Function at 0x417370
Capabilities:
Check os version
Modify service
Query service status
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x684
mov eax, dword [0x447044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 2
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x66c], edi
cmp edi, esi
je 0x4176c6
push 0xf01ff
push 0x441c88
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
cmp ebx, esi
je 0x41769f
push 0x11c
lea eax, [ebp - 0x128]
push esi
push eax
call fcn.004272d0
add esp, 0xc
lea ecx, [ebp - 0x128]
push ecx
mov dword [ebp - 0x128], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 6
jb 0x4174b1
push str._Terminate_Protect__Clear_reTry_Action.
call fcn.004042f0
mov eax, 0x435474
add esp, 4
mov dword [ebp - 0x67c], eax
mov dword [ebp - 0x678], eax
lea eax, [ebp - 0x680]
push eax
push 2
lea edx, [ebp - 0x628]
push ebx
mov dword [ebp - 0x628], esi
mov dword [ebp - 0x624], esi
mov dword [ebp - 0x620], esi
mov dword [ebp - 0x61c], esi
mov dword [ebp - 0x618], esi
mov dword [ebp - 0x614], esi
mov dword [ebp - 0x680], esi
mov dword [ebp - 0x674], 3
mov dword [ebp - 0x670], edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x4174b1
push 0xfe
lea edx, [ebp - 0x106]
xor ecx, ecx
push esi
push edx
mov word [ebp - 0x108], cx
call fcn.004272d0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x108]
push str._Terminate_Protect__Set_Actions_Result_0x_X_.
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x108]
add esp, 0xc
push ecx
call fcn.004042f0
add esp, 4
push 0x206
lea eax, [ebp - 0x60e]
xor edx, edx
push esi
push eax
mov word [ebp - 0x610], dx
call fcn.004272d0
add esp, 0xc
mov dword [ebp - 0x668], esi
xor eax, eax
jmp 0x4174e0
movzx ecx, word [eax + str.SYSTEMCurrentControlSet_servicesWin_Win7]
mov word [ebp + eax - 0x610], cx
add eax, 2
cmp cx, si
jne 0x4174e0
lea ecx, [ebp - 0x668]
push ecx
lea edx, [ebp - 0x664]
push edx
push esi
push 0xf003f
push esi
push esi
push esi
lea eax, [ebp - 0x610]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4175a1
push 0x206
lea edx, [ebp - 0x20e]
xor ecx, ecx
push esi
push edx
mov word [ebp - 0x210], cx
call fcn.004272d0
add esp, 0xc
push str._C:Program_FilesWW2017CFwmcSystem7X.exe_
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.004211f0
lea eax, [ebp - 0x210]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x417564
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x664]
push ecx
lea edx, [ebp - 0x210]
push edx
push 2
push esi
push 0x434a48
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x664]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f2
lea eax, [ebp - 0x406]
xor edx, edx
push esi
push eax
mov word [ebp - 0x408], dx
call fcn.004272d0
add esp, 0xc
lea ecx, [ebp - 0x660]
push ecx
push 0xc8
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call edi
lea edx, [ebp - 0x644]
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x640], 1
je 0x417664
inc esi
push esi
lea eax, [ebp - 0x408]
push 0x4428d0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x408]
add esp, 0xc
push ecx
call fcn.004042f0
add esp, 4
cmp esi, 0xa
je 0x41766b
cmp dword [ebp - 0x640], 3
je 0x41763f
lea edx, [ebp - 0x660]
push edx
push 0xc8
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x41765b
lea eax, [ebp - 0x408]
push str._Terminate_Protect__SERVICE_STOP_PENDING
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
push 0xbb8
call edi
cmp esi, 0xa
jle 0x4175d8
push 0x442970
jmp 0x417670
push 0x4429b8
call fcn.004042f0
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [ebp - 0x66c]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041f53e
mov esp, ebp
pop ebp
ret
push str._Terminate_Protect__Open_Win_Win7_Fail.
call fcn.004042f0
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041f53e
mov esp, ebp
pop ebp
ret
push str._Terminate_Protect_
call fcn.004042f0
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.0041f53e
mov esp, ebp
pop ebp
ret