Function at 0x401270
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
sub esp, 0x11c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push ebp
push esi
push edi
push 0x104
lea eax, [esp + 0x20]
xor edi, edi
push eax
push edi
xor bl, bl
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40144b
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
cmp ebp, edi
je 0x401436
push edi
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x30]
push ecx
push edi
push 2
push 0x10
push 0xf01ff
push str.NCR_Retail_Odometer
push str.NcrOdometer
push ebp
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
je 0x40133e
lea edx, [esp + 0x18]
push edx
push 1
push esi
mov dword [esp + 0x24], str.Loads_and_initializes_the_NCR_Persistent_Memory_DLL.
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
mov eax, dword [sym.imp.MSVCP90.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
push eax
push ecx
push str._installed_successfully.
push ecx
mov ecx, dword [sym.imp.MSVCP90.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push str.NCR_Retail_Odometer
push ecx
mov bl, 1
call fcn.00401bc0
add esp, 0xc
push eax
call fcn.00401bc0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40134e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x14], str.CreateService
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bl, bl
jne 0x40141d
mov edx, dword [sym.imp.MSVCP90.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
push edx
push ecx
push 0x4033bc
mov eax, dword [esp + 0x20]
push edi
push 0x401040
push 0x401020
push str.__0x
push edi
push section..text
push ecx
push str._failed__error
push ecx
push eax
push ecx
push str.
mov ecx, edx
mov edx, dword [sym.imp.MSVCP90.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push ecx
push str._installation_failed.
push ecx
push str.NCR_Retail_Odometer
push edx
call fcn.00401bc0
add esp, 0xc
push eax
call fcn.00401bc0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push eax
call fcn.00401bc0
add esp, 0xc
push eax
call fcn.00401bc0
add esp, 0xc
push eax
call fcn.00401bc0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00401bc0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.00401bc0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [esp + 0x128]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401d82
add esp, 0x11c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x14], str.OpenSCManager
jmp 0x40135d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x14], str.GetModuleFileName
jmp 0x40135d