Function at 0x4204a0
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push 0xffffffffffffffff
push 0x460d08
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x476cd4]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
push 0xf003f
xor ebp, ebp
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x4c], ebp
cmp ebx, ebp
jne 0x4204fd
mov eax, 0x80004003
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
mov eax, dword [esp + 0x54]
push 0xf01ff
push eax
push ebx
mov byte [esp + 0x58], 1
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
mov dword [esp + 0x24], edi
cmp edi, ebp
jne 0x42053d
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 0x80004005
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
mov eax, dword [esp + 0x58]
xor esi, esi
mov dword [esp + 0x18], ebp
cmp eax, ebp
jne 0x420550
mov eax, 0x46c82c
push eax
lea ecx, [esp + 0x18]
call fcn.004098a0
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x4c], 2
cmp dword [ecx - 0xc], ebp
je 0x42058a
lea ecx, [esp + 0x14]
call fcn.004203b0
mov ecx, eax
call fcn.00420400
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov ecx, dword [esp + 0x18]
push esi
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
cmp esi, ebp
je 0x4205a2
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea edx, [esp + 0x28]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov esi, eax
cmp esi, ebp
je 0x42064b
mov eax, dword [esp + 0x3c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x1c], eax
call ebx
cmp dword [esp + 0x2c], 2
mov ebp, eax
jne 0x42063b
mov eax, 0xcccccccd
mul dword [esp + 0x40]
shr edx, 3
cmp edx, 0x3e8
jae 0x4205ec
mov edx, 0x3e8
jmp 0x4205f9
cmp edx, 0x2710
jbe 0x4205f9
mov edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x28]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov esi, eax
test esi, esi
je 0x42063b
mov edx, dword [esp + 0x1c]
cmp dword [esp + 0x3c], edx
jbe 0x42062a
call ebx
mov ebp, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
jmp 0x420634
call ebx
sub eax, ebp
cmp eax, dword [esp + 0x40]
ja 0x42063b
cmp dword [esp + 0x2c], 2
je 0x4205d1
cmp dword [esp + 0x2c], 4
mov ebx, dword [esp + 0x20]
jne 0x42064b
mov esi, 1
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
and esi, 0x7fffbffb
add eax, 0xfffffff0
add esi, 0x80004005
mov byte [esp + 0x4c], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420680
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push ebx
call edi
mov eax, esi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret