Function at 0x40a020
Capabilities:
Check if file exists
Copy file
Create service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c7541
mov eax, dword fs:[0]
push eax
mov eax, 0x2270
call fcn.004939a0
mov eax, dword [0x50545c]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x227c], ecx
call fcn.0042f6d0
mov dword [ebp - 0x14b8], eax
cmp dword [ebp - 0x14b8], 0
je 0x40a07b
push 0
call fcn.0043cd80
add esp, 4
mov dword [ebp - 0x14bc], eax
lea eax, [ebp - 0x1f21]
mov dword [ebp - 0x1f20], eax
push 0
push 0
lea ecx, [ebp - 0x12a8]
call fcn.00410110
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x654]
call fcn.0040f6b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x654]
call fcn.0040f9f0
push 0x208
push 0
lea ecx, [ebp - 0xa6c]
push ecx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0x864]
push edx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x1084]
push eax
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0xe7c]
push ecx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0xc74]
push edx
call fcn.004931a0
add esp, 0xc
push str.NsHwafFs
push 0x104
lea eax, [ebp - 0xa6c]
push eax
call fcn.004943dd
add esp, 0xc
push str.NsHwafFs
push 0x104
lea ecx, [ebp - 0x864]
push ecx
call fcn.004943dd
add esp, 0xc
push str.NSFOCUS_MatrixPoint_File_Defence_Service
push 0x104
lea edx, [ebp - 0xe7c]
push edx
call fcn.004943dd
add esp, 0xc
push str.NsHwafFs.sys
push str.C:WindowsSystem32drivers_s
push 0x104
lea eax, [ebp - 0x1084]
push eax
call fcn.004943dd
add esp, 0x10
push str.NsHwafFs.sys
push str.C:Program_FilesEsafeNetCobra_DocGuard_ClientEstDeskTopdrivers_s
push 0x104
lea ecx, [ebp - 0xc74]
push ecx
call fcn.004943dd
add esp, 0x10
push 0
lea edx, [ebp - 0x1084]
push edx
lea eax, [ebp - 0xc74]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x65c], 1
mov dword [ebp - 0x658], 3
lea ecx, [ebp - 0x1084]
push ecx
lea ecx, [ebp - 0x654]
call fcn.0040f8d0
push 0x208
push 0
lea edx, [ebp - 0xa6c]
push edx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x864]
push eax
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0x1084]
push ecx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0xe7c]
push edx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc74]
push eax
call fcn.004931a0
add esp, 0xc
push str.NsAuditF
push 0x104
lea ecx, [ebp - 0xa6c]
push ecx
call fcn.004943dd
add esp, 0xc
push str.NsAuditF
push 0x104
lea edx, [ebp - 0x864]
push edx
call fcn.004943dd
add esp, 0xc
push str.Nsfocus_File_Audit_Driver
push 0x104
lea eax, [ebp - 0xe7c]
push eax
call fcn.004943dd
add esp, 0xc
push str.NsAuditF.sys
push str.C:WindowsSystem32drivers_s
push 0x104
lea ecx, [ebp - 0x1084]
push ecx
call fcn.004943dd
add esp, 0x10
push str.NsAuditF.sys
push str.C:Program_FilesEsafeNetCobra_DocGuard_ClientEstDeskTopdrivers_s
push 0x104
lea edx, [ebp - 0xc74]
push edx
call fcn.004943dd
add esp, 0x10
push 0
lea eax, [ebp - 0x1084]
push eax
lea ecx, [ebp - 0xc74]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x65c], 1
mov dword [ebp - 0x658], 3
lea edx, [ebp - 0x1084]
push edx
lea ecx, [ebp - 0x654]
call fcn.0040f8d0
push 0x208
push 0
lea eax, [ebp - 0xa6c]
push eax
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0x864]
push ecx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0x1084]
push edx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xe7c]
push eax
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0xc74]
push ecx
call fcn.004931a0
add esp, 0xc
push str.NsWafRegMon
push 0x104
lea edx, [ebp - 0xa6c]
push edx
call fcn.004943dd
add esp, 0xc
push str.NsWafRegMon
push 0x104
lea eax, [ebp - 0x864]
push eax
call fcn.004943dd
add esp, 0xc
push str.NSFOCUS_MatrixPoint_Reg_Defence_Service
push 0x104
lea ecx, [ebp - 0xe7c]
push ecx
call fcn.004943dd
add esp, 0xc
push str.NsWafRegMon.sys
push str.C:WindowsSystem32drivers_s
push 0x104
lea edx, [ebp - 0x1084]
push edx
call fcn.004943dd
add esp, 0x10
push str.NsWafRegMon.sys
push str.C:Program_FilesEsafeNetCobra_DocGuard_ClientEstDeskTopdrivers_s
push 0x104
lea eax, [ebp - 0xc74]
push eax
call fcn.004943dd
add esp, 0x10
push 0
lea ecx, [ebp - 0x1084]
push ecx
lea edx, [ebp - 0xc74]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x65c], 1
mov dword [ebp - 0x658], 3
lea eax, [ebp - 0x1084]
push eax
lea ecx, [ebp - 0x654]
call fcn.0040f8d0
push 0x208
push 0
lea ecx, [ebp - 0xa6c]
push ecx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0x864]
push edx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x1084]
push eax
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0xe7c]
push ecx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0xc74]
push edx
call fcn.004931a0
add esp, 0xc
push str.NsNdis
push 0x104
lea eax, [ebp - 0xa6c]
push eax
call fcn.004943dd
add esp, 0xc
push str.NsNdis
push 0x104
lea ecx, [ebp - 0x864]
push ecx
call fcn.004943dd
add esp, 0xc
push 0x4d1180
push 0x104
lea edx, [ebp - 0xe7c]
push edx
call fcn.004943dd
add esp, 0xc
push str.NsNdis.sys
push str.C:WindowsSystem32drivers_s
push 0x104
lea eax, [ebp - 0x1084]
push eax
call fcn.004943dd
add esp, 0x10
push str.NsNdis.sys
push str.C:Program_FilesEsafeNetCobra_DocGuard_ClientEstDeskTopdrivers_s
push 0x104
lea ecx, [ebp - 0xc74]
push ecx
call fcn.004943dd
add esp, 0x10
push 0
lea edx, [ebp - 0x1084]
push edx
lea eax, [ebp - 0xc74]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x65c], 1
mov dword [ebp - 0x658], 3
lea ecx, [ebp - 0x1084]
push ecx
lea ecx, [ebp - 0x654]
call fcn.0040f8d0
push 0x208
push 0
lea edx, [ebp - 0xa6c]
push edx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x864]
push eax
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0x1084]
push ecx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0xe7c]
push edx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xc74]
push eax
call fcn.004931a0
add esp, 0xc
push 0x4d4298
push 0x104
lea ecx, [ebp - 0xa6c]
push ecx
call fcn.004943dd
add esp, 0xc
push str.NetGroup_Packet_Filter_Driver
push 0x104
lea edx, [ebp - 0x864]
push edx
call fcn.004943dd
add esp, 0xc
push str.NetGroup_Packet_Filter_Driver
push 0x104
lea eax, [ebp - 0xe7c]
push eax
call fcn.004943dd
add esp, 0xc
push str.npf.sys
push str.C:WindowsSystem32drivers_s
push 0x104
lea ecx, [ebp - 0x1084]
push ecx
call fcn.004943dd
add esp, 0x10
push str.npf.sys
push str.C:Program_FilesEsafeNetCobra_DocGuard_ClientEstDeskTopdrivers_s
push 0x104
lea edx, [ebp - 0xc74]
push edx
call fcn.004943dd
add esp, 0x10
push 0
lea eax, [ebp - 0x1084]
push eax
lea ecx, [ebp - 0xc74]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x65c], 1
mov dword [ebp - 0x658], 1
lea edx, [ebp - 0x1084]
push edx
lea ecx, [ebp - 0x654]
call fcn.0040f8d0
push 0x208
push 0
lea eax, [ebp - 0xa6c]
push eax
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0x864]
push ecx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0x1084]
push edx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xe7c]
push eax
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0xc74]
push ecx
call fcn.004931a0
add esp, 0xc
push str.NsUsbFilter
push 0x104
lea edx, [ebp - 0xa6c]
push edx
call fcn.004943dd
add esp, 0xc
push str.NsUsbFilter
push 0x104
lea eax, [ebp - 0x864]
push eax
call fcn.004943dd
add esp, 0xc
push str.NSFOCUS_USB_Storage_Filter_Driver_Service
push 0x104
lea ecx, [ebp - 0xe7c]
push ecx
call fcn.004943dd
add esp, 0xc
push str.NsUsbFt.sys
push str.C:WindowsSystem32drivers_s
push 0x104
lea edx, [ebp - 0x1084]
push edx
call fcn.004943dd
add esp, 0x10
push str.NsUsbFt.sys
push str.C:Program_FilesEsafeNetCobra_DocGuard_ClientEstDeskTopdrivers_s
push 0x104
lea eax, [ebp - 0xc74]
push eax
call fcn.004943dd
add esp, 0x10
push 0
lea ecx, [ebp - 0x1084]
push ecx
lea edx, [ebp - 0xc74]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x65c], 1
mov dword [ebp - 0x658], 0
lea eax, [ebp - 0x1084]
push eax
lea ecx, [ebp - 0x654]
call fcn.0040f8d0
push 0x208
push 0
lea ecx, [ebp - 0xa6c]
push ecx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0x864]
push edx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x1084]
push eax
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0xe7c]
push ecx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0xc74]
push edx
call fcn.004931a0
add esp, 0xc
push str.NsEPSClient
push 0x104
lea eax, [ebp - 0xa6c]
push eax
call fcn.004943dd
add esp, 0xc
push str.NsEPSClient
push 0x104
lea ecx, [ebp - 0x864]
push ecx
call fcn.004943dd
add esp, 0xc
push str.NSFOCUS_MatrixPoint_Client_service
push 0x104
lea edx, [ebp - 0xe7c]
push edx
call fcn.004943dd
add esp, 0xc
push str.ClientFrame.exe
push str.C:Program_FilesEsafeNetCobra_DocGuard_ClientEstDeskTop_s
push 0x104
lea eax, [ebp - 0xc74]
push eax
call fcn.004943dd
add esp, 0x10
push str.ClientFrame.exe
push str.C:Program_FilesEsafeNetCobra_DocGuard_ClientEstDeskTop_s
push 0x104
lea ecx, [ebp - 0x1084]
push ecx
call fcn.004943dd
add esp, 0x10
mov dword [ebp - 0x65c], 0x110
mov dword [ebp - 0x658], 2
lea edx, [ebp - 0x1084]
push edx
lea ecx, [ebp - 0x654]
call fcn.0040f8d0
push 0x208
push 0
lea eax, [ebp - 0xa6c]
push eax
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0x864]
push ecx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0x1084]
push edx
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0xe7c]
push eax
call fcn.004931a0
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0xc74]
push ecx
call fcn.004931a0
add esp, 0xc
push str.NsEPSProtect
push 0x104
lea edx, [ebp - 0xa6c]
push edx
call fcn.004943dd
add esp, 0xc
push str.NsEPSProtect
push 0x104
lea eax, [ebp - 0x864]
push eax
call fcn.004943dd
add esp, 0xc
push str.NSFOCUS_MatrixPoint_Client_protect_service
push 0x104
lea ecx, [ebp - 0xe7c]
push ecx
call fcn.004943dd
add esp, 0xc
push str.EPSProtect.exe
push str.C:Program_FilesEsafeNetCobra_DocGuard_ClientEstDeskTop_s
push 0x104
lea edx, [ebp - 0xc74]
push edx
call fcn.004943dd
add esp, 0x10
push str.EPSProtect.exe
push str.C:Program_FilesEsafeNetCobra_DocGuard_ClientEstDeskTop_s
push 0x104
lea eax, [ebp - 0x1084]
push eax
call fcn.004943dd
add esp, 0x10
mov dword [ebp - 0x65c], 0x110
mov dword [ebp - 0x658], 2
lea ecx, [ebp - 0x1084]
push ecx
lea ecx, [ebp - 0x654]
call fcn.0040f8d0
cmp dword [ebp - 0x14b8], 0
je 0x40aa2c
push 1
call fcn.0043cd80
add esp, 4
mov dword [ebp - 0x14c0], eax
mov dword [ebp - 0x228], 0
lea edx, [ebp - 0x1f08]
push edx
lea ecx, [ebp - 0x654]
call fcn.0040f810
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
jmp 0x40aa87
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x2234], eax
mov dword [ebp - 0x2230], ecx
lea ecx, [ebp - 0x14]
call fcn.004106f0
mov edx, dword [ebp - 0x2234]
mov dword [ebp - 0x1f10], edx
mov eax, dword [ebp - 0x2230]
mov dword [ebp - 0x1f0c], eax
lea ecx, [ebp - 0x1f18]
push ecx
lea ecx, [ebp - 0x654]
call fcn.0040f870
push eax
lea ecx, [ebp - 0x14]
call fcn.0040fb50
movzx edx, al
test edx, edx
je 0x40ac17
lea ecx, [ebp - 0x14]
call fcn.0040fae0
mov ecx, 0x28c
mov esi, eax
lea edi, [ebp - 0x1efc]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14c4], 0
mov dword [ebp - 0x1f00], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x14c4], eax
cmp dword [ebp - 0x14c4], 0
jne 0x40aafb
jmp 0x40aa55
push 0xf01ff
lea eax, [ebp - 0x18e4]
push eax
mov ecx, dword [ebp - 0x14c4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x1f00], eax
cmp dword [ebp - 0x1f00], 0
jne 0x40abd2
lea edx, [ebp - 0x1efc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40ab3d
jmp 0x40aa55
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1efc]
push eax
push 0
mov ecx, dword [ebp - 0x14d0]
push ecx
mov edx, dword [ebp - 0x14d4]
push edx
push 0xf01ff
lea eax, [ebp - 0x16dc]
push eax
lea ecx, [ebp - 0x18e4]
push ecx
mov edx, dword [ebp - 0x14c4]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x1f00], eax
cmp dword [ebp - 0x1f00], 0
jne 0x40abd2
cmp dword [ebp - 0x1f00], 0
je 0x40abad
mov eax, dword [ebp - 0x1f00]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x1f00], 0
cmp dword [ebp - 0x14c4], 0
je 0x40abcd
mov ecx, dword [ebp - 0x14c4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x14c4], 0
jmp 0x40aa55
cmp dword [ebp - 0x1f00], 0
je 0x40abf2
mov edx, dword [ebp - 0x1f00]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x1f00], 0
cmp dword [ebp - 0x14c4], 0
je 0x40ac12
mov eax, dword [ebp - 0x14c4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x14c4], 0
jmp 0x40aa55
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x654]
call fcn.00410640
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x654]
mov dword [ebp - 0x2264], ecx
mov edx, dword [ebp - 0x2264]
push edx
call fcn.0044faf9
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x12a8]
call fcn.00410110
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0049318c
mov esp, ebp
pop ebp
ret