Function at 0x4039a0
Capabilities:
Create service
Inspect section memory permissions
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4e0
mov eax, dword [0x451430]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x10]
test eax, eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x4d0], edx
mov edx, dword [ebp + 0x28]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x4d4], edx
mov edx, dword [ebp + 0x30]
push edi
mov dword [ebp - 0x4cc], ecx
mov dword [ebp - 0x4dc], eax
mov dword [ebp - 0x4d8], edx
mov byte [ebp - 0x4b9], 0
jne 0x4039f5
mov eax, 0x43f77c
push eax
push ecx
push esi
push str.ConfigureService__S__S__S_n
call fcn.0040c2f0
mov eax, dword [ebp + 0x2c]
add esp, 0x10
test eax, eax
je 0x403a25
lea edx, [ebp - 0x4b4]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x403a14
jmp 0x403a5c
xor eax, eax
jmp 0x403a30
movzx ecx, word [eax + 0x43f744]
mov word [ebp + eax - 0x4b4], cx
add eax, 2
test cx, cx
jne 0x403a30
push esi
lea eax, [ebp - 0x4b4]
push 0xc8
push eax
call fcn.00421b60
add esp, 0xc
lea edx, [ebp - 0x194]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x403a66
push str.SYSTEMCurrentControlSetServices
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00422c80
mov edi, eax
add esp, 8
test edi, edi
mov dword [ebp - 0x4e0], edi
je 0x404ad7
push ebx
lea ecx, [ebp - 0x194]
push ecx
push edi
call fcn.00422c80
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 8
test eax, eax
mov dword [ebp - 0x4b8], eax
je 0x403b08
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x403c50
push SysReAllocString
lea edx, [ebp - 0x194]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x403af3
push eax
call ebx
push esi
call ebx
jmp 0x403c50
push str.Service_key_exists__but_service_is_not_installed_n
call fcn.0040c2f0
add esp, 4
push esi
call ebx
jmp 0x403c50
push str.Open_service_key_failed:_adding_service_to_SCM_n
call fcn.0040c2f0
add esp, 4
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x403bfd
mov eax, dword [ebp - 0x4cc]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_CreateServiceW]
xor edi, edi
push edi
push edi
push edi
push edi
push edi
push eax
mov eax, dword [ebp + 0x14]
push ecx
push edx
push eax
push 0x20000000
lea ecx, [ebp - 0x4b4]
push ecx
lea edx, [ebp - 0x194]
push edx
push esi
call ebx
test eax, eax
jne 0x403be3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateServiceW_failed__u_n
mov dword [ebp - 0x4c8], eax
call fcn.0040c2f0
add esp, 8
cmp dword [ebp - 0x4c8], 0x436
jne 0x403bea
cmp edi, 0xa
jge 0x403bea
push 0x43f6c0
lea eax, [ebp - 0x4b4]
push 0xc8
push eax
call fcn.00421b60
mov ecx, dword [ebp - 0x4cc]
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
add esp, 0xc
push 0
push 0
push 0
push 0
push 0
push ecx
mov ecx, dword [ebp + 0x14]
push edx
push eax
push ecx
push 0x20000000
lea edx, [ebp - 0x4b4]
push edx
lea eax, [ebp - 0x194]
push eax
push esi
add edi, 1
call ebx
test eax, eax
je 0x403b65
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [ebp - 0x4e0]
call fcn.00401000
mov esi, eax
test esi, esi
je 0x403c2a
cmp esi, 0xffffffff
je 0x403c2a
push 0
lea ecx, [ebp - 0x4c8]
push ecx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea edx, [ebp - 0x194]
push edx
push edi
call fcn.00422d80
add esp, 8
test esi, esi
mov dword [ebp - 0x4b8], eax
je 0x403c50
cmp esi, 0xffffffff
je 0x403c50
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x14], 0x10
jne 0x403d02
push 0
push 0
call fcn.00401490
cmp eax, 0x1770
jl 0x403d02
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x403d02
push 2
lea eax, [ebp - 0x194]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x403ce4
push str.Will_attempt_to_set_service_SID_n
call fcn.0040c2f0
add esp, 4
lea ecx, [ebp - 0x4c8]
push ecx
push 5
push esi
mov dword [ebp - 0x4c8], 1
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x403cdf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x194]
push edx
push str.ChangeServiceConfig2__S_SERVICE_CONFIG_SERVICE_SID_INFO_failed__x_n
call fcn.0040c2f0
add esp, 0xc
push esi
call ebx
jmp 0x403cff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x194]
push eax
push str.Failed_to_open_service__S_to_change_config__u_n
call fcn.0040c2f0
add esp, 0xc
push edi
call ebx
cmp dword [ebp - 0x4b8], 0
je 0x404ab1
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov byte [ebp - 0x4b9], 1
xor ebx, ebx
mov edi, edi
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..WGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x403d64
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..GlobalWGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x403d64
xor esi, esi
jmp 0x403d8a
test esi, esi
je 0x403d8a
cmp esi, 0xffffffff
je 0x403d8a
push 0
lea ecx, [ebp - 0x4c0]
push ecx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [ebp - 0x4b8]
lea edx, [ebp - 0x4b4]
push edx
push str.DisplayName
push eax
call fcn.004243b0
add esp, 0xc
test al, al
jne 0x403df8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x403de4
cmp ebx, 0xa
jge 0x403de4
push 0x3e8
add ebx, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x403d20
cmp esi, 0xffffffff
je 0x403d20
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403d20
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Warning:_unable_to_set_DisplayName__u_n
call fcn.0040c2f0
add esp, 8
test esi, esi
je 0x403e08
cmp esi, 0xffffffff
je 0x403e08
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x4cc]
test esi, esi
je 0x40408d
mov ebx, dword [ebp - 0x4dc]
test ebx, ebx
je 0x403f67
cmp word [ebx], 0x22
je 0x403ee0
mov ecx, ebx
push ecx
push str.__s_
call fcn.00422c00
add esp, 8
mov ebx, eax
xor edi, edi
call fcn.00401000
mov esi, eax
test esi, esi
je 0x403e6f
cmp esi, 0xffffffff
je 0x403e6f
push 0
lea edx, [ebp - 0x4c0]
push edx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [ebp - 0x4b8]
push ebx
push str.ImagePath
push eax
call fcn.00424400
add esp, 0xc
test al, al
jne 0x403ecc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x403eb8
cmp edi, 0xa
jge 0x403eb8
push 0x3e8
add edi, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x403e42
cmp esi, 0xffffffff
je 0x403e42
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403e42
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Warning:_unable_to_set_ImagePath__u_n
call fcn.0040c2f0
add esp, 8
push esi
call fcn.00401050
push ebx
call fcn.00420af0
add esp, 4
jmp 0x404087
xor edi, edi
call fcn.00401000
mov esi, eax
test esi, esi
je 0x403f0f
cmp esi, 0xffffffff
je 0x403f0f
push 0
lea ecx, [ebp - 0x4c0]
push ecx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edx, dword [ebp - 0x4b8]
push ebx
push str.ImagePath
push edx
call fcn.00424400
add esp, 0xc
test al, al
jne 0x404081
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40406d
cmp edi, 0xa
jge 0x40406d
push 0x3e8
add edi, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x403ee2
cmp esi, 0xffffffff
je 0x403ee2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403ee2
push 0xc8
lea eax, [ebp - 0x324]
push 0
push eax
call fcn.0042d860
mov edx, dword [ebp - 0x4b8]
push 0xc8
lea ecx, [ebp - 0x324]
push ecx
push str.ImagePath
push edx
call fcn.00424500
add esp, 0x1c
cmp word [ebp - 0x324], 0x5c
je 0x40408d
cmp word [ebp - 0x322], 0x3a
je 0x40408d
push str.system32drivers_
lea eax, [ebp - 0x324]
push 0xc8
push eax
call fcn.00421ac0
push esi
lea ecx, [ebp - 0x324]
push 0xc8
push ecx
call fcn.00421b60
add esp, 0x18
xor edi, edi
call fcn.00401000
mov esi, eax
push esi
call fcn.00401070
mov eax, dword [ebp - 0x4b8]
lea edx, [ebp - 0x324]
push edx
push str.ImagePath
push eax
call fcn.004243b0
add esp, 0xc
test al, al
jne 0x404081
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40406d
cmp edi, 0xa
jge 0x40406d
push 0x3e8
add edi, 1
call ebx
test esi, esi
je 0x40403f
cmp esi, 0xffffffff
je 0x40403f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00401000
mov esi, eax
push esi
call fcn.00401070
mov edx, dword [ebp - 0x4b8]
lea ecx, [ebp - 0x324]
push ecx
push str.ImagePath
push edx
call fcn.004243b0
add esp, 0xc
test al, al
je 0x404015
jmp 0x404081
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Warning:_unable_to_set_ImagePath__u_n
call fcn.0040c2f0
add esp, 8
push esi
call fcn.00401050
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ebx, ebx
nop
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..WGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4040d4
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..GlobalWGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4040d4
xor esi, esi
jmp 0x4040fa
test esi, esi
je 0x4040fa
cmp esi, 0xffffffff
je 0x4040fa
push 0
lea eax, [ebp - 0x4c0]
push eax
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x4b8]
push ecx
push str.Type
push edx
call fcn.00424390
add esp, 0xc
test al, al
jne 0x404165
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x404151
cmp ebx, 0xa
jge 0x404151
push 0x3e8
add ebx, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x404090
cmp esi, 0xffffffff
je 0x404090
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404090
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Warning:_unable_to_set_Type__u_n
call fcn.0040c2f0
add esp, 8
test esi, esi
je 0x404175
cmp esi, 0xffffffff
je 0x404175
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x4b8]
lea eax, [ebp - 0x4c1]
push eax
push str.DeleteFlag
push esi
mov byte [ebp - 0x4c1], 0
call fcn.004244a0
lea ecx, [ebp - 0x4c8]
push ecx
push str.Start
push esi
mov dword [ebp - 0x4c8], 3
call fcn.00424450
add esp, 0x18
test al, al
jne 0x4042a5
xor ebx, ebx
lea ecx, [ecx]
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..WGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x404204
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..GlobalWGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x404204
xor esi, esi
jmp 0x40422a
test esi, esi
je 0x40422a
cmp esi, 0xffffffff
je 0x40422a
push 0
lea edx, [ebp - 0x4c0]
push edx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x4b8]
push eax
push str.Start
push ecx
call fcn.00424390
add esp, 0xc
test al, al
jne 0x404295
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x404281
cmp ebx, 0xa
jge 0x404281
push 0x3e8
add ebx, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x4041c0
cmp esi, 0xffffffff
je 0x4041c0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4041c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Warning:_unable_to_set_Start__u_n
call fcn.0040c2f0
add esp, 8
test esi, esi
je 0x4042a5
cmp esi, 0xffffffff
je 0x4042a5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x4c1], 0
jne 0x4042c6
mov eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp + 0x18]
jle 0x4043b5
cmp eax, 4
je 0x4043b5
xor ebx, ebx
jmp 0x4042d0
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..WGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x404314
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..GlobalWGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x404314
xor esi, esi
jmp 0x40433a
test esi, esi
je 0x40433a
cmp esi, 0xffffffff
je 0x40433a
push 0
lea edx, [ebp - 0x4c0]
push edx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x4b8]
push eax
push str.Start
push ecx
call fcn.00424390
add esp, 0xc
test al, al
jne 0x4043a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x404391
cmp ebx, 0xa
jge 0x404391
push 0x3e8
add ebx, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x4042d0
cmp esi, 0xffffffff
je 0x4042d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4042d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Warning:_unable_to_set_Start__u_n
call fcn.0040c2f0
add esp, 8
test esi, esi
je 0x4043b5
cmp esi, 0xffffffff
je 0x4043b5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..WGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4043fb
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..GlobalWGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4043fb
xor esi, esi
jmp 0x404421
test esi, esi
je 0x404421
cmp esi, 0xffffffff
