Function at 0x409875
Capabilities:
Check for time delay via gettickcount
Print debug messages
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41d0a7
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x4280b0]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
sub ebx, ebx
push ebx
push 1
push ecx
mov eax, esp
mov dword [esp + 0x40], esp
push eax
mov edi, str.installUser
mov dword [esp + 0x40], 8
call fcn.00402d3a
lea eax, [esp + 0x38]
push eax
call fcn.004010bd
add esp, 0x10
mov dword [esp + 0x70], ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp eax, 0x2bf20
mov eax, dword [0x428020]
mov ecx, 0x428020
setb byte [esp + 0x11]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x70], 1
call esi
push eax
sub eax, eax
cmp byte [esp + 0x15], bl
setne al
push eax
push str.___YSearchUtilSvc_started.__Fresh_boot:__d___d____
lea eax, [esp + 0x20]
call fcn.00402420
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add esp, 0xc
push dword [esp + 0x14]
call esi
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [esp + 0x34], eax
call fcn.00408455
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x42abc8], eax
cmp eax, ebx
je 0x409d87
push ebx
push 4
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ebx
call fcn.0040762f
pop ecx
pop ecx
mov dword [esp + 0x30], eax
cmp eax, ebx
jne 0x409d77
push ebx
push 1
push ecx
mov eax, esp
mov dword [esp + 0x34], esp
push eax
mov edi, str.svcNextCheckTime
mov dword [esp + 0x28], ebx
call fcn.00402d3a
call fcn.0040116d
add esp, 0xc
push ebx
push 1
push ecx
mov dword [esp + 0x58], eax
mov eax, esp
mov dword [esp + 0x34], esp
push eax
mov edi, str.svcNextCheckSetTime
mov dword [esp + 0x60], ebx
call fcn.00402d3a
call fcn.0040116d
add esp, 0xc
push ebx
push 1
push ecx
mov dword [esp + 0x60], eax
mov eax, esp
mov dword [esp + 0x34], esp
push eax
mov edi, str.svcDestructTime
mov dword [esp + 0x68], ebx
call fcn.00402d3a
call fcn.0040116d
add esp, 0xc
push str.Entered_service_main_loop
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ebx
call fcn.0040709d
pop ecx
push ebx
push 1
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
push eax
mov edi, str.svcNextCheckTimespan
call fcn.00402d3a
call fcn.0040116d
add esp, 0xc
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
cmp eax, ebx
jne 0x409a23
mov dword [esp + 0x24], 0x384
mov dword [esp + 0x20], 0xe10
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x16], 1
call fcn.0040cf2a
pop ecx
cmp dword [esp + 0x48], ebx
je 0x409a43
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004097c9
push 0x1388
mov dword [esp + 0x4c], eax
push ebx
lea eax, [esp + 0x4c]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, ebx
je 0x409d6c
cmp eax, 1
jne 0x409a84
call fcn.00409441
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [esp + 0x48], ebx
jmp 0x4099ea
lea ecx, [esp + 0x28]
call fcn.00401da5
lea eax, [esp + 0x2c]
mov byte [esp + 0x70], 2
mov ecx, dword [esp + 0x28]
push eax
call fcn.0040a182
or eax, eax
jne 0x409d4f
push str.Checking_for_deferred_sets...
call esi
call fcn.00408550
cmp eax, 1
je 0x409abd
mov byte [esp + 0x12], bl
push dword [esp + 0x18]
call fcn.004091d6
mov edi, dword [esp + 0x64]
pop ecx
mov dword [esp + 0x18], eax
cmp dword [esp + 0x40], edi
jl 0x409bc8
jg 0x409ae9
mov eax, dword [esp + 0x3c]
cmp eax, dword [esp + 0x5c]
jb 0x409bc8
cmp dword [0x42abd0], ebx
jne 0x409b65
push str.DESTRUCT___Tracking_search_modifications_and_extension_activations
call fcn.0040709d
pop ecx
call fcn.0040903f
push ebx
push ebx
push ebx
push 1
call fcn.00408e4e
add esp, 0xc
mov eax, esp
mov dword [esp + 0x20], esp
push eax
mov edi, str._remove
call fcn.00402d3a
push ecx
mov eax, esp
mov dword [esp + 0x40], esp
push eax
mov edi, 0x423f78
mov byte [esp + 0x7c], 3
call fcn.00402d3a
mov byte [esp + 0x78], 2
call fcn.00407500
pop ecx
pop ecx
or eax, eax
jns 0x409b53
push eax
push str.unable_to_launch_proc_to_remove_service___x
call fcn.0040709d
pop ecx
pop ecx
mov eax, dword [0x42abc8]
or eax, eax
je 0x409b63
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
sub ebx, ebx
mov edi, dword [esp + 0x58]
cmp dword [esp + 0x40], edi
jl 0x409c19
jg 0x409b83
mov eax, dword [esp + 0x3c]
cmp eax, dword [esp + 0x54]
jb 0x409c19
push str.Checking_for_search_set_modifications...
