Function at 0x44ed48
Capabilities:
Create service
Get common file path
Get disk information
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x10], edx
mov edi, eax
xor eax, eax
push ebp
push 0x44f142
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
cmp dword [0x455af8], 0
je 0x44f11c
lea ebx, [ebp - 0x11d]
mov dword [ebx], 0x620064
add ebx, 4
mov dword [ebx], 0x63006c
add ebx, 4
mov dword [ebx], 0x6b
add ebx, 4
push 0x104
push ebx
call sub.kernel32.dll_GetSystemDirectoryW
add eax, eax
add ebx, eax
mov dword [ebx], 0x44005c
add ebx, 4
mov dword [ebx], 0x490052
add ebx, 4
mov dword [ebx], 0x450056
add ebx, 4
mov dword [ebx], 0x530052
add ebx, 4
mov dword [ebx], 0x64005c
add ebx, 4
mov dword [ebx], 0x6c0062
add ebx, 4
mov dword [ebx], 0x6b0063
add ebx, 4
mov dword [ebx], 0x73002e
add ebx, 4
mov dword [ebx], 0x730079
add ebx, 4
xor eax, eax
mov dword [ebx], eax
mov eax, dword [0x455af8]
push eax
push 0xa
mov ecx, dword [0x4554dc]
mov dl, 1
mov eax, dword [0x40ee88]
call fcn.00411f10
mov ebx, eax
push 0xffff
lea eax, [ebp - 0x140]
lea edx, [ebp - 0x111]
call fcn.00403cd8
mov ecx, dword [ebp - 0x140]
mov dl, 1
mov eax, dword [0x40ed40]
call fcn.00411c60
mov esi, eax
xor ecx, ecx
mov edx, ebx
mov eax, esi
call fcn.00411b00
mov eax, esi
call fcn.00402de4
mov eax, ebx
call fcn.00402de4
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x111]
push eax
push 0
push 1
push 1
push 0xf01ff
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceW
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x44f115
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
jne 0x44ef0e
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x431
jne 0x44ef0e
push 0xf01ff
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x13c]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ControlService
cmp dword [ebp - 0xc], 0
je 0x44f0f1
mov dl, 1
mov eax, dword [0x44ca24]
call fcn.0044cb24
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x44f0cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0x18]
call fcn.0044cbc4
lea ebx, [ebp - 0x11d]
mov dword [ebx], 0x590053
add ebx, 4
mov dword [ebx], 0x540053
add ebx, 4
mov dword [ebx], 0x4d0045
add ebx, 4
mov dword [ebx], 0x43005c
add ebx, 4
mov dword [ebx], 0x720075
add ebx, 4
mov dword [ebx], 0x650072
add ebx, 4
mov dword [ebx], 0x74006e
add ebx, 4
mov dword [ebx], 0x6f0043
add ebx, 4
mov dword [ebx], 0x74006e
add ebx, 4
mov dword [ebx], 0x6f0072
add ebx, 4
mov dword [ebx], 0x53006c
add ebx, 4
mov dword [ebx], 0x740065
add ebx, 4
mov dword [ebx], 0x53005c
add ebx, 4
mov dword [ebx], 0x720065
add ebx, 4
mov dword [ebx], 0x690076
add ebx, 4
mov dword [ebx], 0x650063
add ebx, 4
mov dword [ebx], 0x5c0073
add ebx, 4
mov dword [ebx], 0x620064
add ebx, 4
mov dword [ebx], 0x63006c
add ebx, 4
mov dword [ebx], 0x6b
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x11d]
call fcn.00403cd8
mov edx, dword [ebp - 0x144]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
call fcn.0044cc28
push 0x105
lea eax, [ebp - 0x11d]
push eax
lea edx, [ebp - 0x148]
mov eax, edi
call fcn.004087c0
mov eax, dword [ebp - 0x148]
call fcn.00403f50
push eax
call sub.kernel32.dll_QueryDosDeviceA
mov al, byte [0x44f154]
push eax
lea eax, [ebp - 0x14c]
push eax
lea edx, [ebp - 0x150]
mov eax, edi
call fcn.004087c0
mov eax, dword [ebp - 0x150]
push eax
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x11d]
mov ecx, 0x105
call fcn.00403d20
mov ecx, dword [ebp - 0x154]
mov eax, edi
pop edx
call fcn.0040c664
mov edx, dword [ebp - 0x14c]
lea eax, [ebp - 0x10]
call fcn.00404244
mov eax, dword [ebp - 0x10]
call fcn.00404264
add eax, eax
add eax, 2
push eax
mov ecx, dword [ebp - 0x10]
mov edx, 0x44f160
mov eax, dword [ebp - 0x18]
call fcn.0044cf64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f0d2
mov eax, dword [ebp - 0x18]
call fcn.00402de4
ret
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f11c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f149
lea eax, [ebp - 0x154]
mov edx, 6
call fcn.00403b14
lea eax, [ebp - 0x10]
call fcn.0040413c
ret