Function at 0x449bb2
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x492250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
push 1
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x6c], ebx
call fcn.0044a243
xor esi, esi
test al, al
je 0x449c25
push esi
call fcn.00413e90
pop ecx
test al, al
je 0x449c0e
push esi
push 0x58
push str.d:webapps_b_build_slave_repo_build_srcwow_tools_servicewow_nt_service.cc
lea ecx, [ebp - 0x150]
inc ebx
call fcn.00413f50
add eax, 8
push str.Service_already_installed.
push eax
call fcn.0040b370
pop ecx
pop ecx
test bl, 1
je 0x449c1e
lea ecx, [ebp - 0x150]
call fcn.00414010
mov al, 1
jmp 0x44a230
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], esi
push 0xf003f
push eax
call fcn.0044a4ae
pop ecx
pop ecx
test eax, eax
js 0x44a1dc
cmp dword [ebp - 0x78], ebx
je 0x44a1dc
lea eax, [edi + 4]
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x7c], eax
jb 0x449c57
mov eax, dword [eax]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x70], ecx
mov dword [ecx], eax
test eax, eax
jne 0x449c68
mov eax, esi
jmp 0x449c72
push eax
call fcn.004054f0
pop ecx
mov ecx, dword [ebp - 0x70]
mov dword [ecx + 4], eax
lea ecx, [ebp - 0x34]
call fcn.0040cbe0
push eax
lea ecx, [ebp - 0xa0]
call fcn.00406a10
lea ecx, [ebp - 0x34]
call fcn.004085c0
xor eax, eax
lea ecx, [ebp - 0xa0]
push eax
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004079b0
cmp dword [ebp - 8], 8
lea esi, [ebp - 0x1c]
lea ecx, [edi + 0x34]
cmovae esi, dword [ebp - 0x1c]
cmp dword [ecx + 0x14], 8
jb 0x449cbc
mov ecx, dword [ecx]
cmp dword [edi + 0x30], 8
jb 0x449cc7
mov edx, dword [edi + 0x1c]
jmp 0x449cca
lea edx, [edi + 0x1c]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push esi
push 1
push 2
pop edi
push edi
push 0x10
push 0xf01ff
push ecx
push edx
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
push eax
lea ecx, [ebp - 0x74]
call fcn.0044a723
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.004099c0
mov esi, dword [ebp - 0x74]
test esi, esi
jne 0x449faf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x449d56
push edi
call fcn.00413e90
pop ecx
test al, al
je 0x449d4e
push 4
pop ebx
call sub.KERNEL32.dll_GetLastError
push eax
push edi
push 0x72
push str.d:webapps_b_build_slave_repo_build_srcwow_tools_servicewow_nt_service.cc
lea ecx, [ebp - 0x158]
call fcn.00414780
add eax, 0x10
push str.Unable_to_create_service.
push eax
call fcn.0040b370
pop ecx
pop ecx
test bl, 4
jmp 0x44a1cd
lea eax, [ebp - 0x74]
push eax
mov eax, dword [ebp - 0x80]
push 0xf01ff
add eax, 0x1c
push 0xf003f
push eax
call fcn.0044a55c
add esp, 0x10
test eax, eax
js 0x44a193
mov esi, dword [ebp - 0x74]
test esi, esi
je 0x44a193
xor eax, eax
lea ecx, [ebp - 0x70]
push ecx
push eax
push eax
push esi
mov dword [ebp - 0x70], eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x449faf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x449faf
push dword [ebp - 0x70]
call fcn.0045a324
pop ecx
mov edi, eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x70]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x449fa1
push dword [edi + 0xc]
lea ecx, [ebp - 0x1c]
call fcn.004086a0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.00449b22
mov ecx, esp
push eax
call fcn.004084d0
lea ecx, [ebp - 0x34]
call fcn.0040cbe0
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.004099c0
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.004099c0
push ecx
push ecx
mov ecx, esp
push dword [ebp - 0x7c]
call fcn.004084d0
lea ecx, [ebp - 0x4c]
call fcn.0040cbe0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040ccd0
test al, al
jne 0x449e3e
mov eax, dword [edi + 0xc]
cmp word [eax], 0x22
je 0x449e6c
push 0x30
pop ebx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x6c], ebx
push eax
lea ecx, [ebp - 0x4c]
call fcn.0040d600
push eax
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040d600
mov ecx, eax
call fcn.0040cc80
mov byte [ebp - 0x65], 1
test al, al
jne 0x449e70
mov byte [ebp - 0x65], 0
test bl, 0x20
je 0x449e83
and ebx, 0xffffffdf
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x6c], ebx
call fcn.004085c0
test bl, 0x10
je 0x449e96
and ebx, 0xffffffef
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x6c], ebx
call fcn.004085c0
cmp byte [ebp - 0x65], 0
je 0x44a12f
xor ebx, ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
lea ecx, [ebp - 0xa0]
call fcn.004079b0
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push ebx
cmovae eax, dword [ebp - 0x1c]
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push 1
push 2
push 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ebx, eax
lea ecx, [ebp - 0x1c]
push 0
neg ebx
push 1
sbb bl, bl
call fcn.004099c0
add bl, 1
je 0x449f40
push 2
call fcn.00413e90
mov ebx, dword [ebp - 0x6c]
pop ecx
test al, al
je 0x449f27
or ebx, 0x40
call sub.KERNEL32.dll_GetLastError
push eax
push 2
push 0x8f
push str.d:webapps_b_build_slave_repo_build_srcwow_tools_servicewow_nt_service.cc
lea ecx, [ebp - 0x158]
call fcn.00414780
add eax, 0x10
push str.Unable_to_change_existing_services_bin_path.
push eax
call fcn.0040b370
pop ecx
pop ecx
test bl, 0x40
je 0x44a178
lea ecx, [ebp - 0x158]
call fcn.004147b0
jmp 0x44a178
push 0
call fcn.00413e90
mov ebx, dword [ebp - 0x6c]
pop ecx
test al, al
je 0x449f7c
push 0
push 0x93
push str.d:webapps_b_build_slave_repo_build_srcwow_tools_servicewow_nt_service.cc
lea ecx, [ebp - 0x150]
or ebx, 0x80
call fcn.00413f50
add eax, 8
push str.Overwrite_binary_path_of_existing_service.
push eax
call fcn.0040b370
pop ecx
pop ecx
test bl, bl
jns 0x449f91
lea ecx, [ebp - 0x150]
and ebx, 0xffffff7f
call fcn.00414010
lea ecx, [ebp - 0x4c]
call fcn.004085c0
lea ecx, [ebp - 0x34]
call fcn.004085c0
test edi, edi
je 0x449fac
push edi
call fcn.0045a32d
pop ecx
push 2
pop edi
mov eax, dword [ebp - 0x80]
cmp dword [eax + 0x5c], 0
je 0x44a02d
add eax, 0x4c
cmp dword [eax + 0x14], 8
jb 0x449fc3
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x7c]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x44a02d
push edi
call fcn.00413e90
pop ecx
test al, al
je 0x44a014
or ebx, 0x200
call sub.KERNEL32.dll_GetLastError
push eax
push edi
push 0xa4
push str.d:webapps_b_build_slave_repo_build_srcwow_tools_servicewow_nt_service.cc
lea ecx, [ebp - 0x158]
call fcn.00414780
add eax, 0x10
push str.ChangeServiceConfig2_failed.
