [ebp - 4], 0xa
push 0xffffffffffffffff
push eax
mov word [ebp - 0x2a8], ax
lea ecx, [ebp - 0x2a8]
lea eax, [ebp - 0x344]
mov dword [ebp - 0x294], 7
push eax
mov dword [ebp - 0x298], 0
call fcn.00402a70
lea eax, [ebp - 0x2a8]
mov byte [ebp - 4], 0xb
push eax
call fcn.0045dec0
lea eax, [ebp - 0x2c0]
push eax
call fcn.0045dec0
add esp, 8
mov dword [ebp - 0x350], 0
call fcn.00453aa1
test al, al
je 0x4382ab
pop esp
or dword [edx], eax
cmp dword [esi], esi
popal
popal
pop ecx
xlatb
and al, 0xb9
or dword [ebx + ebp*4 - 0x48], edi
mov ecx, 0xb8ab7c09
loopne 0x438299
mov ah, 0x94
inc ecx
mov ch, byte [edi + 0x688c235d]
movsd dword es:[edi], dword [esi]
jl 0x438294
call fcn.00453903
test al, al
je 0x4382c9
push ebx
mov dh, 1
add byte [eax + eax*8 + 0x61d41574], al
aam 0x61
mov al, byte [0xb0448fe]
fisub word [bp + si]
add bh, byte [esi + 0x3517a82]
cmp byte [ebp + edi*2 - 0x71176dcf], bl
mov bh, 1
add byte [eax + eax*8 - 0x74eced8c], al
and byte [edx - 0x2496d6f8], dl
cmpsb byte [esi], byte es:[edi]
cmp al, 0xf8
salc
call fcn.00453a5c
test al, al
je 0x4382e4
adc ecx, dword [ebx + 0x29089220]
imul ebx, ebx, 0xd6f83ca6
int3
mov esi, dword [ebp - 0x294]
lea ecx, [ebp - 0x2a8]
push dword [ebp - 0x298]
mov edi, dword [ebp - 0x2a8]
lea eax, [ebp - 0x2c0]
cmp esi, 8
cmovae ecx, edi
cmp dword [ebp - 0x2ac], 8
push ecx
cmovae eax, dword [ebp - 0x2c0]
push dword [ebp - 0x2b0]
push eax
call fcn.00403be0
add esp, 0x10
test eax, eax
jne 0x438385
cmp esi, 8
lea ecx, [ebp - 0x2a8]
lea eax, [ebp - 0x290]
cmovae ecx, edi
cmp dword [ebp - 0x27c], 8
push ecx
cmovae eax, dword [ebp - 0x290]
mov ecx, ebx
push eax
call fcn.00438cf0
test eax, eax
je 0x438385
cmp dword [ebp - 0x27c], 8
lea eax, [ebp - 0x290]
mov ecx, ebx
cmovae eax, dword [ebp - 0x290]
push eax
call int.00438b90
xor ecx, ecx
mov edx, 1
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x350], ecx
call fcn.0045398d
test al, al
je 0x4383a2
arpl word [eax], bx
pop ds
jge 0x438412
test eax, 0xa25fe802
cmp dword [ebp - 0x5a], ebx
lds esp, [eax]
pop esp
jmp 0xb4476bb1
call fcn.004537aa
test al, al
je 0x4383c9
sar dword [ebx - 0x67d55a97], 0xb5
add ch, byte [esi]
sahf
xor al, 0xa
push ecx
wait
and ebp, dword [ebx + 0x6a19e27d]
sub al, 0xdd
dec eax
lodsb al, byte [esi]
mov edx, 0x9fd63daa
or ebp, eax
stosd dword es:[edi], eax
mov ah, 1
add byte [eax + eax*8 - 0x52cbe08c], al
call fcn.00453879
test al, al
je 0x4383f1
xor al, 0xad
scasb al, byte es:[edi]
aas
jl 0x438431
daa
in eax, dx
mov ebx, 0x8d7d76fe
inc esp
nop
pop eax
lodsb al, byte [esi]
invalid
cmp dword [ebp - 0x350], 0
je 0x43855a
push 0x5ed58c
lea ecx, [ebp - 0x308]
call fcn.00404170
mov ebx, dword [ebp - 0x348]
mov byte [ebp - 4], 0xc
cmp dword [ebx], 0
je 0x43842d
invalid
push str..dll
lea ecx, [ebp - 0x308]
call fcn.00404400
xor eax, eax
mov dword [ebp - 0x264], 7
push 0xffffffffffffffff
push eax
mov word [ebp - 0x278], ax
lea ecx, [ebp - 0x278]
lea eax, [ebp - 0x344]
mov dword [ebp - 0x268], 0
push eax
call fcn.00402a70
push dword [ebp - 0x2f8]
cmp dword [ebp - 0x2f4], 8
lea eax, [ebp - 0x308]
push 0xffffffffffffffff
cmovae eax, dword [ebp - 0x308]
lea ecx, [ebp - 0x278]
push eax
mov byte [ebp - 4], 0xd
call fcn.00439080
cmp eax, 0xffffffff
je 0x4384bd
pushfd
std
invalid
inc eax
lea ecx, [ebp - 0x278]
push eax
push 0
lea eax, [ebp - 0x320]
push eax
call fcn.004198f0
push eax
lea ecx, [ebp - 0x278]
call fcn.00404380
lea ecx, [ebp - 0x320]
call fcn.00412820
cmp dword [ebp - 0x264], 8
lea ecx, [ebp - 0x278]
lea eax, [ebp - 0x248]
cmovae ecx, dword [ebp - 0x278]
cmp dword [ebp - 0x234], 8
push ecx
cmovae eax, dword [ebp - 0x248]
push eax
call fcn.00454bbd
lea ecx, [ebx + 0xf4]
add esp, 8
lea eax, [ebp - 0x290]
cmp ecx, eax
je 0x438509
push 0xffffffffffffffff
push 0
push eax
call fcn.00402a70
cmp dword [ebp - 0x264], 8
lea ecx, [ebp - 0x278]
lea eax, [ebp - 0x290]
cmovae ecx, dword [ebp - 0x278]
cmp dword [ebp - 0x27c], 8
push ecx
cmovae eax, dword [ebp - 0x290]
push eax
push 0x6d
call fcn.00459c08
add esp, 0xc
lea ecx, [ebp - 0x278]
call fcn.00412820
lea ecx, [ebp - 0x308]
call fcn.00412820
xor esi, esi
jmp 0x438ac5
call fcn.0045360c
test al, al
je 0x438573
mov bh, 0x1d
retf 0x7939
sbb byte [esi], dh
inc ecx
das
je 0x4385d0
inc ebp
dec edx
wait
jno 0x4385a4
mov eax, dword [ebp - 0x354]
cmp dword [eax + 0x14], 8
jb 0x438581
mov eax, dword [eax]
mov ecx, dword [ebp - 0x348]
push eax
call int.00438ee0
mov ecx, dword [ebp - 0x348]
call fcn.00437330
call fcn.00453aa1
test al, al
je 0x4385be
sub ah, byte [eax]
mov edi, 0x26dc1824
ror dword [eax + 0x39], 1
enter 0xffffffffffffd7a9, 0xffffffffffffffcc
inc ecx
dec esp
fcompi st(7)
inc edi
stosb byte es:[edi], al
mov ecx, 0xb9e714
ja 0x438568
push ebp
call fcn.00453bb5
test al, al
je 0x4385e5
pop eax
cli
mov ss, word [ecx - 0x2d6f97b0]
sub esp, dword [ebx + 0x62]
sti
arpl word [edx - 5], sp
imul ebx, dword [eax], 0x6c4e2939
sub dword [edx - 0x68cce0b0], esp
inc edi
adc dword [0xfff0d2f0], ecx
mov ch, 0xb4
cld
invalid
push dword [ebp - 0x34c]
push str.6f1ce
push 0x5e9c5c
call fcn.004690b5
add esp, 0xc
call fcn.00453bfa
test al, al
je 0x438622
add byte [eax + eax*8 + 0x3cb11c74], al
mov cl, 0x3c
or ebx, dword [ecx - 0x455d523f]
stc
lea esi, [eax + 4]
or ecx, eax
dec di
push edi
fist dword [eax + 0x1e]
outsd dx, dword [esi]
lea ebp, [edi - 0x478de79c]
cmp dword [ebp - 0x24c], 8
lea eax, [ebp - 0x260]
cmovae eax, dword [ebp - 0x260]
push eax
push str.d0417
push 0x5e9c5c
call fcn.004690b5
add esp, 0xc
call fcn.00453bb5
test al, al
je 0x438663
jge 0x43867e
jecxz 0x43869d
mov eax, 0x7583e0fb
lds edi, [edi + 0xf]
jl 0x438601
cli
fist word [esi + 0x1b256e8]
add byte [eax + eax*8 - 0x59cde08c], al
aas
sbb byte [edi - 0x10], 0xd7
call fcn.004538be
test al, al
je 0x43868b
xor ah, byte [esi - 0xfa07dc1]
xlatb
cmpsb byte [esi], byte es:[edi]
pop eax
in al, 0xd1
mov al, byte [0xf142b940]
stc
and byte [edx + ecx*4], dh
xor al, 0x8a
xor dh, byte fs:[ecx]
adc ch, bl
pop edi
mov al, byte [0x48e62dfa]
call fcn.004536db
test al, al
je 0x4386aa
add esi, dword [0x4c8c3039]
adc byte [ecx], 0xd6
lcall 0x11e8, 0xdb5f4845
push es
invalid
call fcn.0041b790
mov ebx, dword [ebp - 0x348]
mov esi, eax
test esi, esi
je 0x4386ff
cmp dword [ebx + 0xf0], 8
lea ecx, [ebx + 0xdc]
jb 0x4386cc
mov ecx, dword [ecx]
cmp dword [ebp - 0x24c], 8
lea eax, [ebp - 0x260]
mov edx, dword [esi]
cmovae eax, dword [ebp - 0x260]
push ecx
push eax
mov eax, dword [ebp - 0x360]
mov ecx, esi
push eax
push dword [ebp - 0x358]
push dword [ebp - 0x34c]
call dword [edx + 0x118]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebx], 0
je 0x438784
lea ecx, [ebp - 0x328]
call fcn.00413c00
cmp dword [ebx + 0xd8], 8
lea ecx, [ebx + 0xc4]
mov byte [ebp - 4], 0xe
add byte [eax], al
add dh, al
inc ebp
cld
push cs
jb 0x43872f
mov ecx, dword [ecx]
cmp dword [ebx + 0x30], 8
lea esi, [ebx + 0x1c]
jb 0x43873a
mov esi, dword [esi]
cmp dword [ebx + 0x18], 8
lea edx, [ebx + 4]
jb 0x438745
mov edx, dword [edx]
add ebx, 0x7c
cmp dword [ebx + 0x14], 8
jb 0x438750
mov ebx, dword [ebx]
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push ecx
cmovae eax, dword [ebp - 0x248]
lea ecx, [ebp - 0x328]
push esi
push edx
push ebx
push eax
call fcn.00413f00
lea ecx, [ebp - 0x328]
call fcn.00413d10
jmp 0x438ac0
call fcn.00453cc9
test al, al
je 0x4387a0
rcr dword [ebp + 0x22], 1
test byte [ebp - 0x2cc17853], bh
jnp 0x438724
cdq
scasd eax, dword es:[edi]
stosd dword es:[edi], eax
xchg edx, eax
pop edx
mov edx, 0x9ae8b793
mov ah, 1
add byte [eax + eax*8 - 0x73cfe48c], al
mov bh, byte [edi + edx*8 - 0x6f]
and ecx, dword [ebp - 0x35]
sti
mov ah, 0xdb
mov eax, dword [esp + ebp]
mov cl, 0xb0
in al, 0x1f
retf 0xd491
call fcn.00453c3f
test al, al
je 0x4387c4
xor byte [edx + ecx*4 + 0x2391d77c], cl
dec ebp
retf
call fcn.00453bfa
test al, al
je 0x4387e6
dec edx
cmp eax, ebx
in al, dx
sbb ebp, ebx
adc dword [esi - 0x42f7ff9b], edx
imul dword [ecx + 0x7241283a]
pop es
cmp ch, byte [eax]
inc ecx
jb 0x4387e7
push edx
xchg edi, eax
or byte [ebp + 0x15], dh
inc ebx
push 0xf003f
push 0
aas
add byte [edi], cl
add byte [edx], ch
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x348], ebx
call fcn.00453696
test al, al
je 0x438820
xor edx, edi
popfd
lahf
jg 0x438847
sal byte [edx + edi*4 + 0x72], 0x92
int 0x8e
fnsave dword [ebx - 0x19]
pop eax
lodsd eax, dword [esi]
and cl, byte [ebx - 0x34763]
inc dword [ebp + 0x6a1175db]
outsb dx, byte [esi]
test ebx, ebx
jne 0x438835
push 0x6e
call fcn.00459c08
add esp, 4
xor esi, esi
jmp 0x438ac5
call fcn.00453b70
test al, al
je 0x438855
movsd dword es:[edi], dword [esi]
and esi, dword [ecx]
wait
invalid
mov word [eax], ds
lea eax, [edx + ecx*4]
inc edx
jge 0x4387db
popfd
mov eax, 0x83fffffc
mov ebp, 0xfffffdb4
or byte [ebp - 0x25f73], cl
dec dword [ebx - 0x3636b]
dec dword [edi]
inc ebx
lea esp, [eax - 0x7c000003]
jp 0x438886
cmp dword [ebp - 0x24c], 8
lea ecx, [ebp - 0x260]
mov edx, dword [ebp - 0x364]
cmovae ecx, dword [ebp - 0x260]
cmp dword [edx + 0x14], 8
jb 0x438877
or byte [edx + 2], dh
mov edx, dword [edx]
mov eax, dword [ebp - 0x354]
cmp dword [eax + 0x14], 8
jb 0x438885
mov eax, dword [eax]
push 0
push 0
add byte [edx], ch
push 0x5e9978
push 0
push 0
push ecx
push 1
push 2
push 0x110
push 0xf01ff
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
mov dword [ebp - 0x34c], edi
call fcn.00453ae6
test al, al
je 0x4388e4
aad 0xc6
lodsb al, byte [esi]
invalid
call fcn.004538be
test al, al
je 0x43890d
add ebp, edx
add byte [ebx - 0x69aaf8b8], ch
daa
mov cl, 0xa2
stosd dword es:[edi], eax
or byte [esi - 9], ch
stosb byte es:[edi], al
add eax, 0x8743d573
dec esi
sahf
dec ebx
ljmp 0x4b
test edi, edi
jne 0x43896d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x320]
push eax
call fcn.00439100
add esp, 8
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0xf
jb 0x438933
mov eax, dword [eax]
push eax
push str.LastError
push 0xad
call fcn.00459c08
add esp, 0xc
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x320]
call fcn.00412820
push 0x6f
call fcn.00459c08
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
jmp 0x438ac5
call fcn.00453c3f
test al, al
je 0x438992
pushfd
pop edi
invalid
mov eax, dword [ebp - 0x35c]
cmp dword [eax + 0x14], 8
jb 0x4389a0
mov eax, dword [eax]
mov dword [ebp - 0x358], eax
lea eax, [ebp - 0x358]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call ebx
push dword [ebp - 0x348]
call ebx
call fcn.00453aa1
test al, al
je 0x4389e0
rol byte [ebx - 0x52], 1
fmul st(3), st(0)
inc edx
ja 0x4389ed
cmpsd dword [esi], dword es:[edi]
jge 0x4389bc
getsec
pop ss
loope 0x438a44
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x35c], esi
test esi, esi
je 0x438a3b
pop esi
add byte [ebx - 0x5b4a7610], cl
cld
invalid
mov ecx, dword [ebp - 0x354]
push 0xf003f
call fcn.00439070
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x438a37
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x438a32
push 0x72
call fcn.00459c08
add esp, 4
push esi
call ebx
jmp 0x438a45
push 0x71
jmp 0x438a3d
push 0x70
call fcn.00459c08
add esp, 4
add al, 0xe8
imul esi, dword [ecx - 0x3f7bffff], 0x74
pop ds
call fcn.00453bb5
test al, al
je 0x438a6d
popfd
call 0xf2348199
sbb byte [ebp - 0x29], ah
out dx, al
fisub dword [ebx]
popfd
stc
cld
jns 0x438aad
cmpsb byte [esi], byte es:[edi]
mov ch, ch
xor bl, 0x88
adc byte [esi + 0x5f], ah
mov edi, 0xe89dc2ec
fild qword [ebx - 0x3f7bffff]
call fcn.00453651
test al, al
je 0x438a8f
adc al, 0xfe
jp 0x438aa4
mov word [edi + 0x1c], fs
xchg esi, eax
pop ebp
fimul word [eax]
invalid
call fcn.00453903
test al, al
je 0x438ab4
sbb bl, dl
sub dword [ebx], eax
add al, 0x3a
loopne 0x438a44
cmp ch, byte [esp + ebp*2 + 0x2daeb844]
int1
and bl, byte [edi]
inc esp
mov eax, 0x22f12dae
pop ds
adc dword [ebp + 0x36], 0xffffffbb
cwde
mov eax, 0xff5ccb93
mov ch, 0xa4
cld
invalid
mov ebx, 0xcb93b898
pop esp
push dword [ebp - 0x35c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, 1
lea ecx, [ebp - 0x2a8]
call fcn.00412820
lea ecx, [ebp - 0x2c0]
call fcn.00412820
lea ecx, [ebp - 0x344]
call fcn.00412820
lea ecx, [ebp - 0x290]
call fcn.00412820
lea ecx, [ebp - 0x260]
call fcn.00412820
lea ecx, [ebp - 0x2d8]
call fcn.00412820
lea ecx, [ebp - 0x2f0]
call fcn.00412820
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x438b30
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402ce0
mov ecx, dword [ebp - 0x234]
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp ecx, 8
jb 0x438b6b
inc ecx
push ecx
push dword [ebp - 0x248]
lea ecx, [ebp - 0x248]
call fcn.00402ce0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047070c
mov esp, ebp
pop ebp
ret 0xc