Function at 0x409070
Capabilities:
Delete file
Delete service
Link many functions at runtime
Move file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5238c1
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x80
mov eax, dword [0x556358]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8c], ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x20], esi
test esi, esi
jne 0x4090d7
call edi
push 0xf01ff
push 0x55ace0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
push esi
movq qword [ebp - 0x1c], xmm0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ecx, eax
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x409104
xor eax, eax
jmp 0x40911e
call edi
test eax, eax
je 0x409116
jle 0x40911b
movzx eax, ax
or eax, 0x80070000
jmp 0x40911b
mov eax, 0x8007054f
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
test eax, eax
js 0x409132
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x409132
call edi
push 0x2c
lea eax, [ebp - 0x88]
push 0
push eax
call fcn.004e0850
add esp, 0xc
lea ecx, [ebp - 0x5c]
call fcn.00494eb0
push ecx
mov edx, eax
lea ecx, [ebp - 0x88]
call fcn.004070f0
add esp, 4
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x409175
lea ecx, [ebp - 0x50]
cmp eax, ecx
je 0x409175
push eax
call fcn.004e4113
add esp, 4
push str..sys
lea ecx, [ebp - 0x88]
call fcn.004095a0
xor esi, esi
mov dword [ebp - 0x30], esi
mov byte [ebp - 4], 3
xorps xmm0, xmm0
push 0x544828
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x24], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
push str.IsWow64Process
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64DisableWow64FsRedirection
push edi
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64RevertWow64FsRedirection
push edi
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x24], eax
call fcn.004950a0
test al, al
je 0x409242
push 0x10
call fcn.004d7fcd
mov esi, eax
add esp, 4
mov dword [ebp - 0x90], esi
xorps xmm0, xmm0
mov byte [ebp - 4], 4
push 0x544828
movups xmmword [esi], xmm0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
push str.IsWow64Process
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64DisableWow64FsRedirection
push edi
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64RevertWow64FsRedirection
push edi
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 8], eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x409242
lea eax, [esi + 0xc]
push eax
call ecx
mov eax, dword [ebp - 0x88]
mov ecx, 0x544e38
test eax, eax
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x409383
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
je 0x40927a
jle 0x409281
movzx edi, di
or edi, 0x80070000
jmp 0x40927f
mov edi, 0x8007054f
test edi, edi
jns 0x409385
push 0x2c
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.004e0850
add esp, 0xc
lea edx, [ebp - 0x88]
lea ecx, [ebp - 0x5c]
push 0x545258
call fcn.004098d0
mov eax, dword [ebp - 0x5c]
add esp, 4
test eax, eax
mov ecx, 0x544e38
mov edx, ecx
cmovne edx, eax
mov eax, dword [ebp - 0x88]
test eax, eax
push edx
cmovne ecx, eax
push ecx
call fcn.004e7bc8
mov eax, dword [ebp - 0x5c]
add esp, 8
test eax, eax
mov ecx, 0x544e38
cmovne ecx, eax
push 5
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
mov eax, dword [ebp - 0x5c]
je 0x40936d
mov edi, dword [ebp - 0x8c]
mov dword [edi], 0
test eax, eax
je 0x409310
lea ecx, [ebp - 0x50]
cmp eax, ecx
je 0x409310
push eax
call fcn.004e4113
add esp, 4
mov byte [ebp - 4], 2
test esi, esi
je 0x409335
mov byte [ebp - 4], 6
cmp dword [esi + 4], 0
je 0x40932a
push dword [esi + 0xc]
mov eax, dword [esi + 8]
call eax
push 0x10
push esi
call fcn.004d8000
add esp, 8
mov eax, dword [ebp - 0x88]
test eax, eax
je 0x40934f
lea ecx, [ebp - 0x7c]
cmp eax, ecx
je 0x40934f
push eax
call fcn.004e4113
add esp, 4
mov eax, dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x40935f
push eax
call esi
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x409369
push eax
call esi
mov eax, edi
jmp 0x4093ec
test eax, eax
je 0x409385
lea ecx, [ebp - 0x50]
cmp eax, ecx
je 0x409385
push eax
call fcn.004e4113
add esp, 4
jmp 0x409385
xor edi, edi
mov eax, dword [ebp - 0x8c]
mov byte [ebp - 4], 2
mov dword [eax], edi
test esi, esi
je 0x4093b2
mov byte [ebp - 4], 7
cmp dword [esi + 4], 0
je 0x4093a7
push dword [esi + 0xc]
mov eax, dword [esi + 8]
call eax
push 0x10
push esi
call fcn.004d8000
add esp, 8
mov eax, dword [ebp - 0x88]
test eax, eax
je 0x4093cc
lea ecx, [ebp - 0x7c]
cmp eax, ecx
je 0x4093cc
push eax
call fcn.004e4113
add esp, 4
mov eax, dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x4093dc
push eax
call esi
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4093e6
push eax
call esi
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d7fbc
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret