Function at 0x449338
Capabilities:
Create service
Modify service

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x449340
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x449754
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x20]
call sub.rtl160.bpl__System_TObject_ClassType_qqrv
push eax
mov eax, dword [0x463cbc]
mov eax, dword [eax]
mov ecx, 0x449770
mov dl, 3
call fcn.00408140
xor eax, eax
push ebp
push 0x449732
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 0x20]
call fcn.0044af8c
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov edx, 0x44979c
mov eax, ebx
call fcn.00441260
push 0x4497c0
mov eax, dword [ebp - 0x20]
call sub.rtl160.bpl__System_TObject_ClassType_qqrv
push eax
mov eax, dword [0x463cbc]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov dl, 3
call fcn.00408970
cmp dword [ebp - 4], 0
jne 0x4493d2
call sub.rtl160.bpl__System__TryFinallyExit_qqrv
jmp 0x449739
mov eax, dword [ebp - 0x20]
call sub.rtl160.bpl__System_TObject_ClassType_qqrv
push eax
mov eax, dword [0x463cbc]
mov eax, dword [eax]
mov ecx, 0x4497e8
mov dl, 3
call fcn.00407ff8
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x449411
call sub.kernel32.dll_GetLastError_1
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004483a4
xor eax, eax
push ebp
push 0x4496fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x3e8
mov edx, 0x44980c
mov eax, ebx
call fcn.004411ec
mov esi, eax
mov ecx, 0x3e8
mov edx, 0x449830
mov eax, ebx
call fcn.004411ec
mov edi, eax
mov ecx, 0x3e8
mov edx, 0x449860
mov eax, ebx
call fcn.004411ec
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 8]
push eax
xor ecx, ecx
mov edx, 0x449894
mov eax, ebx
call fcn.00441260
lea eax, [ebp - 0xc]
push eax
xor ecx, ecx
mov edx, 0x4498c0
mov eax, ebx
call fcn.00441260
lea eax, [ebp - 0x10]
push eax
xor ecx, ecx
mov edx, 0x4498f0
mov eax, ebx
call fcn.00441260
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
mov edx, 0x449924
mov eax, ebx
call fcn.00441260
lea eax, [ebp - 0x18]
push eax
xor ecx, ecx
mov edx, 0x449954
mov eax, ebx
call fcn.00441260
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x449988
mov eax, ebx
call fcn.00441260
mov ecx, 0x3e8
mov edx, 0x4499bc
mov eax, ebx
call fcn.004411ec
mov ebx, eax
push esi
mov eax, dword [ebp - 0x20]
call sub.rtl160.bpl__System_TObject_ClassType_qqrv
push eax
mov eax, dword [0x463cbc]
mov eax, dword [eax]
mov ecx, 0x44980c
mov dl, 3
call fcn.004087d8
push edi
mov eax, dword [ebp - 0x20]
call sub.rtl160.bpl__System_TObject_ClassType_qqrv
push eax
mov eax, dword [0x463cbc]
mov eax, dword [eax]
mov ecx, 0x4499e4
mov dl, 3
call fcn.004087d8
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x20]
call sub.rtl160.bpl__System_TObject_ClassType_qqrv
push eax
mov eax, dword [0x463cbc]
mov eax, dword [eax]
mov ecx, 0x449a04
mov dl, 3
call fcn.004087d8
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x20]
call sub.rtl160.bpl__System_TObject_ClassType_qqrv
push eax
mov eax, dword [0x463cbc]
mov eax, dword [eax]
mov ecx, 0x449a24
mov dl, 3
call fcn.00408970
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x20]
call sub.rtl160.bpl__System_TObject_ClassType_qqrv
push eax
mov eax, dword [0x463cbc]
mov eax, dword [eax]
mov ecx, 0x449a44
mov dl, 3
call fcn.00408970
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x20]
call sub.rtl160.bpl__System_TObject_ClassType_qqrv
push eax
mov eax, dword [0x463cbc]
mov eax, dword [eax]
mov ecx, 0x449a68
mov dl, 3
call fcn.00408970
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
call sub.rtl160.bpl__System_TObject_ClassType_qqrv
push eax
mov eax, dword [0x463cbc]
mov eax, dword [eax]
mov ecx, 0x449a90
mov dl, 3
call fcn.00408970
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x20]
call sub.rtl160.bpl__System_TObject_ClassType_qqrv
push eax
mov eax, dword [0x463cbc]
mov eax, dword [eax]
mov ecx, 0x449ab0
mov dl, 3
call fcn.00408970
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
call sub.rtl160.bpl__System_TObject_ClassType_qqrv
push eax
mov eax, dword [0x463cbc]
mov eax, dword [eax]
mov ecx, 0x449ad4
mov dl, 3
call fcn.00408970
push ebx
mov eax, dword [ebp - 0x20]
call sub.rtl160.bpl__System_TObject_ClassType_qqrv
push eax
mov eax, dword [0x463cbc]
mov eax, dword [eax]
mov ecx, 0x4499bc
mov dl, 3
call fcn.004087d8
mov eax, dword [ebp - 0x20]
call sub.rtl160.bpl__System_TObject_ClassType_qqrv
push eax
mov eax, dword [0x463cbc]
mov eax, dword [eax]
mov ecx, 0x449af8
mov dl, 3
call fcn.00407ff8
push 0
mov eax, dword [ebp - 0x14]
call sub.rtl160.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
call fcn.0044b7b8
push eax
push 0
mov eax, dword [ebp - 0xc]
call sub.rtl160.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebp - 8]
call sub.rtl160.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebp - 0x2c]
push eax
push edi
push esi
push 0xf01ff
mov eax, dword [ebp - 0x18]
call sub.rtl160.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebp - 4]
call sub.rtl160.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_CreateServiceW
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x449694
call sub.kernel32.dll_GetLastError_1
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004483a4
xor eax, eax
push ebp
push 0x4496e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
call sub.rtl160.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 1
mov eax, dword [ebp - 0x28]
push eax
call sub.advapi32.dll_ChangeServiceConfig2W
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
call fcn.00448cec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4496e7
mov eax, dword [ebp - 0x28]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44975b
lea eax, [ebp - 0x1c]
mov edx, 7
call sub.rtl160.bpl__System__UStrArrayClr_qqrpvi
ret