je 0x404421
push 0
lea edx, [ebp - 0x4c0]
push edx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x4b8]
push eax
push str.ErrorControl
push ecx
call fcn.00424390
add esp, 0xc
test al, al
jne 0x40448c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x404478
cmp ebx, 0xa
jge 0x404478
push 0x3e8
add ebx, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x4043b7
cmp esi, 0xffffffff
je 0x4043b7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4043b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Warning:_unable_to_set_ErrorControl__u_n
call fcn.0040c2f0
add esp, 8
test esi, esi
je 0x40449c
cmp esi, 0xffffffff
je 0x40449c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x4d0], 0
je 0x404587
xor ebx, ebx
jmp 0x4044b0
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..WGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4044f4
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..GlobalWGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4044f4
xor esi, esi
jmp 0x40451a
test esi, esi
je 0x40451a
cmp esi, 0xffffffff
je 0x40451a
push 0
lea edx, [ebp - 0x4c0]
push edx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [ebp - 0x4d0]
mov ecx, dword [ebp - 0x4b8]
push eax
push str.Group
push ecx
call fcn.004243b0
add esp, 0xc
test al, al
jne 0x4045a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x404574
cmp ebx, 0xa
jge 0x404574
push 0x3e8
add ebx, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x4044b0
cmp esi, 0xffffffff
je 0x4044b0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4044b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Warning:_unable_to_set_Group__u_n
call fcn.0040c2f0
jmp 0x4045a5
call fcn.00401000
mov esi, eax
push esi
call fcn.00401070
mov edx, dword [ebp - 0x4b8]
push str.Group
push edx
call fcn.00422f30
add esp, 8
test esi, esi
je 0x4045b8
cmp esi, 0xffffffff
je 0x4045b8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x24], 0
je 0x404698
xor ebx, ebx
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..WGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x404608
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..GlobalWGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x404608
xor esi, esi
jmp 0x40462e
test esi, esi
je 0x40462e
cmp esi, 0xffffffff
je 0x40462e
push 0
lea eax, [ebp - 0x4c0]
push eax
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp - 0x4b8]
push ecx
push 0x43f4a4
push edx
call fcn.00424390
add esp, 0xc
test al, al
jne 0x4046b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x404685
cmp ebx, 0xa
jge 0x404685
push 0x3e8
add ebx, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x4045c4
cmp esi, 0xffffffff
je 0x4045c4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4045c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Warning:_unable_to_set_Tag__u_n
call fcn.0040c2f0
jmp 0x4046b6
call fcn.00401000
mov esi, eax
push esi
call fcn.00401070
mov eax, dword [ebp - 0x4b8]
push 0x43f4a4
push eax
call fcn.00422f30
add esp, 8
test esi, esi
je 0x4046c9
cmp esi, 0xffffffff
je 0x4046c9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x4d4], 0
je 0x4047b4
xor ebx, ebx
jmp 0x4046e0
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..WGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x404724
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..GlobalWGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x404724
xor esi, esi
jmp 0x40474a
test esi, esi
je 0x40474a
cmp esi, 0xffffffff
je 0x40474a
push 0
lea ecx, [ebp - 0x4c0]
push ecx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edx, dword [ebp - 0x4d4]
mov eax, dword [ebp - 0x4b8]
push edx
push str.DependOnService
push eax
call fcn.00401a80
test al, al
jne 0x4047d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4047a1
cmp ebx, 0xa
jge 0x4047a1
push 0x3e8
add ebx, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x4046e0
cmp esi, 0xffffffff
