Function at 0x404d40
Capabilities:
Create service
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4e4
mov eax, dword [0x4703d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x10]
test eax, eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x4d4], edx
mov edx, dword [ebp + 0x28]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x4d8], edx
mov edx, dword [ebp + 0x30]
push edi
mov dword [ebp - 0x4e0], esi
mov dword [ebp - 0x4cc], ecx
mov dword [ebp - 0x4d0], eax
mov dword [ebp - 0x4dc], edx
mov byte [ebp - 0x4b9], 0
jne 0x404d9c
mov eax, 0x45278c
push eax
push ecx
push esi
push str.ConfigureService:__S__S__S_n
call fcn.0040ef30
mov eax, dword [ebp + 0x2c]
add esp, 0x10
test eax, eax
je 0x404dd1
lea edx, [ebp - 0x4b4]
sub edx, eax
jmp 0x404dc0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x404dc0
jmp 0x404e0c
xor eax, eax
jmp 0x404de0
movzx ecx, word [eax + 0x452754]
mov word [ebp + eax - 0x4b4], cx
add eax, 2
test cx, cx
jne 0x404de0
push esi
lea eax, [ebp - 0x4b4]
push 0xc8
push eax
call fcn.004294d0
add esp, 0xc
lea edx, [ebp - 0x324]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x404e16
push str.SYSTEMCurrentControlSetServices
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042a610
mov edi, eax
add esp, 8
test edi, edi
mov dword [ebp - 0x4e4], edi
je 0x405c74
lea ecx, [ebp - 0x324]
push ecx
push edi
call fcn.0042a610
add esp, 8
test eax, eax
mov dword [ebp - 0x4b8], eax
je 0x404eb7
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x405003
push SysReAllocString
lea edx, [ebp - 0x324]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x404ea2
push eax
call edi
push esi
call edi
jmp 0x405003
push str.ConfigureService:_Service_key_exists__but_service_is_not_installed_n
call fcn.0040ef30
add esp, 4
push esi
call edi
jmp 0x405003
push str.Open_service_key_failed:_adding_service_to_SCM_n
call fcn.0040ef30
add esp, 4
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x404fa6
mov eax, dword [ebp - 0x4cc]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_CreateServiceW]
xor edi, edi
push edi
push edi
push edi
push edi
push edi
push eax
mov eax, dword [ebp + 0x14]
push ecx
push edx
push eax
push 0x20000000
lea ecx, [ebp - 0x4b4]
push ecx
lea edx, [ebp - 0x324]
push edx
push esi
call ebx
test eax, eax
jne 0x404f92
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateServiceW_failed__u_n
mov dword [ebp - 0x4c8], eax
call fcn.0040ef30
add esp, 8
cmp dword [ebp - 0x4c8], 0x436
jne 0x404f99
cmp edi, 0xa
jge 0x404f99
push 0x452674
lea eax, [ebp - 0x4b4]
push 0xc8
push eax
call fcn.004294d0
mov ecx, dword [ebp - 0x4cc]
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
add esp, 0xc
push 0
push 0
push 0
push 0
push 0
push ecx
mov ecx, dword [ebp + 0x14]
push edx
push eax
push ecx
push 0x20000000
lea edx, [ebp - 0x4b4]
push edx
lea eax, [ebp - 0x324]
push eax
push esi
add edi, 1
call ebx
test eax, eax
je 0x404f14
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [ebp - 0x4e4]
call fcn.00402fe0
mov esi, eax
test esi, esi
je 0x404fd3
cmp esi, 0xffffffff
je 0x404fd3
push 0
lea ecx, [ebp - 0x4c8]
push ecx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea edx, [ebp - 0x324]
push edx
push edi
call fcn.0042a7f0
add esp, 8
test esi, esi
mov edi, eax
mov dword [ebp - 0x4b8], edi
je 0x404ffb
cmp esi, 0xffffffff
je 0x404ffb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x405c4f
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov byte [ebp - 0x4b9], 1
xor edi, edi
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..WGUARDNT
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x405056
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..GlobalWGUARDNT
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x405056
xor esi, esi
jmp 0x40507c
test esi, esi
je 0x40507c
cmp esi, 0xffffffff
je 0x40507c
push 0
lea eax, [ebp - 0x4c0]
push eax
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edx, dword [ebp - 0x4b8]
lea ecx, [ebp - 0x4b4]
push ecx
push str.DisplayName
push edx
call fcn.0042c310
add esp, 0xc
test al, al
jne 0x4050ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4050d6
cmp edi, 0xa
jge 0x4050d6
push 0x3e8
add edi, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x405012
cmp esi, 0xffffffff
je 0x405012
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405012
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ConfigureService:_Warning:_unable_to_set_DisplayName__u_n
call fcn.0040ef30
add esp, 8
test esi, esi
je 0x4050fa
cmp esi, 0xffffffff
je 0x4050fa
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x4cc], 0
je 0x405396
mov eax, dword [ebp - 0x4d0]
test eax, eax
je 0x405262
cmp word [eax], 0x22
je 0x4051d5
push eax
push str.__s_
call fcn.0042a590
add esp, 8
mov ebx, eax
xor edi, edi
call fcn.00402fe0
mov esi, eax
test esi, esi
je 0x40515e
cmp esi, 0xffffffff
je 0x40515e
push 0
lea ecx, [ebp - 0x4c0]
push ecx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edx, dword [ebp - 0x4b8]
push ebx
push str.ImagePath
push edx
call fcn.0042c360
add esp, 0xc
test al, al
jne 0x4051bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4051a7
cmp edi, 0xa
jge 0x4051a7
push 0x3e8
add edi, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x405131
cmp esi, 0xffffffff
je 0x405131
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405131
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Warning:_unable_to_set_ImagePath__u_n
call fcn.0040ef30
add esp, 8
push esi
call fcn.00403030
push ebx
call fcn.004280a0
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 4
jmp 0x405396
xor edi, edi
call fcn.00402fe0
mov esi, eax
test esi, esi
je 0x405204
cmp esi, 0xffffffff
je 0x405204
push 0
lea eax, [ebp - 0x4c0]
push eax
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [ebp - 0x4d0]
mov edx, dword [ebp - 0x4b8]
push ecx
push str.ImagePath
push edx
call fcn.0042c360
add esp, 0xc
test al, al
jne 0x405390
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40537c
cmp edi, 0xa
jge 0x40537c
push 0x3e8
add edi, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x4051d7
cmp esi, 0xffffffff
je 0x4051d7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4051d7
push 0xc8
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.0043c140
mov edx, dword [ebp - 0x4b8]
push 0xc8
lea ecx, [ebp - 0x194]
push ecx
push str.ImagePath
push edx
call fcn.0042c460
add esp, 0x1c
cmp word [ebp - 0x194], 0x5c
je 0x4052a9
cmp word [ebp - 0x192], 0x3a
jne 0x4052c6
push 0xb
push str.SystemRoot
push 0xb
lea eax, [ebp - 0x194]
push eax
call fcn.00402ea0
test al, al
je 0x405396
push str.system32drivers_
lea ecx, [ebp - 0x194]
push 0xc8
push ecx
call fcn.00429430
mov edx, dword [ebp - 0x4cc]
push edx
lea eax, [ebp - 0x194]
push 0xc8
push eax
call fcn.004294d0
add esp, 0x18
xor edi, edi
lea esp, [esp]
call fcn.00402fe0
mov esi, eax
test esi, esi
je 0x40532d
cmp esi, 0xffffffff
je 0x40532d
push 0
lea ecx, [ebp - 0x4c0]
push ecx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [ebp - 0x4b8]
lea edx, [ebp - 0x194]
push edx
push str.ImagePath
push eax
call fcn.0042c310
add esp, 0xc
test al, al
jne 0x405390
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40537c
cmp edi, 0xa
jge 0x40537c
push 0x3e8
add edi, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x405300
cmp esi, 0xffffffff
je 0x405300
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405300
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Warning:_unable_to_set_ImagePath__u_n
call fcn.0040ef30
add esp, 8
push esi
call fcn.00403030
xor edi, edi
jmp 0x4053a0
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..WGUARDNT
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x4053e4
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..GlobalWGUARDNT
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x4053e4
xor esi, esi
jmp 0x40540a
test esi, esi
je 0x40540a
cmp esi, 0xffffffff
je 0x40540a
push 0
lea ecx, [ebp - 0x4c0]
push ecx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x4b8]
push edx
push str.Type
push eax
call fcn.0042c2f0
add esp, 0xc
test al, al
jne 0x405479
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x405461
cmp edi, 0xa
jge 0x405461
push 0x3e8
add edi, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x4053a0
cmp esi, 0xffffffff
je 0x4053a0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4053a0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push str.ConfigureService:_Warning:_unable_to_set_Type__u_n
call fcn.0040ef30
add esp, 8
jmp 0x40547f
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x40548f
cmp esi, 0xffffffff
je 0x40548f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x4b8]
lea ecx, [ebp - 0x4c1]
push ecx
push str.DeleteFlag
push esi
mov byte [ebp - 0x4c1], 0
call fcn.0042c400
lea edx, [ebp - 0x4c8]
push edx
push str.Start
push esi
mov dword [ebp - 0x4c8], 3
call fcn.0042c3b0
mov esi, dword [ebp + 0x18]
add esp, 0x18
test al, al
jne 0x4054f5
mov eax, dword [ebp - 0x4e0]
push esi
push eax
call fcn.00404ba0
test al, al
jne 0x4054f5
call edi
push eax
push str.WARNING__ConfigureService:_unable_to_set_Start__u_n
call fcn.0040ef30
add esp, 8
cmp byte [ebp - 0x4c1], 0
jne 0x40550d
mov eax, dword [ebp - 0x4c8]
cmp eax, esi
jle 0x40552e
cmp eax, 4
je 0x40552e
mov ecx, dword [ebp - 0x4e0]
push esi
push ecx
call fcn.00404ba0
test al, al
jne 0x40552e
call edi
push eax
push str.WARNING__ConfigureService:_failed_to_set_Start__u_n
call fcn.0040ef30
add esp, 8
xor edi, edi
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..WGUARDNT
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x405574
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..GlobalWGUARDNT
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x405574
xor esi, esi
jmp 0x40559a
test esi, esi
je 0x40559a
cmp esi, 0xffffffff
je 0x40559a
push 0
lea edx, [ebp - 0x4c0]
push edx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x4b8]
push eax
push str.ErrorControl
push ecx
call fcn.0042c2f0
add esp, 0xc
test al, al
jne 0x405605
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4055f1
cmp edi, 0xa
jge 0x4055f1
push 0x3e8
add edi, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x405530
cmp esi, 0xffffffff
je 0x405530
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405530
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ConfigureService:_Warning:_unable_to_set_ErrorControl__u_n
call fcn.0040ef30
add esp, 8
test esi, esi
je 0x405615
cmp esi, 0xffffffff
je 0x405615
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x4d4], 0
je 0x4056fb
xor edi, edi
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..WGUARDNT
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x405668
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..GlobalWGUARDNT
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x405668
xor esi, esi
jmp 0x40568e
test esi, esi
je 0x40568e
cmp esi, 0xffffffff
je 0x40568e
push 0
lea edx, [ebp - 0x4c0]
push edx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [ebp - 0x4d4]
mov ecx, dword [ebp - 0x4b8]
push eax
push str.Group
push ecx
call fcn.0042c310
add esp, 0xc
test al, al
jne 0x40571c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4056e8
cmp edi, 0xa
jge 0x4056e8
push 0x3e8
add edi, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x405624
cmp esi, 0xffffffff
je 0x405624
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405624
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ConfigureService:_Warning:_unable_to_set_Group__u_n
call fcn.0040ef30
jmp 0x405719
call fcn.00402fe0
mov esi, eax
push esi
call fcn.00403050
mov edx, dword [ebp - 0x4b8]
push str.Group
push edx
call fcn.0042a9e0
add esp, 8
test esi, esi
je 0x40572c
cmp esi, 0xffffffff
je 0x40572c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp + 0x24]
test ebx, ebx
je 0x405819
xor edi, edi
lea esp, [esp]
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..WGUARDNT
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40578c
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..GlobalWGUARDNT
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40578c
xor esi, esi
jmp 0x4057b2
test esi, esi
je 0x4057b2
cmp esi, 0xffffffff
je 0x4057b2
push 0
lea eax, [ebp - 0x4c0]
push eax
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [ebp - 0x4b8]
push ebx
push 0x45243c
push ecx
call fcn.0042c2f0
add esp, 0xc
test al, al
jne 0x40583a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x405806
cmp edi, 0xa
jge 0x405806
push 0x3e8
add edi, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x405740
cmp esi, 0xffffffff
je 0x405740
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405740
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ConfigureService:_Warning:_unable_to_set_Tag__u_n
call fcn.0040ef30
jmp 0x405837
call fcn.00402fe0
mov esi, eax
push esi
call fcn.00403050
mov edx, dword [ebp - 0x4b8]
push 0x45243c
push edx
call fcn.0042a9e0
add esp, 8
test esi, esi
je 0x40584a
cmp esi, 0xffffffff
je 0x40584a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x4d8], 0
je 0x405947
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor edi, edi
nop
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..WGUARDNT
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x4058a4
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..GlobalWGUARDNT
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x4058a4
xor esi, esi
jmp 0x4058ca
test esi, esi
je 0x4058ca
cmp esi, 0xffffffff
je 0x4058ca
push 0
lea eax, [ebp - 0x4c0]
push eax
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ebp - 0x4b8]
push ecx
push str.DependOnService
push edx
call fcn.004034b0
test al, al
jne 0x405935
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x405921
cmp edi, 0xa
jge 0x405921
push 0x3e8
add edi, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x405860
cmp esi, 0xffffffff
je 0x405860
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405860
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ConfigureService:_Warning:_unable_to_set_DependOnService__u_n
call fcn.0040ef30
add esp, 8
test esi, esi
je 0x40597e
cmp esi, 0xffffffff
je 0x40597e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40597e
call fcn.00402fe0
mov esi, eax
push esi
call fcn.00403050
mov eax, dword [ebp - 0x4b8]
push str.DependOnService
push eax
call fcn.0042a9e0
add esp, 8
test esi, esi
je 0x405978
cmp esi, 0xffffffff
je 0x405978
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp dword [ebp - 0x4dc], 0
je 0x405a67
xor edi, edi
lea ecx, [ecx]
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..WGUARDNT
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x4059d4
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..GlobalWGUARDNT
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x4059d4
xor esi, esi
jmp 0x4059fa
test esi, esi
je 0x4059fa
cmp esi, 0xffffffff
je 0x4059fa
push 0
lea ecx, [ebp - 0x4c0]
push ecx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edx, dword [ebp - 0x4dc]
mov eax, dword [ebp - 0x4b8]
push edx
push str.Description
push eax
call fcn.0042c310
add esp, 0xc
test al, al
jne 0x405a88
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x405a54
cmp edi, 0xa
jge 0x405a54
push 0x3e8
add edi, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x405990
cmp esi, 0xffffffff
je 0x405990
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405990
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ConfigureService:_Warning:_unable_to_set_Description__u_n
call fcn.0040ef30
jmp 0x405a85
call fcn.00402fe0
mov esi, eax
push esi
call fcn.00403050
mov ecx, dword [ebp - 0x4b8]
push str.Description
push ecx
call fcn.0042a9e0
add esp, 8
test esi, esi
je 0x405a98
cmp esi, 0xffffffff
je 0x405a98
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00402fe0
mov esi, eax
test esi, esi
je 0x405ac5
cmp esi, 0xffffffff
je 0x405ac5
push 0
lea edx, [ebp - 0x4c0]
push edx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, dword [ebp - 0x4b8]
push str.DependOnGroup
push edi
call fcn.0042a9e0
add esp, 8
test esi, esi
je 0x405ae9
cmp esi, 0xffffffff
je 0x405ae9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x14], 0x10
je 0x405b0c
call fcn.00402fe0
mov esi, eax
push esi
call fcn.00403050
push str.ObjectName
push edi
call fcn.0042a9e0
jmp 0x405be3
xor edi, edi
mov edi, edi
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..WGUARDNT
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x405b54
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..GlobalWGUARDNT
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x405b54
xor esi, esi
jmp 0x405b7a
test esi, esi
je 0x405b7a
cmp esi, 0xffffffff
je 0x405b7a
push 0
lea eax, [ebp - 0x4c0]
push eax
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [ebp - 0x4b8]
push str.LocalSystem
push str.ObjectName
push ecx
call fcn.0042c310
add esp, 0xc
test al, al
jne 0x405be6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x405bd2
cmp edi, 0xa
jge 0x405bd2
push 0x3e8
add edi, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x405b10
cmp esi, 0xffffffff
je 0x405b10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405b10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ConfigureService:_Warning:_unable_to_set_ObjectName__u_n
call fcn.0040ef30
add esp, 8
test esi, esi
je 0x405bf6
cmp esi, 0xffffffff
je 0x405bf6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00402fe0
mov esi, eax
test esi, esi
je 0x405c23
cmp esi, 0xffffffff
je 0x405c23
push 0
lea edx, [ebp - 0x4c0]
push edx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, dword [ebp - 0x4b8]
push str.DeleteFlag
push edi
call fcn.0042a9e0
add esp, 8
test esi, esi
je 0x405c47
cmp esi, 0xffffffff
je 0x405c47
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.0042a5f0
jmp 0x405c59
push str.ConfigureService:_Failed_to_get_serviceRegKey
call fcn.0040ef30
mov eax, dword [ebp - 0x4e4]
add esp, 4
push eax
call fcn.0042a5f0
add esp, 4
cmp byte [ebp - 0x4b9], 0
jne 0x405c81
push str.ERROR:_ConfigureService:_ConfigureService:_Unable_to_update_registry._n
call fcn.0040ef30
add esp, 4
mov eax, dword [ebp + 0x34]
test al, al
je 0x405c9b
push eax
lea ecx, [ebp - 0x324]
push ecx
call fcn.0041b220
mov byte [ebp - 0x4b9], al
mov bl, byte [ebp - 0x4b9]
movzx edx, bl
push edx
push str.ConfigureService:_exit_d_n
call fcn.0040ef30
mov ecx, dword [ebp - 4]
add esp, 8
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0043c015
mov esp, ebp
pop ebp
ret 0x30