Function at 0x405ee0
Capabilities:
Create service
Delete service
Get common file path
Start service

Disassembly:
sub esp, 0x67c
mov eax, dword [0x45cefc]
xor eax, esp
mov dword [esp + 0x674], eax
push ebx
push ebp
push esi
push edi
push 0x103
lea eax, [esp + 0x265]
push 0
push eax
mov byte [esp + 0x26c], 0
call fcn.00423160
push 0x103
lea ecx, [esp + 0x481]
push 0
push ecx
mov byte [esp + 0x488], 0
call fcn.00423160
push 0x103
lea edx, [esp + 0x595]
push 0
push edx
mov byte [esp + 0x59c], 0
call fcn.00423160
push 0x103
lea eax, [esp + 0x391]
push 0
push eax
mov byte [esp + 0x398], 0
call fcn.00423160
add esp, 0x30
push 0x104
lea ecx, [esp + 0x36c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x368]
push edx
lea eax, [esp + 0x474]
push str._sLxUDisk.sys
push eax
call fcn.00425524
lea ecx, [esp + 0x374]
push ecx
lea edx, [esp + 0x588]
push str.._sLxUDisk64.sys
push edx
call fcn.00425524
add esp, 0x18
cmp dword [0x471cf4], 0
jne 0x405ffc
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x405ff2
push 0x471cf0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
jne 0x405ff2
mov dword [0x471cf0], eax
mov dword [0x471cf4], 1
cmp dword [0x471cf0], 0
lea ecx, [esp + 0x470]
je 0x406013
lea ecx, [esp + 0x578]
lea edx, [esp + 0x260]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x406020
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x406084
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.DRIVER_NOT_FOUND
push str.____hs___
push 0x474260
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [0x471a9c]
add esp, 0xc
push 0x10
push edx
push 0x474260
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 0x64
jmp 0x406162
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x4060d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40613a
push str.ADMIN_PRIVILEGES_DRIVER
push str.____hs___
push 0x474260
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [0x471a9c]
add esp, 0xc
push 0x10
push eax
jmp 0x40606d
push 0xf01ff
push str.truecrypt
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x406103
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call ebp
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x274]
push ecx
push 1
push 3
push 1
push 0xf01ff
push str.truecrypt
push str.truecrypt
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
jne 0x406141
push edi
call ebp
mov eax, 1
jmp 0x406162
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call ebp
push esi
call ebp
xor eax, eax
test ebx, ebx
sete al
mov ecx, dword [esp + 0x684]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00423893
add esp, 0x67c
ret