Function at 0x413250
Capabilities:
Check os version
Modify service
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
mov eax, dword [0x43e044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x41353f
push 0xf01ff
push 0x43a198
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
je 0x413531
push 0x11c
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00422210
add esp, 0xc
lea ecx, [ebp - 0x128]
push ecx
mov dword [ebp - 0x128], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 6
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jb 0x4133a3
push str._Resume_Protect__Set_reTry_Action.
call fcn.00403790
mov eax, 1
mov dword [ebp - 0x628], eax
mov dword [ebp - 0x620], eax
mov eax, 0x3a98
mov dword [ebp - 0x61c], eax
mov dword [ebp - 0x614], eax
mov eax, 0x4301b4
add esp, 4
mov dword [ebp - 0x640], eax
mov dword [ebp - 0x63c], eax
lea eax, [ebp - 0x644]
push eax
push 2
lea edx, [ebp - 0x628]
push ebx
mov dword [ebp - 0x624], 0xea60
mov dword [ebp - 0x618], 0
mov dword [ebp - 0x644], 0x15180
mov dword [ebp - 0x638], 3
mov dword [ebp - 0x634], edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x4133a3
xor ecx, ecx
push 0xfe
push ecx
lea edx, [ebp - 0x106]
push edx
mov word [ebp - 0x108], cx
call fcn.00422210
add esp, 0xc
call esi
push eax
lea eax, [ebp - 0x108]
push 0x43af80
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x108]
add esp, 0xc
push ecx
call fcn.00403790
add esp, 4
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x60e]
push eax
mov word [ebp - 0x610], dx
call fcn.00422210
add esp, 0xc
mov dword [ebp - 0x630], 0
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [eax + str.SYSTEMCurrentControlSet_servicesWin_Win7]
mov word [ebp + eax - 0x610], cx
add eax, 2
test cx, cx
jne 0x4133d0
lea ecx, [ebp - 0x630]
push ecx
lea edx, [ebp - 0x62c]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x610]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41349e
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x20e]
push edx
mov word [ebp - 0x210], cx
call fcn.00422210
add esp, 0xc
push str._C:Program_FilesWW2017CFwmcSystem7.exe_
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0041c332
lea eax, [ebp - 0x210]
add esp, 0xc
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413460
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x62c]
push ecx
lea edx, [ebp - 0x210]
push edx
push 2
push 0
push 0x42f9d8
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x62c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x4134d3
push 0x43b040
call fcn.00403790
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
xor edx, edx
push 0x3fe
push edx
lea eax, [ebp - 0x406]
push eax
mov word [ebp - 0x408], dx
call fcn.00422210
add esp, 0xc
call esi
push eax
lea ecx, [ebp - 0x408]
push 0x43b080
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x408]
add esp, 0xc
push edx
call fcn.00403790
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a70e
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x43b0d0
jmp 0x413544
push str._Resume_Protect_
call fcn.00403790
mov ecx, dword [ebp - 4]
add esp, 4
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.0041a70e
mov esp, ebp
pop ebp
ret