Function at 0x401a70
Capabilities:
Get common file path
Link many functions at runtime
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
mov eax, dword [0x406024]
push ebx
mov ebx, dword [ebp + 8]
xor eax, ebp
push esi
xor ecx, ecx
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0x424], eax
mov eax, dword [ebp + 0xc]
dec ebx
cmp ebx, ecx
mov dword [esp + 0xc], ecx
lea edx, [eax + 4]
je 0x401c11
lea esp, [esp]
mov eax, dword [edx]
cmp byte [eax], 0x2d
jne case.0x401aca.99
movsx ecx, byte [eax + 1]
add ecx, 0xffffff9e
cmp ecx, 0x13
ja case.0x401aca.99
movzx ecx, byte [ecx + 0x401c88]
jmp dword [ecx*4 + 0x401c6c]
mov esi, fcn.00401090
jmp case.0x401aca.99
mov cl, byte [eax + 2]
add eax, 2
test cl, cl
jne 0x401aeb
mov edi, dword [edx + 4]
dec ebx
add edx, 4
jmp case.0x401aca.99
mov edi, eax
jmp case.0x401aca.99
mov esi, fcn.004011c0
jmp case.0x401aca.99
mov esi, fcn.004012d0
jmp case.0x401aca.99
mov esi, 0x401490
jmp case.0x401aca.99
mov dword [esp + 0xc], 1
add edx, 4
dec ebx
jne 0x401ab0
xor ecx, ecx
cmp esi, ecx
je 0x401bb1
mov edx, dword [str.PIPIStartSvr]
push edx
call esi
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x401b35
push eax
call dword [sym.imp.MSVCR71.dll_exit]
cmp esi, fcn.004012d0
jne 0x401b66
mov eax, dword [str.PIPIStartSvr]
push 2
push eax
call fcn.00401600
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x401baa
mov ecx, dword [str.PIPIStartSvr]
push ecx
call fcn.004012d0
add esp, 4
mov ebx, eax
jmp 0x401baa
mov edx, fcn.00401090
test edx, edx
je 0x401baa
mov eax, dword [str.PIPIStartSvr]
push eax
call fcn.004011c0
mov ecx, dword [str.PIPIStartSvr]
push ecx
call fcn.00401090
mov eax, dword [str.PIPIStartSvr]
mov ecx, 0x27
mov esi, 0x404448
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x28]
push edx
push eax
movsb byte es:[edi], byte [esi]
call fcn.00401760
add esp, 0x10
push ebx
call dword [sym.imp.MSVCR71.dll_exit]
cmp edi, ecx
je 0x401c0b
mov esi, dword [sym.imp.MSVCR71.dll__stricmp]
push str.demand
push edi
call esi
add esp, 8
test eax, eax
jne 0x401bd1
mov eax, 2
jmp 0x401be6
push str.disable
push edi
call esi
add esp, 8
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 4
mov ecx, dword [str.PIPIStartSvr]
push eax
push ecx
call fcn.00401600
mov ecx, dword [esp + 0x42c]
add esp, 8
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402d2b
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0xc], ecx
jne 0x401c5e
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], 0x404435
mov dword [esp + 0x18], 0x4019d0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
je 0x401c40
push 0
call dword [sym.imp.MSVCR71.dll_exit]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x78
je 0x401c5e
call esi
cmp eax, 0x427
je 0x401c5e
push 1
call dword [sym.imp.MSVCR71.dll_exit]
call fcn.004017e0
push 0
call dword [sym.imp.MSVCR71.dll_exit]
nop
fcomp dword [edx]
inc eax
add byte [ebx + ebx], al
inc eax
add ch, bh
sbb al, byte [eax]
rcr dword [edx], 1
inc eax
add dh, dh
sbb al, byte [eax]
out dx, eax
sbb al, byte [eax]
or al, 0x1b
inc eax
add byte [eax], al
push es
add dword [edx], eax
add dword [esi], eax
push es
add eax, dword [esi]
push es
push es
push es
push es
push es
push es
push es
push es
add al, 6
add eax, -858993460