call esi
call fcn.0040903f
mov ecx, dword [esp + 0x20]
push ebx
sub eax, eax
add ecx, dword [esp + 0x40]
push 1
adc eax, dword [esp + 0x48]
push ecx
push ecx
mov dword [esp + 0x68], eax
mov eax, esp
mov dword [esp + 0x48], esp
push eax
mov edi, str.svcNextCheckSetTime
mov dword [esp + 0x68], ecx
call fcn.00402d3a
call fcn.0040128c
add esp, 0x10
jmp 0x409c65
mov eax, dword [0x428020]
mov ecx, 0x428020
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x5c]
mov byte [esp + 0x70], 4
sub eax, dword [esp + 0x3c]
sbb edi, dword [esp + 0x40]
push edi
push eax
push str.time_until_destruct:__d
lea eax, [esp + 0x28]
call fcn.00402420
mov edi, dword [esp + 0x28]
add esp, 0xc
push edi
call esi
lea eax, [edi - 0x10]
mov byte [esp + 0x70], 2
call fcn.00402daa
jmp 0x409b65
mov eax, dword [0x428020]
mov ecx, 0x428020
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x54]
mov byte [esp + 0x70], 5
sub eax, dword [esp + 0x3c]
sbb edi, dword [esp + 0x40]
push edi
push eax
push str.time_until_next_search_set_check:__d
lea eax, [esp + 0x2c]
call fcn.00402420
mov edi, dword [esp + 0x2c]
add esp, 0xc
push edi
call esi
lea eax, [edi - 0x10]
mov byte [esp + 0x70], 2
call fcn.00402daa
mov eax, dword [esp + 0x40]
cmp eax, dword [esp + 0x50]
jg 0x409cd1
jl 0x409c7b
mov eax, dword [esp + 0x3c]
cmp eax, dword [esp + 0x4c]
jae 0x409cd1
cmp byte [esp + 0x11], bl
jne 0x409cd1
mov eax, dword [0x428020]
mov ecx, 0x428020
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
mov byte [esp + 0x70], 6
sub eax, dword [esp + 0x3c]
sbb ecx, dword [esp + 0x40]
push ecx
push eax
push str.time_until_next_activation_check:__d
lea eax, [esp + 0x2c]
call fcn.00402420
mov edi, dword [esp + 0x2c]
add esp, 0xc
push edi
call esi
lea eax, [edi - 0x10]
call fcn.00402daa
jmp 0x409d56
push str.Checking_for_activations...
call esi
cmp byte [esp + 0x11], bl
lea eax, [esp + 0x13]
push eax
sete al
movzx eax, al
push eax
push 1
push ebx
call fcn.00408e4e
mov edx, dword [esp + 0x50]
mov edi, dword [esp + 0x4c]
add esp, 0x10
cmp eax, 1
jne 0x409d0e
cmp byte [esp + 0x12], bl
je 0x409d0e
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], edx
mov ecx, 0x15180
cmp byte [esp + 0x13], bl
jne 0x409d1d
mov ecx, dword [esp + 0x24]
push ebx
sub eax, eax
add ecx, edi
push 1
push ecx
adc eax, edx
push ecx
mov dword [esp + 0x60], eax
mov eax, esp
mov dword [esp + 0x48], esp
push eax
mov edi, str.svcNextCheckTime
mov dword [esp + 0x60], ecx
call fcn.00402d3a
call fcn.0040128c
add esp, 0x10
mov byte [esp + 0x11], bl
jmp 0x409d56
push str.___user_who_installed_service_not_interactive.__sleeping.
call esi
mov byte [esp + 0x70], 1
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
call fcn.00402daa
jmp 0x4099ea
push str.Exited_service_main_loop
call fcn.0040709d
pop ecx
mov eax, dword [0x42abc8]
cmp eax, ebx
je 0x409d87
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x34], ebx
jl 0x409d93
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.00402daa
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
call fcn.00402daa
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret