Function at 0x457170
Capabilities:
Create service
Delete service
Query service configuration
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4a8800]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
push 0xf003f
push 0
push 0
mov dword [ebp - 0x20], 0
movdqu xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [edi + 0x108], eax
test eax, eax
je 0x4573d0
push 0
push 0
push 0
push 0
push 0
push edi
push 1
push 3
push 1
push 0xf01ff
push str.RDMSR_Executor_Driver
push 0x4818d4
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x10c], eax
cmp dword [edi + 0x10c], 0
jne 0x4572f3
call ebx
cmp eax, 5
je 0x4572dc
lea ecx, [eax - 0x430]
cmp ecx, 1
ja 0x4572ca
push 0xf01ff
push 0x4818d4
push dword [edi + 0x108]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [edi + 0x10c], eax
cmp dword [edi + 0x10c], 0
jne 0x457253
call ebx
push eax
push str.Error_opening_service:__d_n
push 1
call fcn.00456a40
add esp, 0xc
jmp 0x4572e6
lea eax, [ebp - 0x28]
push eax
mov eax, dword [edi + 0x10c]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
call ebx
cmp eax, 0x7a
jne 0x4572bf
mov esi, dword [ebp - 0x28]
push esi
push 1
call fcn.0045d5e9
add esp, 8
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [edi + 0x10c]
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
push dword [ebp - 0x24]
test eax, eax
jne 0x4572af
call fcn.0045a5bb
add esp, 4
call ebx
push eax
push str.Error_query_service_config_adjusted_buffer_:__d_n
jmp 0x4573de
call fcn.0045a5bb
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 4
jmp 0x4572e6
push eax
push str.Error_query_service_config:__d_n
jmp 0x4573de
push eax
push str.Create_driver_service_failed:__d_n
push 1
call fcn.00456a40
add esp, 0xc
jmp 0x4572e6
mov dword [edi + 0x128], 0xfffffff6
cmp dword [edi + 0x10c], 0
je 0x4573e8
mov eax, dword [edi + 0x10c]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x457355
lea eax, [ebp - 0x20]
push eax
mov eax, dword [edi + 0x10c]
push 4
push eax
call fcn.00457460
add esp, 0xc
test eax, eax
jne 0x45735e
push str.Driver_load_failed._n
push 1
call fcn.00456a40
mov eax, dword [edi + 0x10c]
add esp, 8
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_DeleteService]
call eax
push dword [edi + 0x108]
call esi
mov dword [edi + 0x10c], 0
jmp 0x4573e8
call ebx
cmp eax, 0x420
jne 0x4573c6
push str.Driver_already_running._n
push 1
call fcn.00456a40
add esp, 8
push dword [edi + 0x108]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
push 0x40000000
push 3
push 0
push 3
push 0xc0000000
push str..GlobalTmpRdr
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0
push 1
push 0
mov dword [edi + 0x110], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0x124], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045b1f5
mov esp, ebp
pop ebp
ret
push str.Driver_start_failed._n
jmp 0x457326
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push eax
push str.Open_SCM_failed:__d_n
push 1
call fcn.00456a40
add esp, 0xc
mov eax, dword [edi + 0x108]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x457405
push eax
call esi
mov dword [edi + 0x108], 0
cmp dword [edi + 0x10c], 0
je 0x457444
mov eax, dword [edi + 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x457431
call ebx
push eax
push str.Delete_driver_service_failed:__d_n
push 1
call fcn.00456a40
add esp, 0xc
mov eax, dword [edi + 0x10c]
push eax
call esi
mov dword [edi + 0x10c], 0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045b1f5
mov esp, ebp
pop ebp
ret