Function at 0x409b2a
Capabilities:
Create service
Delete service
Modify service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
xor eax, eax
mov dword [ebp - 0x30], edx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor edx, edx
push 3
mov dword [ebp - 0x3c], ecx
inc edx
or ebx, 0xffffffff
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x24], eax
mov esi, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], eax
pop ecx
mov dword [ebp - 8], ecx
test edi, edi
je 0x409cae
mov esi, dword [ebp + 8]
mov dword [ebp - 4], edx
add esi, 4
push 0x4011a4
push dword [esi - 4]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409cf2
cmp dword [ebp - 4], edi
jae 0x409cf2
lea edi, [ebx + 1]
neg edi
push 0x403b2c
push dword [esi]
sbb edi, edi
and edi, ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409bc1
push 0x10
jmp 0x409c67
push 0x403b34
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409bdb
push 0x20
jmp 0x409c67
push 0x4041f4
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409bf2
push 0x50
jmp 0x409c67
push 0x404204
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409c09
push 0x60
jmp 0x409c67
push 0x403ad0
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409c23
mov ebx, 0x100
jmp 0x409c86
push 0x403afc
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409c3b
xor ebx, ebx
inc ebx
jmp 0x409c86
push 0x403b0c
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409c52
push 2
jmp 0x409c67
push 0x404218
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409c6a
push 8
pop ebx
jmp 0x409c86
push 0x403ae4
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409ff7
mov ebx, 0x2f309a20
or ebx, edi
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
add eax, 2
add esi, 8
mov dword [ebp - 4], eax
dec eax
cmp eax, edi
jb 0x409b7d
mov esi, dword [ebp - 0x10]
cmp ebx, 0xffffffff
jne 0x409cb1
push 0x10
pop ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push esi
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push edx
push ecx
push ebx
push 0xf01ff
push dword [ebp - 0x28]
push dword [ebp - 0x30]
push dword [ebp - 0x3c]
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CreateServiceW]
mov edi, eax
test edi, edi
jne 0x40a057
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, 0x4045dc
jmp 0x40a04b
push 0x40422c
push dword [esi - 4]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409dd1
cmp dword [ebp - 4], edi
jae 0x409dd1
push 0x403ff0
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409d30
mov ecx, eax
mov dword [ebp - 8], ecx
jmp 0x409c8e
push 0x40423c
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409d48
xor ecx, ecx
inc ecx
jmp 0x409d28
push 0x40424c
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409d60
push 2
pop ecx
jmp 0x409d28
push 0x404258
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409d77
push 3
jmp 0x409d5d
push 0x404268
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409d8e
push 4
jmp 0x409d5d
push 0x40427c
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409db0
push 2
pop ecx
inc eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0x2c], eax
jmp 0x409c8e
push 0x403ae4
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x40a01c
mov ecx, 0xd0034911
jmp 0x409d28
push 0x404298
push dword [esi - 4]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409e77
cmp dword [ebp - 4], edi
jae 0x409e77
push 0x4042a8
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409e13
xor edx, edx
inc edx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
jmp 0x409c91
push 0x4042b8
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409e2b
push 2
pop edx
jmp 0x409e08
push 0x4042d8
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409e42
push 3
jmp 0x409e28
push 0x4042c8
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409e59
mov edx, eax
jmp 0x409e08
push 0x403ae4
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x40a02e
mov edx, 0xd74550
jmp 0x409e08
push 0x4042ec
push dword [esi - 4]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409e9c
mov eax, dword [ebp - 4]
cmp eax, edi
jae 0x409e9c
mov ecx, dword [esi]
mov dword [ebp - 0x24], ecx
jmp 0x409fca
push 0x401184
push dword [esi - 4]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409ec1
mov eax, dword [ebp - 4]
cmp eax, edi
jae 0x409ec1
mov ecx, dword [esi]
mov dword [ebp - 0x20], ecx
jmp 0x409fca
push 0x404300
push dword [esi - 4]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409efc
cmp dword [ebp - 4], edi
jae 0x409efc
push 0x40430c
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409c8b
lea eax, [ebp - 0x34]
mov dword [ebp - 0x1c], eax
jmp 0x409c8b
push 0x404388
push dword [esi - 4]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409f21
mov eax, dword [ebp - 4]
cmp eax, edi
jae 0x409f21
mov ecx, dword [esi]
mov dword [ebp - 0x28], ecx
jmp 0x409fca
push 0x404314
push dword [esi - 4]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409faa
cmp dword [ebp - 4], edi
jae 0x409faa
mov eax, dword [esi]
xor edi, edi
mov ecx, eax
mov dword [ebp - 0x38], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x409f46
sub ecx, edx
sar ecx, 1
lea edi, [ecx*2 + 4]
push edi
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40a040
push dword [ebp - 0x38]
mov edx, edi
mov ecx, eax
call fcn.0040c6c3
mov eax, dword [ebp - 0x10]
mov ecx, eax
movzx edx, word [eax]
test dx, dx
je 0x409c88
cmp dx, 0x2f
jne 0x409f98
xor eax, eax
mov word [ecx], ax
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x409f8d
jmp 0x409c88
push 0x404368
push dword [esi - 4]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x409fd5
mov eax, dword [ebp - 4]
cmp eax, edi
jae 0x409fd5
mov ecx, dword [esi]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
jmp 0x409c94
push 0x404374
push dword [esi - 4]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x40a012
mov eax, dword [ebp - 4]
cmp eax, edi
jae 0x40a012
mov ecx, dword [esi]
mov dword [ebp - 0x14], ecx
jmp 0x409fca
cmp byte [0x40ebc4], 1
jne 0x40a012
mov dword [ebp - 0x38], 0x4011a4
push 0x69
lea edx, [ebp - 0x38]
pop ecx
call fcn.0040a4ce
call fcn.00409b08
jmp 0x40a0e2
cmp byte [0x40ebc4], 1
jne 0x40a012
mov dword [ebp - 0x38], 0x40422c
jmp 0x40a007
cmp byte [0x40ebc4], 1
jne 0x40a012
mov dword [ebp - 0x38], 0x404298
jmp 0x40a007
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, 0x404328
mov edx, eax
call fcn.0040889b
jmp 0x40a0e2
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x40a0a9
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
push 3
push edi
call dword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x40a0a9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x40a0a9
mov edx, esi
mov ecx, 0x404408
call fcn.0040889b
push edi
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_DeleteService]
test eax, eax
jne 0x40a0d9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
mov ecx, 0x403fc4
call fcn.0040889b
jmp 0x40a0d7
push 0x64
lea edx, [ebp - 0x38]
mov dword [ebp - 0x38], 0x4045dc
pop ecx
call fcn.0040a4ce
cmp ebx, 0xffffffff
je 0x40a0d5
test ebx, 0x100
je 0x40a0d5
lea edx, [ebp - 0x30]
mov ecx, 0x84
call fcn.0040a4ce
xor eax, eax
mov esi, eax
push edi
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8