Function at 0x40f7b5
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x459310]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 0x3c
mov eax, 0x43e27a
call fcn.0043bc87
mov edi, ecx
call fcn.0040f6e2
test eax, eax
je 0x40f7ec
xor eax, eax
inc eax
jmp 0x40faa3
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
call esi
cmp dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], eax
jne 0x40f887
lea ecx, [ebp - 0x10]
call fcn.00419470
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], ebx
call fcn.0041a530
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.004195a0
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push str.Unable_to_open_service_control_manager._System_error:___d___s
push eax
call fcn.0041b950
add esp, 0x10
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.00419480
lea ecx, [ebp - 0x10]
call fcn.004195a0
push eax
push 1
push 0x121
push str..NBService.cpp
push 0x4593c0
call fcn.0040e4bd
or dword [ebp - 4], 0xffffffff
add esp, 0x14
lea ecx, [ebp - 0x10]
call fcn.00419480
xor eax, eax
jmp 0x40faa3
push 0x208
lea eax, [ebp + 2]
push ebx
push eax
mov word [ebp], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push ebx
push str.RPCSS
push ebx
push ebx
lea eax, [edi + 0x30]
lea ecx, [ebp]
push ecx
xor edi, edi
inc edi
push edi
push 2
push 0x10
push 0xf01ff
push eax
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x1c], eax
call esi
cmp dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], eax
jne 0x40f948
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [ebp - 0x10]
call fcn.00419470
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], 2
call fcn.0041a530
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004195a0
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push str.Unable_to_create_service._System_error:___d___s
push eax
call fcn.0041b950
add esp, 0x10
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00419480
lea ecx, [ebp - 0x10]
call fcn.004195a0
push eax
push edi
push 0x134
jmp 0x40f862
lea eax, [ebp - 0x24]
push eax
push edi
push dword [ebp - 0x1c]
mov dword [ebp - 0x24], str.Nero_BackItUp_Scheduler_4.0_is_responsible_to_control_all_jobs_created_using_Nero_BackItUp._These_jobs_can_create_backups_of_selected_files_folders_partitions_or_complete_hard_disk_to_hard_disk__network_drive__disc_or_FTP.
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x40f9dc
call esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], eax
call fcn.00419470
push dword [ebp - 0x14]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 4], 4
call fcn.0041a530
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.004195a0
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push str.Updating_service_description_has_failed._System_error:___d___s
push eax
call fcn.0041b950
add esp, 0x10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.00419480
lea ecx, [ebp - 0x18]
call fcn.004195a0
push eax
push edi
push 0x145
push str..NBService.cpp
push 0x4593c0
call fcn.0040e4bd
or dword [ebp - 4], 0xffffffff
add esp, 0x14
lea ecx, [ebp - 0x18]
call fcn.00419480
mov dword [ebp - 0x34], edi
xor eax, eax
lea edi, [ebp - 0x44]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x48]
push eax
push 2
push dword [ebp - 0x1c]
xor edi, edi
inc edi
mov dword [ebp - 0x30], 0x1f4
mov dword [ebp - 0x48], 0x15180
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x40fa91
call esi
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.00419470
lea eax, [ebp - 0x2c]
push esi
push eax
mov dword [ebp - 4], 6
call fcn.0041a530
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.004195a0
push eax
push esi
lea eax, [ebp - 0x20]
push 0x4458c8
push eax
call fcn.0041b950
add esp, 0x10
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.00419480
lea ecx, [ebp - 0x20]
call fcn.004195a0
push eax
push edi
push 0x159
push str..NBService.cpp
push 0x4593c0
call fcn.0040e4bd
or dword [ebp - 4], 0xffffffff
add esp, 0x14
lea ecx, [ebp - 0x20]
call fcn.00419480
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.0043bc78
add ebp, 0x210
leave
ret