Function at 0x41d99a
Capabilities:
Copy file
Create service
Get common file path
Modify service

Disassembly:
push ebp
lea ebp, [esp - 0xbc8]
sub esp, 0xc48
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp + 0xbc4], eax
mov eax, dword [ebp + 0xbd0]
push edi
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x7c]
xor edi, edi
push eax
mov dword [ebp - 0x7c], edi
call fcn.0041bf62
push 0xf003f
push edi
push edi
mov dword [ebp - 0x74], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x78], eax
cmp eax, edi
je 0x41dc85
push ebx
push esi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp + 0x5ac], ax
lea eax, [ebp + 0x5ae]
push edi
push eax
call fcn.00492200
add esp, 0xc
push 0x104
lea eax, [ebp + 0x5ac]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
push esi
mov word [ebp + 0x3a4], ax
lea eax, [ebp + 0x3a6]
push edi
push eax
call fcn.00492200
add esp, 0xc
call fcn.0045d92f
lea ebx, [esi + 2]
test eax, eax
je 0x41daf7
push str.SafeBoxProtect64.sys
lea eax, [ebp + 0x5ac]
push eax
push str.___sDrivers_s
lea eax, [ebp + 0x3a4]
push ebx
push eax
call fcn.0041d8b0
xor eax, eax
push esi
mov word [ebp + 0x9bc], ax
lea eax, [ebp + 0x9be]
push edi
push eax
call fcn.00492200
push dword [ebp - 0x70]
lea eax, [ebp + 0x9bc]
push str._sSafeBoxProtect64.sys
push 0x104
push eax
call fcn.0040c6cf
xor eax, eax
push esi
mov word [ebp + 0x7b4], ax
lea eax, [ebp + 0x7b6]
push edi
push eax
call fcn.00492200
lea eax, [ebp + 0x5ac]
push eax
push str._sDriversSafeBoxProtect64.sys
lea eax, [ebp + 0x7b4]
push 0x104
push eax
call fcn.0040c6cf
add esp, 0x4c
push edi
lea eax, [ebp + 0x7b4]
push eax
lea eax, [ebp + 0x9bc]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x41db8a
push str.copy_success
call fcn.004904a4
pop ecx
jmp 0x41db8a
push str.SafeBoxProtect.sys
push str.system32Drivers_s
lea eax, [ebp + 0x3a4]
push ebx
push eax
call fcn.0041d8b0
xor eax, eax
push esi
mov word [ebp + 0x7b4], ax
lea eax, [ebp + 0x7b6]
push edi
push eax
call fcn.00492200
push dword [ebp - 0x70]
lea eax, [ebp + 0x7b4]
push str._sSafeBoxProtect.sys
push 0x104
push eax
call fcn.0040c6cf
xor eax, eax
push esi
mov word [ebp + 0x9bc], ax
lea eax, [ebp + 0x9be]
push edi
push eax
call fcn.00492200
lea eax, [ebp + 0x5ac]
push eax
push str._sDriversSafeBoxProtect.sys
lea eax, [ebp + 0x9bc]
push 0x104
push eax
call fcn.0040c6cf
add esp, 0x48
push edi
lea eax, [ebp + 0x9bc]
push eax
lea eax, [ebp + 0x7b4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
xor eax, eax
push esi
mov word [ebp + 0x19c], ax
lea eax, [ebp + 0x19e]
push edi
push eax
call fcn.00492200
push str.SafeBoxProtect
push 0x4d8558
lea eax, [ebp + 0x19c]
push ebx
push eax
call fcn.0041d8b0
xor eax, eax
push esi
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x6a]
push edi
push eax
call fcn.00492200
push str._g_rg
push 0x4d8558
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.0041d8b0
add esp, 0x38
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp + 0x3a4]
push eax
push edi
push 1
push 1
mov esi, 0xf01ff
push esi
lea eax, [ebp + 0x19c]
push eax
mov ebx, str.SafeBoxProtect
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x70], eax
cmp eax, edi
jne 0x41dc50
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x70], eax
cmp eax, edi
je 0x41dc7a
lea ecx, [ebp + 0x19c]
push ecx
push edi
push edi
push edi
push edi
push edi
lea ecx, [ebp + 0x3a4]
push ecx
push edi
push 1
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 0x74], eax
jmp 0x41dc57
mov dword [ebp - 0x74], 1
cmp dword [ebp - 0x74], edi
je 0x41dc7a
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x80]
push eax
push 1
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebx
push dword [ebp - 0x7c]
call fcn.0041bf88
mov ecx, dword [ebp + 0xbc4]
mov eax, dword [ebp - 0x74]
xor ecx, ebp
pop edi
call fcn.0048c64c
add ebp, 0xbc8
leave
ret