Function at 0x41b7f2
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x650
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x4d6b10
push 0x64
push dword [ebp + 8]
mov ebx, 0x503c38
mov ecx, ebx
mov dword [ebp + 0x10], eax
push 0x4f0098
call fcn.0041d07f
mov esi, 0x4f09bc
lea edi, [ebp - 0xc]
lea eax, [ebp - 0xc]
mov dword [0x504028], 1
movsw word es:[edi], word [esi]
push eax
push dword [ebp + 0x10]
movsb byte es:[edi], byte [esi]
call fcn.00419dc9
mov edi, eax
xor esi, esi
pop ecx
cmp edi, esi
pop ecx
je 0x41b897
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.UnregServer
push edi
call esi
test eax, eax
je 0x41b8c9
push str.RegServer
push edi
call esi
test eax, eax
je 0x41b8d5
push str.Service
push edi
call esi
test eax, eax
je 0x41b8d9
push str.Close
push edi
call esi
test eax, eax
je 0x41b8e9
lea eax, [ebp - 0xc]
push eax
push edi
call fcn.00419dc9
mov edi, eax
pop ecx
test edi, edi
pop ecx
jne 0x41b853
xor esi, esi
mov edi, 0x20019
lea ecx, [ebp - 8]
push edi
push str.AppID
push SysReAllocStringLen
mov dword [ebp - 8], esi
call fcn.004198cc
cmp eax, esi
mov dword [ebp + 0x10], eax
je 0x41b8f5
cmp dword [ebp - 8], esi
je 0x41b92d
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41b92d
mov ecx, ebx
call fcn.0041ce3b
jmp 0x41bae8
push 0
jmp 0x41b8db
push 1
push 1
mov ecx, ebx
call fcn.0041bc47
jmp 0x41bae8
mov ecx, ebx
call fcn.0041cfb2
jmp 0x41bae8
push edi
push str.568F3382_A756_11D3_9B07_0090275F67ED
push dword [ebp - 8]
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.004198cc
cmp eax, esi
mov dword [ebp + 0x10], eax
je 0x41b935
cmp dword [ebp - 4], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x41b923
push dword [ebp - 4]
call edi
mov dword [ebp - 4], esi
cmp dword [ebp - 8], esi
je 0x41b92d
push dword [ebp - 8]
call edi
mov eax, dword [ebp + 0x10]
jmp 0x41bae8
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x104
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp + 0x10]
push eax
push esi
push str.LocalService
mov dword [ebp + 0x10], esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, esi
mov dword [0x504028], esi
jne 0x41b971
mov dword [0x504028], 1
mov ecx, ebx
call fcn.0041baef
push dword [0x504028]
mov esi, 0x503ff0
mov ecx, esi
push dword [0x503fc4]
push 0x503ebc
push 0x4efe40
call fcn.00423240
mov edi, dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x1c]
push eax
call edi
movzx eax, word [ebp - 0x10]
push eax
movzx eax, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x14]
push eax
movzx eax, word [ebp - 0x16]
push eax
movzx eax, word [ebp - 0x1a]
push eax
movzx eax, word [ebp - 0x1c]
push eax
lea eax, [ebp - 0x13c]
push str.NMS_Service_starts_at__d._d._d__d:_d:_d
push eax
call fcn.004bfb90
add esp, 0x20
lea eax, [ebp - 0x13c]
push eax
push esi
call fcn.00423150
mov eax, dword [ebp + 8]
pop ecx
pop ecx
mov dword [0x5040a4], 1
mov dword [0x5041d4], eax
call fcn.00416f6b
test eax, eax
jl 0x41ba10
mov ecx, ebx
call fcn.0041d9b2
call fcn.00416f79
jmp 0x41ba7a
mov al, byte [ebp + 0x13]
push 0
lea ecx, [ebp - 0x38]
mov byte [ebp - 0x38], al
call fcn.00406ad6
and dword [ebp - 0x28], 0
and dword [ebp - 0x24], 0
push 0x2164
lea ecx, [ebp - 0x38]
call fcn.0041a16a
test eax, eax
jne 0x41ba5d
push str.NMSSvc.cpp
push 0x543
push str.sEventMessage.LoadString_IDS_SERVICE_START_FAILED_
lea eax, [ebp - 0x650]
push str.__s____d__in___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x41ba69
mov eax, 0x4d68e8
push eax
push ebx
call fcn.0041aa75
pop ecx
pop ecx
lea ecx, [ebp - 0x38]
call fcn.00405d6e
lea eax, [ebp - 0x1c]
push eax
call edi
movzx eax, word [ebp - 0x10]
push eax
movzx eax, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x14]
push eax
movzx eax, word [ebp - 0x16]
push eax
movzx eax, word [ebp - 0x1a]
push eax
movzx eax, word [ebp - 0x1c]
push eax
lea eax, [ebp - 0x13c]
push str.NMS_Service_stops_at__d._d._d__d:_d:_d
push eax
call fcn.004bfb90
add esp, 0x20
lea eax, [ebp - 0x13c]
push eax
push esi
call fcn.00423150
mov edi, dword [0x503fd8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
pop ecx
cmp dword [ebp - 4], ebx
pop ecx
je 0x41badc
push dword [ebp - 4]
call esi
mov dword [ebp - 4], ebx
cmp dword [ebp - 8], ebx
je 0x41bae6
push dword [ebp - 8]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10