Function at 0x409390
Capabilities:
Check os version
Create service
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f50a
mov eax, dword fs:[0]
push eax
mov eax, 0x139c
call fcn.0040e970
mov eax, dword [0x41500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
push 0x410fb0
push 0
call fcn.004071a0
mov ecx, eax
call fcn.0040a8f0
lea eax, [ebp - 0x1340]
mov dword [ebp - 0x1340], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x409af7
cmp dword [ebp - 0x133c], 6
jl 0x409af7
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4094d0
lea eax, [ebp - 0xa18]
mov dword [ebp - 0xa1c], 0x400
mov dword [ebp - 0xa20], eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0xa20]
call fcn.0040a7b0
sub esp, 0x808
mov dword [ebp - 4], 1
mov edi, esp
lea eax, [ebp - 0x1228]
mov ecx, 0x202
lea esi, [ebp - 0xa20]
rep movsd dword es:[edi], dword [esi]
push str.GetModuleFileName
push eax
call fcn.004074f0
mov byte [ebp - 4], 2
add esp, 0x80c
push dword [eax]
push 2
call fcn.004071a0
mov ecx, eax
call fcn.0040a8f0
mov eax, dword [ebp - 0x1228]
lea ecx, [ebp - 0x1220]
cmp eax, ecx
je 0x4094ad
push eax
call fcn.0040dca4
add esp, 4
mov eax, dword [ebp - 0xa20]
lea ecx, [ebp - 0xa18]
cmp eax, ecx
je 0x4094c6
push eax
call fcn.0040dca4
add esp, 4
mov eax, 0x80004005
jmp 0x409b10
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x1368], eax
test eax, eax
jne 0x40954e
lea eax, [ebp - 0xa18]
mov dword [ebp - 0xa1c], 0x400
mov dword [ebp - 0xa20], eax
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0xa20]
call fcn.0040a7b0
sub esp, 0x808
mov dword [ebp - 4], 4
mov edi, esp
lea eax, [ebp - 0x1228]
mov ecx, 0x202
lea esi, [ebp - 0xa20]
rep movsd dword es:[edi], dword [esi]
push str.OpenSCManager
push eax
call fcn.004074f0
mov byte [ebp - 4], 5
jmp 0x40947e
mov dword [ebp - 0x136c], eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], 6
push ecx
push 1
push 3
push 0x10
push 0xf01ff
push str.TeraBoxUtility
push str.TeraBoxUtility
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
mov dword [ebp - 0x1364], esi
test esi, esi
jne 0x409654
lea eax, [ebp - 0xa18]
mov dword [ebp - 0xa1c], 0x400
mov dword [ebp - 0xa20], eax
mov byte [ebp - 4], 7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0xa20]
call fcn.0040a7b0
sub esp, 0x808
mov byte [ebp - 4], 8
mov edi, esp
lea eax, [ebp - 0x1228]
mov ecx, 0x202
lea esi, [ebp - 0xa20]
rep movsd dword es:[edi], dword [esi]
push str.CreateService
push eax
call fcn.004074f0
add esp, 0x80c
mov byte [ebp - 4], 9
push dword [eax]
push 2
call fcn.004071a0
mov ecx, eax
call fcn.0040a8f0
mov eax, dword [ebp - 0x1228]
lea ecx, [ebp - 0x1220]
cmp eax, ecx
je 0x409621
push eax
call fcn.0040dca4
add esp, 4
mov eax, dword [ebp - 0xa20]
lea ecx, [ebp - 0xa18]
cmp eax, ecx
je 0x40963a
push eax
call fcn.0040dca4
add esp, 4
push dword [ebp - 0x1368]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, 0x80004005
call edi
mov eax, esi
jmp 0x409b10
mov dword [ebp - 0x1370], esi
lea ecx, [ebp - 0x1344]
call fcn.00402d50
push str.TeraBox_Service_used_To_quickly_apply_for_disk_space
lea ecx, [ebp - 0x1344]
mov byte [ebp - 4], 0xb
call fcn.00401530
mov eax, dword [ebp - 0x1344]
cmp dword [eax - 4], 1
jle 0x409699
push dword [eax - 0xc]
lea ecx, [ebp - 0x1344]
call fcn.00401a80
mov eax, dword [ebp - 0x1344]
mov dword [ebp - 0x1358], eax
lea eax, [ebp - 0x1358]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push str.TeraBoxUtility
lea eax, [ebp - 0x1228]
push 0x4110dc
push eax
call fcn.004074f0
add esp, 8
mov byte [ebp - 4], 0xc
push dword [eax]
push 0
call fcn.004071a0
mov ecx, eax
call fcn.0040a8f0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1220]
mov eax, dword [ebp - 0x1228]
cmp eax, ecx
je 0x4096f9
push eax
call fcn.0040dca4
add esp, 4
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceObjectSecurity]
lea eax, [ebp - 0x1348]
push eax
push 0
lea eax, [ebp - 0x134c]
mov dword [ebp - 0x134c], 0
push eax
push 4
push esi
mov dword [ebp - 0x1348], 0
call edi
test eax, eax
jne 0x40976e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x40976e
lea ecx, [ebp - 0xa20]
call fcn.0040a880
sub esp, 0x808
mov byte [ebp - 4], 0xd
mov esi, eax
mov edi, esp
lea eax, [ebp - 0x1228]
mov ecx, 0x202
rep movsd dword es:[edi], dword [esi]
push 0x4110f8
push eax
call fcn.004074f0
mov byte [ebp - 4], 0xe
jmp 0x4097c8
push dword [ebp - 0x1348]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0x134c], ebx
test ebx, ebx
jne 0x40981a
lea ecx, [ebp - 0xa20]
call fcn.0040a880
sub esp, 0x808
mov byte [ebp - 4], 0xf
mov esi, eax
mov edi, esp
lea eax, [ebp - 0x1228]
mov ecx, 0x202
rep movsd dword es:[edi], dword [esi]
push 0x41113c
push eax
call fcn.004074f0
mov byte [ebp - 4], 0x10
add esp, 0x80c
push dword [eax]
push 2
call fcn.004071a0
mov ecx, eax
call fcn.0040a8f0
mov eax, dword [ebp - 0x1228]
lea ecx, [ebp - 0x1220]
cmp eax, ecx
je 0x4097f7
push eax
call fcn.0040dca4
add esp, 4
mov eax, dword [ebp - 0xa20]
lea ecx, [ebp - 0xa18]
cmp eax, ecx
je 0x409810
push eax
call fcn.0040dca4
add esp, 4
mov esi, 0x80004005
jmp 0x409abb
mov dword [ebp - 0x1374], ebx
lea eax, [ebp - 0x1348]
mov byte [ebp - 4], 0x11
push eax
push dword [ebp - 0x1348]
push ebx
push 4
push esi
call edi
test eax, eax
jne 0x409875
lea ecx, [ebp - 0xa20]
call fcn.0040a880
sub esp, 0x808
mov byte [ebp - 4], 0x12
mov esi, eax
mov edi, esp
lea eax, [ebp - 0x1228]
mov ecx, 0x202
rep movsd dword es:[edi], dword [esi]
push 0x4110f8
push eax
call fcn.004074f0
mov byte [ebp - 4], 0x13
jmp 0x409a5a
lea eax, [ebp - 0x135c]
mov dword [ebp - 0x1360], 0
push eax
lea eax, [ebp - 0x1350]
mov dword [ebp - 0x135c], 0
push eax
lea eax, [ebp - 0x1360]
mov dword [ebp - 0x1350], 0
push eax
push dword [ebp - 0x134c]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x4098f2
lea ecx, [ebp - 0xa20]
call fcn.0040a880
sub esp, 0x808
mov byte [ebp - 4], 0x14
mov esi, eax
mov edi, esp
lea eax, [ebp - 0x1228]
mov ecx, 0x202
rep movsd dword es:[edi], dword [esi]
push 0x411160
push eax
call fcn.004074f0
mov byte [ebp - 4], 0x15
jmp 0x409a5a
push 0
push 2
push 0x34
push str.USERS
lea eax, [ebp - 0x13a8]
mov dword [ebp - 0x1354], 0
push eax
call dword [sym.imp.ADVAPI32.dll_BuildExplicitAccessWithNameW]
lea eax, [ebp - 0x1354]
push eax
push dword [ebp - 0x1350]
lea eax, [ebp - 0x13a8]
push eax
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
je 0x40996e
lea ecx, [ebp - 0xa20]
call fcn.0040a880
sub esp, 0x808
mov byte [ebp - 4], 0x16
mov esi, eax
mov edi, esp
lea eax, [ebp - 0x1228]
mov ecx, 0x202
rep movsd dword es:[edi], dword [esi]
push str.SetEntriesInAcl
push eax
call fcn.004074f0
mov byte [ebp - 4], 0x17
jmp 0x409a5a
push 1
lea eax, [ebp - 0x1388]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x4099bb
lea ecx, [ebp - 0xa20]
call fcn.0040a880
sub esp, 0x808
mov byte [ebp - 4], 0x18
mov esi, eax
mov edi, esp
lea eax, [ebp - 0x1228]
mov ecx, 0x202
rep movsd dword es:[edi], dword [esi]
push 0x4111d8
push eax
call fcn.004074f0
mov byte [ebp - 4], 0x19
jmp 0x409a5a
push 0
push dword [ebp - 0x1354]
lea eax, [ebp - 0x1388]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x409a0d
lea ecx, [ebp - 0xa20]
call fcn.0040a880
sub esp, 0x808
mov byte [ebp - 4], 0x1a
mov esi, eax
mov edi, esp
lea eax, [ebp - 0x1228]
mov ecx, 0x202
rep movsd dword es:[edi], dword [esi]
push 0x411220
push eax
call fcn.004074f0
mov byte [ebp - 4], 0x1b
jmp 0x409a5a
lea eax, [ebp - 0x1388]
push eax
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_SetServiceObjectSecurity]
test eax, eax
jne 0x409aa9
lea ecx, [ebp - 0xa20]
call fcn.0040a880
sub esp, 0x808
mov byte [ebp - 4], 0x1c
mov esi, eax
mov edi, esp
lea eax, [ebp - 0x1228]
mov ecx, 0x202
rep movsd dword es:[edi], dword [esi]
push 0x411260
push eax
call fcn.004074f0
mov byte [ebp - 4], 0x1d
add esp, 0x80c
push dword [eax]
push 2
call fcn.004071a0
mov ecx, eax
call fcn.0040a8f0
mov eax, dword [ebp - 0x1228]
lea ecx, [ebp - 0x1220]
cmp eax, ecx
je 0x409a89
push eax
call fcn.0040dca4
add esp, 4
mov eax, dword [ebp - 0xa20]
lea ecx, [ebp - 0xa18]
cmp eax, ecx
je 0x409aa2
push eax
call fcn.0040dca4
add esp, 4
mov esi, 0x80004005
jmp 0x409aab
xor esi, esi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebp - 4], 0xa
or eax, 0xffffffff
mov edi, dword [ebp - 0x1344]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x409add
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
push dword [ebp - 0x1364]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push dword [ebp - 0x1368]
call edi
mov eax, esi
jmp 0x409b10
push ecx
push 0x410fc8
push 0
call fcn.004071a0
mov ecx, eax
call fcn.0040a8f0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040d7a5
mov esp, ebp
pop ebp
ret