Function at 0x48f940
Capabilities:
Create service
Delete service
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x5c7004]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
push 2
push 0
mov esi, ecx
push 0
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [esp + 0x20], ebx
test ebx, ebx
jne 0x48f9a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea esp, [esp]
test eax, eax
jle 0x48fb6b
movzx eax, ax
or eax, 0xc0070000
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, 0x5cf00c
xor eax, eax
lock cmpxchg dword [edx], ecx
mov edi, eax
test edi, edi
je 0x48fa6f
lock inc dword [edi - 4]
push dword [esi + 0x28]
push dword [edi + 4]
push str.__s___ras___s_
call sym.ProcessHacker.exe_PhFormatString
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov esi, eax
mov ecx, dword [ecx + 0x28]
push 0x5621e4
push str.LocalSystem
push 0
push 0
push 0
push dword [esi + 4]
push 0
push 3
push 0x10
push 0xf01ff
push ecx
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, ds:[esi - 8]
mov ebx, eax
or esi, 0xffffffff
mov edx, esi
lock xadd dword [ecx + 4], edx
dec edx
jne 0x48fa28
call fcn.004c1f60
lea ecx, [edi - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x48fa3a
call fcn.004c1f60
push dword ds:[esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x48fab2
test ebx, ebx
jle 0x48fa5b
movzx ebx, bx
or ebx, 0xc0070000
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push 0
push dword [0x5cd528]
call sym.ProcessHacker.exe_PhGetDllFileName
mov edi, eax
mov edx, 0x5cf00c
mov ecx, edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x48fa93
lock inc dword [edi - 4]
test edi, edi
jne 0x48f9bd
mov eax, 0xc0000229
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
call fcn.0048f7e0
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov eax, dword [esp + 0x10]
push dword [eax + 0x28]
push str.BaseNamedObjects_
call sym.ProcessHacker.exe_PhConcatStrings2
mov ebx, eax
mov edi, 0x32
movzx ecx, word [ebx]
mov word [esp + 0x24], cx
movzx ecx, word [ebx]
add cx, 2
mov word [esp + 0x26], cx
mov ecx, dword [ebx + 4]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x24]
call fcn.0045b6a0
mov esi, eax
test esi, esi
jns 0x48fb2d
lea edx, [esp + 0x18]
mov dword [esp + 0x18], 0xfff0bdc0
mov dword [esp + 0x1c], 0xffffffff
call fcn.004c18c0
sub edi, 1
jne 0x48fb00
lea ecx, [ebx - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x48fb45
jmp 0x48fb40
call fcn.004c1f60
test esi, esi
js 0x48fb5e
mov edx, dword [esp + 0x10]
mov ecx, 0xc
call fcn.0045b980
mov esi, eax
call fcn.0045b840
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret