Function at 0x402cd0
Capabilities:
Create service
Modify service
Persist via windows service
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x447004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x830], ebx
push esi
push edi
mov edi, edx
test ebx, ebx
jne 0x402cf8
xor esi, esi
jmp 0x402d0f
mov esi, ebx
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x402d00
sub esi, ecx
sar esi, 1
cmp word [ebx], 0x22
je 0x402dd3
push 0x20
push ebx
call fcn.004260a5
add esp, 8
test eax, eax
je 0x402dd3
lea eax, [esi*2 + 4]
mov dword [ebp - 0x82c], eax
cmp eax, 0x800
jb 0x402d62
push esi
push str.Path_to_service_is_too_long___u_.
push 0
push edi
call fcn.0041bc20
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425576
mov esp, ebp
pop ebp
ret
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402d67
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x808]
push ebx
push eax
call fcn.00426ea0
mov eax, 0x22
add esi, esi
push esi
mov word [ebp - 0x808], ax
lea eax, [ebp - 0x806]
push ebx
push eax
call fcn.00426ea0
mov eax, 0x22
add esp, 0x18
mov word [ebp + esi - 0x806], ax
xor ecx, ecx
mov eax, dword [ebp - 0x82c]
mov word [ebp + eax - 0x808], cx
lea eax, [ebp - 0x808]
mov dword [ebp - 0x830], eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x82c], eax
test eax, eax
jne 0x402e3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, 0xa0
test esi, esi
cmove esi, eax
test edi, edi
je 0x402e28
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x402e18
mov edx, dword [ecx]
mov eax, dword [edx]
add eax, ecx
push eax
mov eax, dword [edx + 4]
call eax
add esp, 4
mov ecx, esi
mov dword [edi], 0x19
call fcn.0041b480
mov dword [edi + 4], eax
xor esi, esi
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00425576
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x814]
push eax
push 0x20219
push 0
push str.SoftwareCleverFilesDisk_Drill
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x402eeb
mov esi, dword [ebp - 0x814]
lea eax, [ebp - 0x80c]
xor ecx, ecx
xor edx, edx
test esi, esi
mov ebx, esi
cmove eax, ecx
test eax, eax
je 0x402f46
mov dword [ebp - 0x814], ecx
mov dword [ebp - 0x834], 4
test esi, esi
je 0x402f73
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x814]
push eax
push ecx
push str.switchedOn
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402f68
cmp dword [ebp - 0x814], 4
jne 0x402f68
cmp eax, dword [ebp - 0x80c]
push ebx
sbb eax, eax
neg eax
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402f75
mov ecx, dword [0x4478b4]
lea edx, [ebp - 0x810]
mov dword [ebp - 0x810], 0
mov dword [ebp - 0x80c], 0
push edx
mov eax, dword [ecx]
add eax, 0x4478b4
push 0xc
push eax
mov eax, dword [ecx + 4]
call eax
xor edx, edx
add esp, 0xc
test eax, eax
cmovne edx, dword [ebp - 0x810]
test edx, edx
jne 0x402f34
mov edx, 0x4479a8
jmp 0x402f44
mov dword [edx + 8], 0
mov dword [edx + 4], esi
mov dword [edx], 0x4479f4
xor ebx, ebx
test edx, edx
je 0x402f59
mov ecx, dword [edx]
mov eax, dword [ecx]
add eax, edx
push eax
mov eax, dword [ecx + 4]
call eax
add esp, 4
xor esi, esi
test ebx, ebx
je 0x402f75
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402f75
push ebx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402f75
xor esi, esi
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x830]
mov eax, esi
push 1
xor eax, 1
add eax, 2
push eax
push 0x10
push 0xf01ff
push str.DiskDrill_Watcher
push str.cfbackd
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, eax
test ebx, ebx
jne 0x402ffc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, 0xa0
test esi, esi
cmove esi, eax
test edi, edi
je 0x402fef
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x402fdf
mov edx, dword [ecx]
mov eax, dword [edx]
add eax, ecx
push eax
mov eax, dword [edx + 4]
call eax
add esp, 4
mov ecx, esi
mov dword [edi], 0x19
call fcn.0041b480
mov dword [edi + 4], eax
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
jmp 0x4030c6
lea eax, [ebp - 0x810]
mov dword [ebp - 0x828], 0x78
mov dword [ebp - 0x818], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x828]
movlpd qword [ebp - 0x810], xmm0
push eax
push 2
push ebx
movlpd qword [ebp - 0x824], xmm0
mov dword [ebp - 0x81c], 1
mov dword [ebp - 0x810], 1
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x40306b
lea eax, [ebp - 0x80c]
mov dword [ebp - 0x80c], str.This_service_is_part_of_Disk_Drill_app__developed_by_CleverFiles.
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x4030ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, 0xa0
test esi, esi
cmove esi, eax
test edi, edi
je 0x4030a7
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x403097
mov edx, dword [ecx]
mov eax, dword [edx]
add eax, ecx
push eax
mov eax, dword [edx + 4]
call eax
add esp, 4
mov ecx, esi
mov dword [edi], 0x19
call fcn.0041b480
mov dword [edi + 4], eax
xor esi, esi
jmp 0x4030bd
test esi, esi
je 0x4030b8
xor edx, edx
mov ecx, ebx
call fcn.00403260
mov esi, 1
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call edi
push dword [ebp - 0x82c]
call edi
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00425576
mov esp, ebp
pop ebp
ret