Function at 0x401aa0
Capabilities:
Delete service
Get file size
Read file on windows
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x41b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
push edi
push 0x200
mov dword [ebp - 0x230], eax
xor ebx, ebx
mov dword [ebp - 0x208], eax
xor edi, edi
lea eax, [ebp - 0x204]
mov dword [ebp - 0x22c], 0
push ebx
push eax
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x238], 0
call fcn.00402e20
mov eax, dword [ebp + 8]
add esp, 0xc
cmp eax, 2
jl 0x401d9b
jne 0x401b37
mov eax, dword [esi + 4]
mov dword [ebp - 0x234], eax
cmp word [eax], 0x2d
je 0x401d9b
mov dword [ebp - 0x22c], 1
xor esi, esi
jmp 0x401b7e
cmp eax, 3
jne 0x401d9b
mov eax, dword [esi + 4]
mov ecx, 0x419b30
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401b6e
test dx, dx
je 0x401b6a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401b6e
add eax, 4
add ecx, 4
test dx, dx
jne 0x401b48
xor eax, eax
jmp 0x401b73
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401d80
mov esi, dword [esi + 8]
call fcn.004015f0
test eax, eax
jns 0x401b99
push str._x__Install_Driver_Error_n
call fcn.00401010
add esp, 4
jmp 0x401daa
cmp dword [ebp - 0x22c], ebx
je 0x401be5
mov eax, dword [ebp - 0x234]
test eax, eax
jne 0x401bbd
push str._x__Invalid_Input_file_name_n
call fcn.00401010
add esp, 4
jmp 0x401daa
mov ecx, eax
call fcn.004012a0
test eax, eax
jns 0x401bda
push str._x__Failed_n
call fcn.00401010
add esp, 4
jmp 0x401daa
mov dword [ebp - 0x228], ebx
jmp 0x401db4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x238], eax
test eax, eax
jne 0x401c1a
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str._x__CreateFileW_error:_0x_x_n
jmp 0x401da2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
push 4
push 0x3000
push edi
push 0
call esi
push 4
mov dword [ebp - 0x230], eax
lea eax, [edi*2 + 1]
push 0x3000
push eax
push 0
call esi
mov ebx, eax
mov eax, dword [ebp - 0x230]
test eax, eax
je 0x401d71
test ebx, ebx
je 0x401d71
mov esi, edi
test edi, edi
je 0x401c9d
nop
push 0
lea ecx, [ebp - 0x208]
sub eax, esi
push ecx
push esi
add eax, edi
push eax
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401ce3
mov eax, dword [ebp - 0x230]
sub esi, dword [ebp - 0x208]
jne 0x401c70
lea eax, [edi + edi]
push eax
mov eax, dword [ebp - 0x230]
push ebx
push edi
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
xor esi, esi
mov word [ebx + edi*4], ax
test edi, edi
je 0x401db4
movzx eax, word [ebx + esi*2]
mov edx, eax
cmp eax, 0xd
je 0x401cdc
cmp eax, 0xa
je 0x401cdc
test ax, ax
jne 0x401cf5
cmp esi, edi
jae 0x401cf5
inc esi
jmp 0x401cc7
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str._x__ReadFile_error:_0x_x_n
jmp 0x401da2
xor ecx, ecx
cmp eax, 0xd
je 0x401d22
mov eax, edx
nop
cmp ax, 0xa
je 0x401d22
test ax, ax
je 0x401d22
cmp esi, edi
jae 0x401d22
inc esi
mov word [ebp + ecx*2 - 0x204], ax
inc ecx
movzx eax, word [ebx + esi*2]
cmp eax, 0xd
jne 0x401d00
add ecx, ecx
cmp ecx, 0x200
jae 0x401f0a
xor eax, eax
mov word [ebp + ecx - 0x204], ax
lea ecx, [ebp - 0x204]
call fcn.004012a0
test eax, eax
lea eax, [ebp - 0x204]
js 0x401d69
push 0x200
push 0
push eax
call fcn.00402e20
add esp, 0xc
cmp esi, edi
jb 0x401cc7
jmp 0x401db4
push eax
push str._x__Failed_on_image:__ws_n
jmp 0x401da2
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push str._x__VirtualAlloc_error:_0x_x_n
jmp 0x401da2
push str._x__Input_Argument_Error_n
call fcn.00401010
push dword [esi]
push str.____Usage:__ws___PE_image_name_CASE_SENSITIVE_____f__PE_image_name_list_file___n
call fcn.00401010
add esp, 0xc
jmp 0x401daa
push dword [esi]
push str.____Usage:__ws___PE_image_name_CASE_SENSITIVE_____f__PE_image_name_list_file___n
call fcn.00401010
add esp, 8
mov dword [ebp - 0x228], 0xffffffff
xor eax, eax
xor esi, esi
push 0xf003f
push eax
push eax
mov dword [ebp - 0x22c], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x234], eax
test eax, eax
jne 0x401de3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._x__OpenSCManager_failed___d__n
jmp 0x401e51
push 0xf01ff
push str.NetDiscovery
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x22c], eax
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x20c], esi
push 1
push eax
movups xmmword [ebp - 0x224], xmm0
movq qword [ebp - 0x214], xmm0
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x401e34
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._x__ControlService_error:_0x_x_n
jmp 0x401e51
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x401e5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._x__DeleteService_error:_0x_x_n
call fcn.00401010
add esp, 8
or esi, 0xffffffff
mov eax, dword [ebp - 0x22c]
xorps xmm0, xmm0
mov ecx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movq qword [ebp - 0x214], xmm0
mov dword [ebp - 0x20c], 0
movups xmmword [ebp - 0x224], xmm0
test eax, eax
je 0x401e91
push eax
call ecx
mov ecx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x401e9e
push eax
call ecx
test esi, esi
jns 0x401eb9
push str._x__Remove_Service_Error_n
call fcn.00401010
add esp, 4
mov dword [ebp - 0x228], 0xffffffff
mov eax, dword [ebp - 0x230]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x401ed2
push 0x8000
push edi
push eax
call esi
test ebx, ebx
je 0x401ee2
push 0x8000
lea eax, [edi + edi]
push eax
push ebx
call esi
mov eax, dword [ebp - 0x238]
pop edi
pop esi
pop ebx
test eax, eax
je 0x401ef6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x228]
xor ecx, ebp
call fcn.00401f10
mov esp, ebp
pop ebp
ret
call fcn.00402040
int3