Function at 0x417950
Capabilities:
Check os version
Modify service
Query service status
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x684
mov eax, dword [0x448044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 2
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x66c], edi
cmp edi, esi
je 0x417ca6
push 0xf01ff
push 0x442c08
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
cmp ebx, esi
je 0x417c7f
push 0x11c
lea eax, [ebp - 0x128]
push esi
push eax
call fcn.004279d0
add esp, 0xc
lea ecx, [ebp - 0x128]
push ecx
mov dword [ebp - 0x128], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 6
jb 0x417a91
push str._Terminate_Protect__Clear_reTry_Action.
call fcn.004042f0
mov eax, 0x436474
add esp, 4
mov dword [ebp - 0x67c], eax
mov dword [ebp - 0x678], eax
lea eax, [ebp - 0x680]
push eax
push 2
lea edx, [ebp - 0x628]
push ebx
mov dword [ebp - 0x628], esi
mov dword [ebp - 0x624], esi
mov dword [ebp - 0x620], esi
mov dword [ebp - 0x61c], esi
mov dword [ebp - 0x618], esi
mov dword [ebp - 0x614], esi
mov dword [ebp - 0x680], esi
mov dword [ebp - 0x674], 3
mov dword [ebp - 0x670], edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x417a91
push 0xfe
lea edx, [ebp - 0x106]
xor ecx, ecx
push esi
push edx
mov word [ebp - 0x108], cx
call fcn.004279d0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x108]
push str._Terminate_Protect__Set_Actions_Result_0x_X_.
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x108]
add esp, 0xc
push ecx
call fcn.004042f0
add esp, 4
push 0x206
lea eax, [ebp - 0x60e]
xor edx, edx
push esi
push eax
mov word [ebp - 0x610], dx
call fcn.004279d0
add esp, 0xc
mov dword [ebp - 0x668], esi
xor eax, eax
jmp 0x417ac0
movzx ecx, word [eax + str.SYSTEMCurrentControlSet_servicesWin_Win7]
mov word [ebp + eax - 0x610], cx
add eax, 2
cmp cx, si
jne 0x417ac0
lea ecx, [ebp - 0x668]
push ecx
lea edx, [ebp - 0x664]
push edx
push esi
push 0xf003f
push esi
push esi
push esi
lea eax, [ebp - 0x610]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x417b81
push 0x206
lea edx, [ebp - 0x20e]
xor ecx, ecx
push esi
push edx
mov word [ebp - 0x210], cx
call fcn.004279d0
add esp, 0xc
push str._C:Program_FilesWW2017CFwmcSystem7X.exe_
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.004217d0
lea eax, [ebp - 0x210]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x417b44
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x664]
push ecx
lea edx, [ebp - 0x210]
push edx
push 2
push esi
push 0x435a48
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x664]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f2
lea eax, [ebp - 0x406]
xor edx, edx
push esi
push eax
mov word [ebp - 0x408], dx
call fcn.004279d0
add esp, 0xc
lea ecx, [ebp - 0x660]
push ecx
push 0xc8
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call edi
lea edx, [ebp - 0x644]
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x640], 1
je 0x417c44
inc esi
push esi
lea eax, [ebp - 0x408]
push 0x443850
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x408]
add esp, 0xc
push ecx
call fcn.004042f0
add esp, 4
cmp esi, 0xa
je 0x417c4b
cmp dword [ebp - 0x640], 3
je 0x417c1f
lea edx, [ebp - 0x660]
push edx
push 0xc8
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x417c3b
lea eax, [ebp - 0x408]
push str._Terminate_Protect__SERVICE_STOP_PENDING
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
push 0xbb8
call edi
cmp esi, 0xa
jle 0x417bb8
push 0x4438f0
jmp 0x417c50
push 0x443938
call fcn.004042f0
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [ebp - 0x66c]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret
push str._Terminate_Protect__Open_Win_Win7_Fail.
call fcn.004042f0
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret
push str._Terminate_Protect_
call fcn.004042f0
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret