Function at 0x40288e
Capabilities:
Add user account
Create service
Delete directory
Delete file
Enumerate files on windows
Get common file path
Get file attributes
Modify service
Persist via windows service
Set file attributes
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d296a
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2684
call fcn.0045f530
mov eax, dword [0x4fa654]
xor eax, esp
mov dword [esp + 0x2680], eax
push ebx
push esi
push edi
mov eax, dword [0x4fa654]
xor eax, esp
push eax
lea eax, [esp + 0x2698]
mov dword fs:[0], eax
xor esi, esi
xor eax, eax
mov dword [esp + 0x64], 7
mov dword [esp + 0x60], esi
mov word [esp + 0x50], ax
lea eax, [esp + 0x68c]
push eax
push 0x1000
mov dword [esp + 0x26a8], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40294e
lea eax, [esp + 0x68c]
push eax
lea eax, [esp + 0xfc]
push eax
call fcn.00404c84
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x100]
lea ecx, [esp + 0x58]
mov byte [esp + 0x26a8], 1
call fcn.00405528
push 1
xor edi, edi
lea esi, [esp + 0xfc]
mov byte [esp + 0x26a4], 0
call fcn.00401198
mov esi, str.UpdatusInstall.log
push esi
call fcn.00447827
pop ecx
mov edi, eax
push esi
lea eax, [esp + 0x54]
call fcn.0040594f
push 8
pop ebx
push ebx
call fcn.00447c3b
pop ecx
mov dword [esp + 0x20], eax
mov byte [esp + 0x26a0], 2
test eax, eax
je 0x402998
mov ecx, dword [esp + 0x50]
cmp dword [esp + 0x64], ebx
jae 0x40298e
lea ecx, [esp + 0x50]
push ecx
mov esi, eax
call fcn.00401000
jmp 0x40299a
xor eax, eax
mov byte [esp + 0x26a0], 0
mov dword [esp + 0x14], eax
mov byte [esp + 0x26a0], 3
mov ecx, dword [0x4ff46c]
mov dword [0x4ff46c], eax
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x14]
mov byte [esp + 0x26a0], 0
call fcn.00405403
lea eax, [esp + 0xdc]
push eax
call fcn.004018c2
pop ecx
mov byte [esp + 0x26a0], 4
cmp dword [eax + 0x14], ebx
jb 0x4029eb
mov eax, dword [eax]
mov ecx, dword [0x4ff46c]
push eax
push str.Daemon_type:__s
call fcn.0040102f
pop ecx
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0xe0]
mov byte [esp + 0x26a4], 0
call fcn.00401198
or dword [esp + 0x26a0], 0xffffffff
push 1
lea esi, [esp + 0x54]
call fcn.00401198
xor eax, eax
push 0x208
push eax
mov word [esp + 0x484], ax
lea eax, [esp + 0x486]
push eax
call fcn.00447b70
add esp, 0xc
push 0x105
lea eax, [esp + 0x480]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x402ab7
lea eax, [esp + 0xdc]
push eax
call fcn.00420059
pop ecx
mov dword [esp + 0x26a0], 5
cmp dword [eax + 0x14], ebx
jb 0x402a81
mov eax, dword [eax]
mov ecx, dword [0x4ff46c]
push eax
push str.Unable_to_GetModuleFileName:__s
call fcn.0040102f
or dword [esp + 0x26a8], 0xffffffff
pop ecx
xor ebx, ebx
pop ecx
inc ebx
push ebx
xor edi, edi
lea esi, [esp + 0xe0]
call fcn.00401198
mov dword [esp + 0x10], ebx
jmp 0x403b13
mov ecx, dword [0x4ff46c]
push str.Opening_SC_manager...
call fcn.0040102f
pop ecx
push 3
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [esp + 0x28], eax
cmp eax, esi
jne 0x402b1b
lea eax, [esp + 0xdc]
push eax
call fcn.00420059
pop ecx
push 6
pop ebx
mov dword [esp + 0x26a0], ebx
cmp dword [eax + 0x14], 8
jb 0x402afc
mov eax, dword [eax]
mov ecx, dword [0x4ff46c]
push eax
push str.OpenSCManager_failed:__s
call fcn.0040102f
or dword [esp + 0x26a8], 0xffffffff
pop ecx
pop ecx
push 1
jmp 0x402aa0
push 0x100b6
push str.nvUpdatusService
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [esp + 0x18], eax
cmp eax, esi
je 0x402b59
push eax
call fcn.00402681
pop ecx
mov dword [esp + 0x10], eax
cmp eax, esi
je 0x402b59
mov ecx, dword [0x4ff46c]
push str.StopService_failed
call fcn.0040102f
pop ecx
jmp 0x403af8
mov ecx, dword [0x4ff46c]
push str.Installing_COM...
call fcn.0040102f
push 7
pop eax
xor ecx, ecx
mov dword [esp + 0x68], eax
mov dword [esp + 0x64], esi
mov word [esp + 0x54], cx
mov dword [esp + 0x26a4], eax
lea eax, [esp + 0x54]
push eax
call fcn.0041e757
pop ecx
pop ecx
test al, al
jne 0x402bc5
push 1
or dword [esp + 0x26a4], 0xffffffff
xor edi, edi
lea esi, [esp + 0x54]
call fcn.00401198
mov ecx, dword [0x4ff46c]
push str.Unable_to_register_COM_object
call fcn.0040102f
pop ecx
mov dword [esp + 0x10], 0xd
jmp 0x403af8
push str._RegServer
lea eax, [esp + 0xfc]
push eax
call fcn.00404c84
push str.ComUpdatus.exe
lea ebx, [esp + 0xe0]
lea ecx, [esp + 0x54]
mov byte [esp + 0x26a4], 8
call fcn.00404d08
lea ecx, [esp + 0xf8]
push ecx
lea edx, [esp + 0x54]
mov ecx, eax
mov byte [esp + 0x26a4], 9
call fcn.0040248e
xor ebx, ebx
pop ecx
inc ebx
push ebx
xor edi, edi
lea esi, [esp + 0xe0]
mov dword [esp + 0x18], eax
mov byte [esp + 0x26a4], 8
call fcn.00401198
push ebx
lea esi, [esp + 0xfc]
mov byte [esp + 0x26a4], 7
call fcn.00401198
cmp dword [esp + 0x14], edi
je 0x402c6f
mov esi, dword [0x4ff46c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [esp + 0x18]
mov ecx, esi
push str.Failed_to_call_ComUpdatus.exe__RegServer:_code_d__lastError_u
call fcn.0040102f
add esp, 0xc
push ebx
jmp 0x402b94
or dword [esp + 0x26a0], 0xffffffff
push ebx
xor edi, edi
lea esi, [esp + 0x54]
call fcn.00401198
xor eax, eax
mov dword [esp + 0xd4], 7
mov dword [esp + 0xd0], edi
mov word [esp + 0xc0], ax
lea ecx, [esp + 0xc0]
mov dword [esp + 0x26a0], 0xa
call fcn.0040901e
test al, al
jne 0x402cd8
mov ecx, dword [0x4ff46c]
push str.Unable_to_compute_working_path
call fcn.0040102f
pop ecx
mov dword [esp + 0x10], 0xe
jmp 0x403ae1
lea eax, [esp + 0xc0]
call fcn.0041e4e3
mov esi, 0x4def44
test al, al
je 0x4031ae
and dword [esp + 0x108], 0
xor eax, eax
mov dword [esp + 0x10c], 7
mov word [esp + 0xf8], ax
push esi
lea eax, [esp + 0x54]
push eax
mov byte [esp + 0x26a8], 0xb
call fcn.00404c84
lea eax, [esp + 0xf8]
push eax
lea eax, [esp + 0x54]
push eax
mov byte [esp + 0x26a8], 0xc
call fcn.004097e2
pop ecx
pop ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], eax
push ebx
xor edi, edi
lea esi, [esp + 0x54]
mov byte [esp + 0x26a4], 0xe
call fcn.00401198
cmp dword [esp + 0x14], edi
je 0x402d8f
lea eax, [esp + 0xc0]
push eax
call fcn.0041f2bf
pop ecx
test al, al
je 0x403179
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0xc0]
push eax
call fcn.0041ed5e
pop ecx
test al, al
jne 0x403179
mov ecx, dword [0x4ff46c]
push str.Cleaning_working_directory...
call fcn.0040102f
cmp dword [esp + 0xd8], 8
mov eax, dword [esp + 0xc4]
pop ecx
jae 0x402db8
lea eax, [esp + 0xc0]
and dword [esp + 0x98], edi
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0x9c], 7
mov word [esp + 0x88], ax
push dword [esp + 0x10]
lea eax, [esp + 0xe0]
push eax
mov byte [esp + 0x26a8], 0xf
call fcn.00404c84
push 0xffffffffffffffff
push 0
lea eax, [esp + 0xe4]
lea ecx, [esp + 0x90]
mov byte [esp + 0x26a8], 0x10
call fcn.00405528
push ebx
xor edi, edi
lea esi, [esp + 0xe0]
mov byte [esp + 0x26a4], 0xf
call fcn.00401198
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x403162
cmp dword [esp + 0x9c], 8
mov eax, dword [esp + 0x88]
jae 0x402e4e
lea eax, [esp + 0x88]
lea eax, [eax + ecx*2]
cmp word [eax - 2], 0x5c
je 0x402e73
mov esi, 0x4e0ca0
push esi
call fcn.00447827
pop ecx
mov edi, eax
push esi
lea eax, [esp + 0x8c]
call fcn.0040594f
xor ecx, ecx
cmp dword [esp + 0x98], ecx
jbe 0x402ec6
cmp dword [esp + 0x9c], 8
mov eax, dword [esp + 0x88]
jae 0x402e96
lea eax, [esp + 0x88]
cmp word [eax + ecx*2], 0x2f
jne 0x402ebc
cmp dword [esp + 0x9c], 8
mov eax, dword [esp + 0x88]
jae 0x402eb5
lea eax, [esp + 0x88]
push 0x5c
pop edx
mov word [eax + ecx*2], dx
inc ecx
cmp ecx, dword [esp + 0x98]
jb 0x402e7e
lea eax, [esp + 0x88]
push eax
lea esi, [esp + 0x54]
call fcn.00401874
mov esi, 0x4e5458
push esi
mov byte [esp + 0x26a4], 0x11
call fcn.00447827
pop ecx
mov edi, eax
push esi
lea eax, [esp + 0x54]
call fcn.0040594f
push 0x250
lea eax, [esp + 0x230]
push 0
push eax
call fcn.00447b70
mov eax, dword [esp + 0x5c]
add esp, 0xc
cmp dword [esp + 0x64], 8
jae 0x402f1d
lea eax, [esp + 0x50]
lea ecx, [esp + 0x22c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x24], eax
cmp eax, 0xffffffff
jne 0x402fd6
push ebx
xor edi, edi
lea esi, [esp + 0x54]
mov byte [esp + 0x26a4], 0xf
call fcn.00401198
push ebx
lea esi, [esp + 0x8c]
mov byte [esp + 0x26a4], 0xe
call fcn.00401198
lea eax, [esp + 0xdc]
push eax
call fcn.00420059
pop ecx
mov byte [esp + 0x26a0], 0x13
cmp dword [eax + 0x14], 8
jb 0x402f80
mov eax, dword [eax]
mov ecx, dword [0x4ff46c]
push eax
push str.Failed_to_delete_the_working_directory_owned_by_a_wrong_user:__s
call fcn.0040102f
pop ecx
pop ecx
push ebx
xor edi, edi
lea esi, [esp + 0xe0]
mov byte [esp + 0x26a4], 0xe
call fcn.00401198
mov byte [esp + 0x26a0], 0xb
mov dword [esp + 0x10], 0xe
cmp dword [esp + 0x14], edi
je 0x402fca
push dword [esp + 0x14]
call fcn.004477a1
pop ecx
lea esi, [esp + 0xf8]
jmp 0x403ad1
lea eax, [esp + 0x88]
push eax
lea esi, [esp + 0x70]
call fcn.00401874
lea eax, [esp + 0x258]
push eax
mov byte [esp + 0x26a4], 0x12
call fcn.00447827
pop ecx
lea ecx, [esp + 0x258]
mov edi, eax
push ecx
mov eax, esi
call fcn.0040594f
test byte [esp + 0x22c], 0x10
je 0x40305c
lea eax, [esp + 0x258]
push 0x4def40
push eax
call fcn.00448a0a
pop ecx
pop ecx
test eax, eax
je 0x4030e0
lea eax, [esp + 0x258]
push 0x4e0ca8
push eax
call fcn.00448a0a
pop ecx
pop ecx
test eax, eax
je 0x4030e0
mov eax, esi
call fcn.0041f34a
jmp 0x4030e0
mov eax, dword [esp + 0x6c]
push 8
pop edi
cmp dword [esp + 0x80], edi
jae 0x403070
lea eax, [esp + 0x6c]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
test eax, eax
jne 0x4030e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4030e0
mov eax, dword [esp + 0x6c]
cmp dword [esp + 0x80], edi
jae 0x403099
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [esp + 0x6c]
cmp dword [esp + 0x80], edi
jae 0x4030b1
lea ecx, [esp + 0x6c]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x403221
mov eax, dword [esp + 0x6c]
cmp dword [esp + 0x80], edi
jae 0x4030d5
lea eax, [esp + 0x6c]
push eax
call esi
test eax, eax
je 0x403221
push ebx
xor edi, edi
lea esi, [esp + 0x70]
mov byte [esp + 0x26a4], 0x11
call fcn.00401198
lea eax, [esp + 0x22c]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402fd6
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edi
call esi
test eax, eax
jne 0x40314e
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x402f39
push edi
call esi
test eax, eax
je 0x402f39
push ebx
xor edi, edi
lea esi, [esp + 0x54]
mov byte [esp + 0x26a4], 0xf
call fcn.00401198
push ebx
xor edi, edi
lea esi, [esp + 0x8c]
mov byte [esp + 0x26a4], 0xe
call fcn.00401198
mov byte [esp + 0x26a0], 0xb
cmp dword [esp + 0x14], 0
je 0x403192
push dword [esp + 0x14]
call fcn.004477a1
pop ecx
push ebx
xor edi, edi
lea esi, [esp + 0xfc]
mov byte [esp + 0x26a4], 0xa
call fcn.00401198
mov esi, 0x4def44
mov ecx, dword [0x4ff46c]
push str.Creating_user...
call fcn.0040102f
xor eax, eax
pop ecx
mov dword [esp + 0xb8], 7
mov dword [esp + 0xb4], edi
mov word [esp + 0xa4], ax
lea ecx, [esp + 0xa4]
mov byte [esp + 0x26a0], 0x14
call fcn.0040a2ad
test al, al
jne 0x40323a
mov ecx, dword [0x4ff46c]
push str.generatePassword_failed
call fcn.0040102f
pop ecx
mov ecx, dword [0x4ff46c]
push str.CreateUser_failed
call fcn.0040102f
mov dword [esp + 0x14], 7
jmp 0x403ac9
push ebx
xor edi, edi
lea esi, [esp + 0x70]
mov byte [esp + 0x26a4], 0x11
call fcn.00401198
jmp 0x402f39
cmp dword [esp + 0xb8], 8
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x2c], esi
jae 0x403256
lea eax, [esp + 0xa4]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x30]
push eax
push ebx
push edi
mov dword [esp + 0x48], ebx
mov dword [esp + 0x54], 0x10001
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x44], ebx
mov dword [esp + 0x58], edi
call dword [sym.imp.NETAPI32.dll_NetUserAdd]
mov dword [esp + 0x10], eax
cmp eax, edi
je 0x4033d6
cmp eax, 0x8b0
je 0x4032ed
mov ecx, eax
lea esi, [esp + 0x88]
call fcn.00401cc3
mov byte [esp + 0x26a0], 0x15
cmp dword [eax + 0x14], 8
jb 0x4032b9
mov eax, dword [eax]
push dword [esp + 0x10]
mov ecx, dword [0x4ff46c]
push eax
push str.NetUserAdd_call_failed_with_code__s___lu_
call fcn.0040102f
lea esi, [esp + 0x94]
add esp, 0xc
xor edi, edi
push ebx
mov byte [esp + 0x26a4], 0x14
call fcn.00401198
jmp 0x403204
mov ecx, dword [0x4ff46c]
push str.User_already_exists__trying_to_reset_password...
call fcn.0040102f
pop ecx
lea eax, [esp + 0x14]
push eax
push ebx
push esi
push edi
call dword [sym.imp.NETAPI32.dll_NetUserGetInfo]
mov dword [esp + 0x10], eax
cmp eax, edi
je 0x403350
mov ecx, eax
lea esi, [esp + 0x210]
call fcn.00401cc3
mov byte [esp + 0x26a0], 0x16
cmp dword [eax + 0x14], 8
jb 0x403332
mov eax, dword [eax]
push dword [esp + 0x10]
mov ecx, dword [0x4ff46c]
push eax
push str.NetUserGetInfo_call_failed_with_code__s___lu_
call fcn.0040102f
lea esi, [esp + 0x21c]
jmp 0x4032d5
cmp dword [esp + 0xb8], 8
mov eax, dword [esp + 0xa4]
jae 0x403368
lea eax, [esp + 0xa4]
mov ecx, dword [esp + 0x14]
mov dword [ecx + 4], eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x18]
push ebx
push esi
push edi
call dword [sym.imp.NETAPI32.dll_NetUserSetInfo]
push dword [esp + 0x14]
mov dword [esp + 0x14], eax
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
cmp dword [esp + 0x10], edi
je 0x4033d6
mov ecx, dword [esp + 0x10]
lea esi, [esp + 0x184]
call fcn.00401cc3
mov byte [esp + 0x26a0], 0x17
cmp dword [eax + 0x14], 8
jb 0x4033b5
mov eax, dword [eax]
push dword [esp + 0x10]
mov ecx, dword [0x4ff46c]
push eax
push str.NetUserSetInfo_call_failed_with_code__s___lu_
call fcn.0040102f
lea esi, [esp + 0x190]
jmp 0x4032d5
and dword [esp + 0x7c], 0
xor eax, eax
mov dword [esp + 0x80], 7
mov word [esp + 0x6c], ax
push 0x4def44
lea eax, [esp + 0xe0]
push eax
mov byte [esp + 0x26a8], 0x18
call fcn.00404c84
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0xe0]
push eax
mov byte [esp + 0x26a8], 0x19
call fcn.004097e2
pop ecx
pop ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x4c], eax
push ebx
xor edi, edi
lea esi, [esp + 0xe0]
mov byte [esp + 0x26a4], 0x1b
call fcn.00401198
cmp dword [esp + 0x10], edi
jne 0x403476
cmp dword [esp + 0x80], 8
mov eax, dword [esp + 0x6c]
jae 0x40345a
lea eax, [esp + 0x6c]
mov ecx, dword [0x4ff46c]
push eax
push str.Failed_to_lookup_SID_of_UpdatusUser._Error:__s
call fcn.0040102f
pop ecx
pop ecx
lea esi, [esp + 0x6c]
jmp 0x4032d8
push dword [esp + 0x10]
mov eax, str.SeServiceLogonRight
call fcn.00401eb7
pop ecx
test al, al
jne 0x4034e4
lea eax, [esp + 0x1bc]
push eax
call fcn.00420059
pop ecx
mov byte [esp + 0x26a0], 0x1c
cmp dword [eax + 0x14], 8
jb 0x4034a7
mov eax, dword [eax]
mov ecx, dword [0x4ff46c]
push eax
push str.Failed_to_add_logon_privilege_to_UpdatusUser._Last_error_description:__s
call fcn.0040102f
lea esi, [esp + 0x1c4]
pop ecx
pop ecx
push ebx
xor edi, edi
mov byte [esp + 0x26a4], 0x1b
call fcn.00401198
push dword [esp + 0x10]
mov byte [esp + 0x26a4], 0x18
call fcn.004477a1
jmp 0x40346c
push dword [esp + 0x10]
mov eax, str.SeDenyInteractiveLogonRight
call fcn.00401eb7
pop ecx
test al, al
jne 0x40352f
lea eax, [esp + 0x168]
push eax
call fcn.00420059
pop ecx
mov byte [esp + 0x26a0], 0x1d
cmp dword [eax + 0x14], 8
jb 0x403515
mov eax, dword [eax]
mov ecx, dword [0x4ff46c]
push eax
push str.Failed_to_add_SE_DENY_INTERACTIVE_LOGON_NAME_privilege_to_UpdatusUser._Last_error_description:__s
call fcn.0040102f
lea esi, [esp + 0x170]
jmp 0x4034bf
push dword [esp + 0x10]
mov eax, str.SeAssignPrimaryTokenPrivilege
call fcn.00401eb7
pop ecx
test al, al
jne 0x40357d
lea eax, [esp + 0x1f4]
push eax
call fcn.00420059
pop ecx
mov byte [esp + 0x26a0], 0x1e
cmp dword [eax + 0x14], 8
jb 0x403560
mov eax, dword [eax]
mov ecx, dword [0x4ff46c]
push eax
push str.Failed_to_add_SE_ASSIGNPRIMARYTOKEN_NAME_privilege_to_UpdatusUser._Last_error_description:__s
call fcn.0040102f
lea esi, [esp + 0x1fc]
jmp 0x4034bf
push str.SeRestorePrivilege
lea eax, [esp + 0xfc]
push eax
call fcn.00404c84
lea edi, [esp + 0xf8]
mov byte [esp + 0x26a0], 0x1f
call fcn.0041f237
neg al
sbb al, al
inc al
push ebx
xor edi, edi
lea esi, [esp + 0xfc]
mov byte [esp + 0x23], al
mov byte [esp + 0x26a4], 0x1b
call fcn.00401198
cmp byte [esp + 0x1f], 0
je 0x403606
lea eax, [esp + 0x1a0]
push eax
call fcn.00420059
pop ecx
mov byte [esp + 0x26a0], 0x20
cmp dword [eax + 0x14], 8
jb 0x4035e9
mov eax, dword [eax]
mov ecx, dword [0x4ff46c]
push eax
push str.SetThreadPrivilege_failed._Last_error_description:__s
call fcn.0040102f
lea esi, [esp + 0x1a8]
jmp 0x4034bf
push dword [esp + 0x10]
call fcn.00401f2b
pop ecx
test al, al
jne 0x40364f
lea eax, [esp + 0x130]
push eax
call fcn.00420059
pop ecx
mov byte [esp + 0x26a0], 0x21
cmp dword [eax + 0x14], 8
jb 0x403632
mov eax, dword [eax]
mov ecx, dword [0x4ff46c]
push eax
push str.Failed_to_reset_registry_permissions._Last_error_description:__s
call fcn.0040102f
lea esi, [esp + 0x138]
jmp 0x4034bf
and dword [esp + 0x60], edi
xor eax, eax
mov dword [esp + 0x64], 7
mov word [esp + 0x50], ax
lea eax, [esp + 0x50]
push eax
mov byte [esp + 0x26a4], 0x22
call fcn.0041e757
pop ecx
test al, al
jne 0x4036aa
push ebx
xor edi, edi
lea esi, [esp + 0x54]
mov byte [esp + 0x26a4], 0x1b
call fcn.00401198
cmp byte [0x4ff45a], 0
je 0x4034d1
push str.Failed_to_set_permissions_for_COM_object_n
call fcn.00447aa4
pop ecx
jmp 0x4034d1
lea eax, [esp + 0x114]
push str._RegUpdatus
push eax
call fcn.0041d00d
mov esi, eax
lea eax, [esp + 0x154]
push 0x4df17c
push eax
mov byte [esp + 0x26b0], 0x23
call fcn.0041d00d
add esp, 0x10
push eax
lea eax, [esp + 0x1dc]
push eax
lea eax, [esp + 0x58]
push eax
mov byte [esp + 0x26ac], 0x24
call fcn.00404cc7
push esi
lea edx, [esp + 0x54]
mov ecx, eax
mov byte [esp + 0x26a4], 0x25
call fcn.0040248e
pop ecx
push ebx
xor edi, edi
lea esi, [esp + 0x1dc]
mov dword [esp + 0x28], eax
mov byte [esp + 0x26a4], 0x24
call fcn.00401198
push ebx
lea esi, [esp + 0x150]
mov byte [esp + 0x26a4], 0x23
call fcn.00401198
push ebx
lea esi, [esp + 0x118]
mov byte [esp + 0x26a4], 0x22
call fcn.00401198
cmp dword [esp + 0x24], edi
je 0x40377b
mov esi, dword [0x4ff46c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [esp + 0x28]
mov ecx, esi
push str.Failed_to_call_ComUpdatus.exe__RegUpdatus:_runProcess___d__lastError___d
call fcn.0040102f
add esp, 0xc
jmp 0x403679
push ebx
xor edi, edi
lea esi, [esp + 0x54]
mov byte [esp + 0x26a4], 0x1b
call fcn.00401198
lea ecx, [esp + 0xa4]
call fcn.004022ae
test al, al
jne 0x4037c5
mov ecx, dword [0x4ff46c]
push str.Failed_to_tune_user
call fcn.0040102f
push dword [esp + 0x14]
mov byte [esp + 0x26a8], 0x18
call fcn.004477a1
jmp 0x40346b
push dword [esp + 0x10]
mov byte [esp + 0x26a4], 0x18
call fcn.004477a1
pop ecx
push ebx
xor edi, edi
lea esi, [esp + 0x70]
mov byte [esp + 0x26a4], 0x14
call fcn.00401198
mov ecx, dword [0x4ff46c]
xor esi, esi
cmp dword [esp + 0x18], esi
jne 0x4038de
push str.Creating_service...
call fcn.0040102f
cmp dword [esp + 0xbc], 8
mov eax, dword [esp + 0xa8]
pop ecx
jae 0x403820
lea eax, [esp + 0xa4]
push eax
push str..UpdatusUser
push 0x4ff458
push esi
push esi
lea eax, [esp + 0x490]
push eax
push ebx
push 2
push 0x10
push 0x96
push str.NVIDIA_Update_Service_Daemon
push str.nvUpdatusService
push dword [esp + 0x58]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [esp + 0x18], eax
cmp eax, esi
jne 0x403923
lea eax, [esp + 0x114]
push eax
call fcn.00420059
pop ecx
mov byte [esp + 0x26a0], 0x26
cmp dword [eax + 0x14], 8
jb 0x40387d
mov eax, dword [eax]
mov ecx, dword [0x4ff46c]
push eax
push str.Create_Service_failed:__s
call fcn.0040102f
pop ecx
pop ecx
push ebx
xor edi, edi
lea esi, [esp + 0x118]
mov byte [esp + 0x26a4], 0x14
call fcn.00401198
push ebx
lea esi, [esp + 0xa8]
mov dword [esp + 0x14], 4
mov byte [esp + 0x26a4], 0xa
call fcn.00401198
or dword [esp + 0x26a0], 0xffffffff
push ebx
lea esi, [esp + 0xc4]
call fcn.00401198
jmp 0x403b09
push str.Retuning_existing_service...
call fcn.0040102f
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x480]
push eax
lea edx, [esp + 0xac]
call fcn.0040274a
pop ecx
pop ecx
test al, al
jne 0x403923
mov ecx, dword [0x4ff46c]
push str.ReTune_service_failed
call fcn.0040102f
mov dword [esp + 0x14], 4
jmp 0x403ac9
mov ecx, dword [0x4ff46c]
push str.Tuning_service...
call fcn.0040102f
pop ecx
lea eax, [esp + 0x20]
push eax
push ebx
push dword [esp + 0x20]
mov dword [esp + 0x2c], str.NVIDIA_Settings_Update_Manager_service__used_to_check_new_updates_from_NVIDIA_server.
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
cmp eax, esi
jne 0x40399a
lea eax, [esp + 0x114]
push eax
call fcn.00420059
pop ecx
mov byte [esp + 0x26a0], 0x27
cmp dword [eax + 0x14], 8
jb 0x40396e
mov eax, dword [eax]
mov ecx, dword [0x4ff46c]
push eax
push str.Set_the_description_of_the_service_failed:__s
call fcn.0040102f
pop ecx
pop ecx
push ebx
xor edi, edi
lea esi, [esp + 0x118]
mov byte [esp + 0x26a4], 0x14
call fcn.00401198
xor esi, esi
mov ecx, dword [0x4ff46c]
push str.Registering_daemon_in_firewall...
call fcn.0040102f
pop ecx
call fcn.0040a5ef
mov ecx, dword [0x4ff46c]
test al, al
jne 0x4039d1
push str.Failed_to_create_firewall_control
call fcn.0040102f
mov dword [esp + 0x14], 2
jmp 0x403ac9
push str.Service_installed__now_starting_it...
call fcn.0040102f
pop ecx
push esi
push esi
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
cmp eax, esi
jne 0x403a41
lea eax, [esp + 0x114]
push eax
call fcn.00420059
pop ecx
mov byte [esp + 0x26a0], 0x28
cmp dword [eax + 0x14], 8
jb 0x403a0a
mov eax, dword [eax]
mov ecx, dword [0x4ff46c]
push eax
push str.Failed_to_start_the_service:__s
call fcn.0040102f
pop ecx
pop ecx
push ebx
xor edi, edi
lea esi, [esp + 0x118]
mov byte [esp + 0x26a4], 0x14
call fcn.00401198
mov dword [esp + 0x10], 2
jmp 0x403aca
mov esi, dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [0x4ff438], 2
mov edi, 0x4ff434
jmp 0x403a78
cmp dword [0x4ff438], 2
jne 0x403a85
push 0x4dfa50
call fcn.00447aa4
mov dword [esp], 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push 4
push dword [esp + 0x20]
call esi
test eax, eax
jne 0x403a58
push 0x4dfa54
call fcn.00447aa4
cmp dword [0x4ff438], 4
pop ecx
je 0x403ab4
lea eax, [esp + 0x114]
push eax
call fcn.00420059
pop ecx
mov byte [esp + 0x26a0], 0x29
jmp 0x403a02
mov ecx, dword [0x4ff46c]
push str.Service_installed_and_start_successfully.
call fcn.0040102f
and dword [esp + 0x14], 0
pop ecx
lea esi, [esp + 0xa4]
push ebx
xor edi, edi
mov byte [esp + 0x26a4], 0xa
call fcn.00401198
or dword [esp + 0x26a0], 0xffffffff
push ebx
xor edi, edi
lea esi, [esp + 0xc4]
call fcn.00401198
cmp dword [esp + 0x18], 0
je 0x403b09
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x2698]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2680]
xor ecx, esp
call fcn.004466c5
mov esp, ebp
pop ebp
ret