Function at 0x40e3f0
Capabilities:
Create service
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b0
mov eax, dword [0x49b138]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x10
call fcn.0042ff9e
add esp, 4
test eax, eax
je 0x40e420
push 0
mov ecx, eax
call fcn.0040161a
mov esi, eax
jmp 0x40e422
xor esi, esi
push 0
push str.service
push str.uniquename
mov ecx, esi
call fcn.00401870
push eax
call fcn.004527ab
add esp, 4
mov ebx, eax
mov ecx, esi
mov dword [ebp - 0x19c], ebx
push 0
push str.service
push str.auth1
call fcn.00401870
push eax
call fcn.004527ab
add esp, 4
mov dword [ebp - 0x198], eax
test esi, esi
je 0x40e47e
mov ecx, esi
call fcn.004016d4
push 0x10
push esi
call fcn.0042ffce
add esp, 8
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40e483
sub ecx, edx
sar ecx, 1
jne 0x40e4d5
push ebx
call fcn.0043eff1
mov esi, dword [ebp - 0x198]
push esi
call fcn.0043eff1
push str.Service_is_not_registered._Exiting.
push 0x4a0d68
call fcn.00402c50
push eax
call fcn.00403580
add esp, 0x14
mov eax, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430365
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp + 0x10]
mov ecx, 0x484664
mov eax, esi
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40e500
test dl, dl
je 0x40e4fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40e500
add eax, 2
add ecx, 2
test dl, dl
jne 0x40e4e0
xor eax, eax
jmp 0x40e505
sbb eax, eax
or eax, 1
test eax, eax
je 0x40e948
mov ecx, str.rundebug
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40e534
test dl, dl
je 0x40e530
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40e534
add eax, 2
add ecx, 2
test dl, dl
jne 0x40e514
xor eax, eax
jmp 0x40e539
sbb eax, eax
or eax, 1
test eax, eax
je 0x40e948
mov ecx, str.create
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40e568
test dl, dl
je 0x40e564
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40e568
add eax, 2
add ecx, 2
test dl, dl
jne 0x40e548
xor eax, eax
jmp 0x40e56d
sbb eax, eax
or eax, 1
push edi
test eax, eax
je 0x40e833
mov ecx, 0x484698
mov eax, esi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40e5a0
test dl, dl
je 0x40e59c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40e5a0
add eax, 2
add ecx, 2
test dl, dl
jne 0x40e580
xor eax, eax
jmp 0x40e5a5
sbb eax, eax
or eax, 1
test eax, eax
je 0x40e833
mov ecx, str.delete
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40e5d4
test dl, dl
je 0x40e5d0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40e5d4
add eax, 2
add ecx, 2
test dl, dl
jne 0x40e5b4
xor eax, eax
jmp 0x40e5d9
sbb eax, eax
or eax, 1
test eax, eax
je 0x40e75d
mov ecx, 0x48478c
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40e608
test dl, dl
je 0x40e604
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40e608
add eax, 2
add ecx, 2
test dl, dl
jne 0x40e5e8
xor eax, eax
jmp 0x40e60d
sbb eax, eax
or eax, 1
test eax, eax
je 0x40e75d
mov ecx, str.start
mov eax, esi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40e640
test dl, dl
je 0x40e63c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40e640
add eax, 2
add ecx, 2
test dl, dl
jne 0x40e620
xor eax, eax
jmp 0x40e645
sbb eax, eax
or eax, 1
test eax, eax
je 0x40e93d
mov eax, str.stop
mov cl, byte [esi]
cmp cl, byte [eax]
jne 0x40e672
test cl, cl
je 0x40e66e
mov cl, byte [esi + 1]
cmp cl, byte [eax + 1]
jne 0x40e672
add esi, 2
add eax, 2
test cl, cl
jne 0x40e652
xor eax, eax
jmp 0x40e677
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40e6b3
push ebx
call fcn.0040d770
add esp, 4
mov esi, dword [ebp - 0x198]
pop edi
push esi
call fcn.0043eff1
push dword [ebp - 0x19c]
call fcn.0043eff1
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
xor eax, eax
pop esi
pop ebx
call fcn.00430365
mov esp, ebp
pop ebp
ret 0x10
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x4a0b8c], eax
cmp eax, 0xffffffff
je 0x40e684
xorps xmm0, xmm0
mov dword [0x4a0b90], 0x30
lea eax, [ebp - 0x1ac]
movlpd qword [0x4a0b9c], xmm0
push eax
movlpd qword [0x4a0ba4], xmm0
mov dword [0x4a0b94], 2
mov dword [0x4a0b98], 1
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x1a8], 0x40d9c0
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x1a0], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x40e684
push str.This_service_file_is_not_intended_to_be_started_directly.
push 0x4a0d68
call fcn.00402c50
push eax
call fcn.00403580
add esp, 0xc
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40e684
mov eax, 0x48478c
mov cl, byte [esi]
cmp cl, byte [eax]
jne 0x40e782
test cl, cl
je 0x40e77e
mov cl, byte [esi + 1]
cmp cl, byte [eax + 1]
jne 0x40e782
add esi, 2
add eax, 2
test cl, cl
jne 0x40e762
xor eax, eax
jmp 0x40e787
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40e794
push ebx
call fcn.0040d770
add esp, 4
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x40e816
push 0xf01ff
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x40e7f6
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
mov eax, str.__success___delete_service
jne 0x40e7d7
mov eax, str.__error___cant_delete_service
push eax
push 0x4a0d68
call fcn.004075f0
push eax
call fcn.00403580
add esp, 0xc
push edi
call ebx
push esi
call ebx
jmp 0x40e684
push str.__error___cant_open_service
push 0x4a0d68
call fcn.004075f0
push eax
call fcn.00403580
add esp, 0xc
push esi
call ebx
jmp 0x40e684
push str.__error___cant_open_service_control_manager
push 0x4a0d68
call fcn.004075f0
push eax
call fcn.00403580
add esp, 0xc
jmp 0x40e684
push 0xc8
lea eax, [ebp - 0x194]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x40e8ef
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x194]
push eax
push 1
push 3
push pe_nt_image_headers32
push 0xf01ff
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x40e8bb
push eax
call ebx
push str.__success___install_service
push 0x4a0d68
call fcn.004075f0
add esp, 8
push eax
call fcn.00403580
add esp, 4
push edi
call ebx
mov ebx, dword [ebp - 0x19c]
jmp 0x40e907
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.__error___cant_create_service__error
push 0x4a0d68
call fcn.004075f0
add esp, 8
mov ecx, eax
call fcn.00404670
push eax
call fcn.00403580
add esp, 4
push edi
call ebx
mov ebx, dword [ebp - 0x19c]
jmp 0x40e907
push str.__error___cant_open_service_control_manager
push 0x4a0d68
call fcn.004075f0
push eax
call fcn.00403580
add esp, 0xc
mov eax, 0x484698
nop dword [eax]
mov cl, byte [esi]
cmp cl, byte [eax]
jne 0x40e930
test cl, cl
je 0x40e92c
mov cl, byte [esi + 1]
cmp cl, byte [eax + 1]
jne 0x40e930
add esi, 2
add eax, 2
test cl, cl
jne 0x40e910
xor eax, eax
jmp 0x40e935
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40e684
push ebx
call fcn.0040d8a0
jmp 0x40e681
push ebx
push str._in_proxy_mode
push str.1.0.8
push str.Miray_SSP
push 0x4a0d68
mov dword [0x4a0b94], 1
call fcn.00402c50
add esp, 8
push eax
call fcn.004075f0
add esp, 8
push eax
call fcn.00402c50
add esp, 8
push eax
call fcn.004075f0
push eax
call fcn.00403580
add esp, 0xc
mov eax, str.rundebug
mov cl, byte [esi]
cmp cl, byte [eax]
jne 0x40e9b5
test cl, cl
je 0x40e9b1
mov cl, byte [esi + 1]
cmp cl, byte [eax + 1]
jne 0x40e9b5
add esi, 2
add eax, 2
test cl, cl
jne 0x40e995
xor eax, eax
jmp 0x40e9ba
sbb eax, eax
or eax, 1
mov esi, dword [ebp - 0x198]
test eax, eax
sete al
movzx eax, al
push eax
push esi
push ebx
call fcn.0040e200
add esp, 0xc
jmp 0x40e68b