je 0x4046e0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4046e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Warning:_unable_to_set_DependOnService__u_n
call fcn.0040c2f0
jmp 0x4047d2
call fcn.00401000
mov esi, eax
push esi
call fcn.00401070
mov ecx, dword [ebp - 0x4b8]
push str.DependOnService
push ecx
call fcn.00422f30
add esp, 8
test esi, esi
je 0x4047e5
cmp esi, 0xffffffff
je 0x4047e5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x4d8], 0
je 0x4048cb
xor ebx, ebx
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..WGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x404838
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..GlobalWGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x404838
xor esi, esi
jmp 0x40485e
test esi, esi
je 0x40485e
cmp esi, 0xffffffff
je 0x40485e
push 0
lea edx, [ebp - 0x4c0]
push edx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x4b8]
push eax
push str.Description
push ecx
call fcn.004243b0
add esp, 0xc
test al, al
jne 0x4048ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4048b8
cmp ebx, 0xa
jge 0x4048b8
push 0x3e8
add ebx, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x4047f4
cmp esi, 0xffffffff
je 0x4047f4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4047f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Warning:_unable_to_set_Description__u_n
call fcn.0040c2f0
jmp 0x4048e9
call fcn.00401000
mov esi, eax
push esi
call fcn.00401070
mov edx, dword [ebp - 0x4b8]
push str.Description
push edx
call fcn.00422f30
add esp, 8
test esi, esi
je 0x4048fc
cmp esi, 0xffffffff
je 0x4048fc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00401000
mov esi, eax
test esi, esi
je 0x404929
cmp esi, 0xffffffff
je 0x404929
push 0
lea eax, [ebp - 0x4c0]
push eax
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, dword [ebp - 0x4b8]
push str.DependOnGroup
push ebx
call fcn.00422f30
add esp, 8
test esi, esi
je 0x40494d
cmp esi, 0xffffffff
je 0x40494d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x14], 0x10
je 0x404970
call fcn.00401000
mov esi, eax
push esi
call fcn.00401070
push str.ObjectName
push ebx
call fcn.00422f30
jmp 0x404a45
xor ebx, ebx
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..WGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4049b6
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..GlobalWGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4049b6
xor esi, esi
jmp 0x4049dc
test esi, esi
je 0x4049dc
cmp esi, 0xffffffff
je 0x4049dc
push 0
lea ecx, [ebp - 0x4c0]
push ecx
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edx, dword [ebp - 0x4b8]
push str.LocalSystem
push str.ObjectName
push edx
call fcn.004243b0
add esp, 0xc
test al, al
jne 0x404a48
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x404a34
cmp ebx, 0xa
jge 0x404a34
push 0x3e8
add ebx, 1
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x404972
cmp esi, 0xffffffff
je 0x404972
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x404972
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Warning:_unable_to_set_ObjectName__u_n
call fcn.0040c2f0
add esp, 8
test esi, esi
je 0x404a58
cmp esi, 0xffffffff
je 0x404a58
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00401000
mov esi, eax
test esi, esi
je 0x404a85
cmp esi, 0xffffffff
je 0x404a85
push 0
lea eax, [ebp - 0x4c0]
push eax
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, dword [ebp - 0x4b8]
push str.DeleteFlag
push edi
call fcn.00422f30
add esp, 8
test esi, esi
je 0x404aa9
cmp esi, 0xffffffff
je 0x404aa9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00422c60
jmp 0x404abb
push str.Failed_to_get_serviceRegKey
call fcn.0040c2f0
mov ecx, dword [ebp - 0x4e0]
add esp, 4
push ecx
call fcn.00422c60
add esp, 4
cmp byte [ebp - 0x4b9], 0
pop ebx
jne 0x404aee
push str.ERROR:_Unable_to_update_registry._n
call fcn.0040c2f0
push str.ERROR:_Unable_to_update_registry._n
call fcn.0042e111
add esp, 8
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x4b9]
pop edi
xor ecx, ebp
pop esi
call fcn.0042d845
mov esp, ebp
pop ebp
ret 0x2c