Function at 0x407030
Capabilities:
Check os version
Create service
Modify service

Disassembly:
sub esp, 0xb2c
mov eax, dword [0x421e94]
xor eax, esp
mov dword [esp + 0xb28], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push ebp
push esi
push edi
push 0xf003f
xor edi, edi
push edi
push edi
mov ebp, ecx
call ebx
mov esi, eax
test esi, esi
je 0x407093
push 1
lea eax, [ebp + 0x40]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x40707e
push eax
mov edi, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x407093
mov eax, 1
jmp 0x407137
push 0x104
lea ecx, [esp + 0x132]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x407135
cmp eax, 0x104
je 0x407135
mov edx, 0x22
mov word [esp + 0x12c], dx
mov ecx, edx
xor edx, edx
push 0xf003f
push edx
push edx
mov word [esp + eax*2 + 0x13a], cx
mov word [esp + eax*2 + 0x13c], dx
call ebx
mov ebx, eax
test ebx, ebx
jne 0x407150
push 0x400
lea eax, [esp + 0x33c]
push eax
push 0xd80a
call fcn.00406320
add esp, 0xc
test eax, eax
jne 0x40711f
push str.Could_not_open_Service_Manager
lea ecx, [esp + 0x33c]
push 0x400
push ecx
call fcn.00406240
add esp, 0xc
push 0
add ebp, 0x40
push ebp
lea edx, [esp + 0x340]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [esp + 0xb38]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040dd76
add esp, 0xb2c
ret
push 0
push 0
push str.RPCSS
push 0
push 0
lea eax, [esp + 0x140]
push eax
push 1
push 3
push 0x10
push 0xf01ff
add ebp, 0x40
push ebp
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
jne 0x4071d1
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x400
lea ecx, [esp + 0x33c]
push ecx
push 0xd80b
call fcn.00406320
add esp, 0xc
test eax, eax
jne 0x4071c1
push str.Could_not_create_service
lea edx, [esp + 0x33c]
push 0x400
push edx
call fcn.00406240
add esp, 0xc
push 0
push ebp
lea eax, [esp + 0x340]
push eax
jmp 0x40712d
push 0x41b738
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
lea ecx, [esp + 0x10]
push ecx
push 1
push esi
mov dword [esp + 0x1c], 0x41b738
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push 0x114
lea edx, [esp + 0x1c]
push 0
push edx
call fcn.0040e3e0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x1c], 6
mov edi, 1
jne 0x40729b
lea ecx, [esp + 0x14]
push ecx
push 5
push esi
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov edi, eax
test edi, edi
jne 0x40729b
push 0x400
lea edx, [esp + 0x33c]
push edx
push 0xd80b
call fcn.00406320
add esp, 0xc
test eax, eax
jne 0x407288
push str.Intel_R__ICCS___setting_per_service_SID_failed__n
lea eax, [esp + 0x33c]
push 0x400
push eax
call fcn.00406240
add esp, 0xc
push 0
push ebp
lea ecx, [esp + 0x340]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov eax, edi
jmp 0x407137