push eax
call fcn.0040b370
pop ecx
pop ecx
test ebx, 0x200
je 0x44a02d
lea ecx, [ebp - 0x158]
and ebx, 0xfffffdff
call fcn.004147b0
cmp byte [ebp + 8], 0
je 0x44a0cc
push 3
xor eax, eax
pop ecx
mov dword [ebp + eax*8 - 0x30], 0xea60
mov dword [ebp + eax*8 - 0x34], 1
inc eax
cmp eax, ecx
jb 0x44a03c
and dword [ebp - 0x18], 0
mov eax, 0x48b560
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push edi
push esi
mov dword [ebp - 0xc], ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x44a0cc
push edi
call fcn.00413e90
mov esi, 0x400
pop ecx
test al, al
je 0x44a0b7
or ebx, esi
call sub.KERNEL32.dll_GetLastError
push eax
push edi
push 0xbb
push str.d:webapps_b_build_slave_repo_build_srcwow_tools_servicewow_nt_service.cc
lea ecx, [ebp - 0x158]
call fcn.00414780
add eax, 0x10
push str.ChangeServiceConfig2_failed.
push eax
call fcn.0040b370
pop ecx
pop ecx
test esi, ebx
je 0x44a0cc
lea ecx, [ebp - 0x158]
and ebx, 0xfffffbff
call fcn.004147b0
push 0
call fcn.00413e90
mov esi, 0x800
pop ecx
test al, al
je 0x44a106
push 0
push 0xbf
push str.d:webapps_b_build_slave_repo_build_srcwow_tools_servicewow_nt_service.cc
lea ecx, [ebp - 0x150]
or ebx, esi
call fcn.00413f50
add eax, 8
push str.Service_installed.
push eax
call fcn.0040b370
pop ecx
pop ecx
test esi, ebx
je 0x44a115
lea ecx, [ebp - 0x150]
call fcn.00414010
mov bl, 1
lea ecx, [ebp - 0x74]
call fcn.00449b08
lea ecx, [ebp - 0xa0]
call fcn.00406b20
jmp 0x44a226
push 2
call fcn.00413e90
mov esi, 0x100
pop ecx
test al, al
je 0x44a169
push 2
push 0x95
push str.d:webapps_b_build_slave_repo_build_srcwow_tools_servicewow_nt_service.cc
lea ecx, [ebp - 0x150]
or ebx, esi
call fcn.00413f50
add eax, 8
push str.Unable_to_create_service._There_may_be_an_existing_service_with_same_service_name.
push eax
call fcn.0040b370
pop ecx
pop ecx
test esi, ebx
je 0x44a178
lea ecx, [ebp - 0x150]
call fcn.00414010
lea ecx, [ebp - 0x4c]
call fcn.004085c0
lea ecx, [ebp - 0x34]
call fcn.004085c0
push edi
call fcn.0045a32d
pop ecx
xor ebx, ebx
jmp 0x44a117
push edi
call fcn.00413e90
pop ecx
test al, al
je 0x44a1ca
push 8
pop ebx
call sub.KERNEL32.dll_GetLastError
push eax
push edi
push 0x79
push str.d:webapps_b_build_slave_repo_build_srcwow_tools_servicewow_nt_service.cc
lea ecx, [ebp - 0x158]
call fcn.00414780
add eax, 0x10
push str.Unable_to_open_existing_service.
push eax
call fcn.0040b370
pop ecx
pop ecx
test bl, 8
je 0x44a18f
lea ecx, [ebp - 0x158]
call fcn.004147b0
jmp 0x44a18f
push 2
call fcn.00413e90
pop ecx
test al, al
je 0x44a214
push 2
pop ebx
call sub.KERNEL32.dll_GetLastError
push eax
push ebx
push 0x5f
push str.d:webapps_b_build_slave_repo_build_srcwow_tools_servicewow_nt_service.cc
lea ecx, [ebp - 0x158]
call fcn.00414780
add eax, 0x10
push str.Unable_to_open_service_manager.
push eax
call fcn.0040b370
pop ecx
pop ecx
test bl, 2
je 0x44a224
lea ecx, [ebp - 0x158]
call fcn.004147b0
xor ebx, ebx
lea ecx, [ebp - 0x78]
call fcn.00449b08
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045a313
mov esp, ebp
pop ebp
ret 4