Function at 0x40805f
Capabilities:
Check for time delay via gettickcount
Copy file
Create service
Delete service
Get common file path
Start service
Stop service

Disassembly:
push ebp
lea ebp, [esp - 0xd0]
sub esp, 0x150
mov eax, dword [0x4250b0]
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0xf0], esi
mov dword [ebp + 0xcc], eax
je 0x4080a4
push dword [ebp + 0xe8]
push dword [ebp + 0xe4]
push dword [ebp + 0xe0]
push str.Attempting_Component_Load___s___s___s_
push esi
call fcn.00415908
add esp, 0x14
mov ebx, dword [ebp + 0xec]
xor eax, eax
cmp ebx, esi
sete al
push 0xff
push dword [ebp + 0xe0]
mov dword [ebp + 0xec], eax
lea eax, [ebp - 0x54]
push eax
call fcn.00416870
add esp, 0xc
cmp ebx, esi
mov byte [ebp + 0xab], 0
je 0x4080ff
cmp dword [0x42a578], esi
je 0x4080ff
cmp dword [ebp + 0xf0], esi
je 0x408522
push str.Driver_Load_Skipped_due_to_64_bit_O_S
push esi
call fcn.00415908
pop ecx
pop ecx
jmp 0x408522
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, esi
mov dword [ebp - 0x5c], eax
jne 0x408141
cmp dword [ebp + 0xec], esi
mov eax, 0xffa9
je 0x408125
mov dword [0x42ad08], eax
push eax
push 0x429ba0
call fcn.00405dc1
pop ecx
push eax
push 2
call fcn.00415908
add esp, 0xc
jmp 0x408522
push edi
push 0xf01ff
lea ecx, [ebp - 0x54]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp eax, esi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x58], eax
je 0x4081bf
lea ecx, [ebp - 0x80]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov eax, 0x1388
cmp dword [ebp - 0x68], eax
jg 0x408179
mov eax, dword [ebp - 0x68]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add eax, 0x32
push eax
call esi
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push dword [ebp - 0x58]
call edi
push 0x2ee
call esi
push 0xf01ff
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
je 0x4081bd
push eax
call edi
mov eax, 0xffac
jmp 0x40845f
xor esi, esi
push 0x421664
push dword [ebp + 0xd8]
call fcn.0041779a
pop ecx
pop ecx
mov ecx, eax
cmp ecx, esi
mov dword [ebp - 0x58], ecx
mov byte [ebp + 0xbc], 0x31
mov byte [ebp + 0xbd], 0
je 0x4081fc
lea eax, [ebp + 0xbc]
push eax
push dword [ebp + 0xd8]
call fcn.00407f93
pop ecx
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [ebp - 0x64], eax
call fcn.0041827a
cdq
mov ecx, 0x320
idiv ecx
add edx, 0x12c
mov dword [ebp - 0x60], edx
call esi
sub eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x60]
jle 0x40821d
push dword [ebp - 0x58]
call fcn.0041731d
mov dword [esp], 0x421544
push dword [ebp + 0xd8]
call fcn.0041779a
push dword [ebp + 0xd8]
mov dword [ebp - 0x58], eax
call fcn.004160ad
add esp, 0xc
test eax, eax
jne 0x408275
push dword [ebp - 0x5c]
call edi
push dword [ebp + 0xd8]
push str._s_does_not_contain_a_valid_certificate__Load_denied.
push 1
call fcn.00415908
add esp, 0xc
jmp 0x408521
push 0x102
mov esi, 0x426600
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [0x426600], 0
je 0x4082b7
xor eax, eax
inc eax
cmp byte [eax + 0x426600], 0
jne 0x408291
cmp byte [eax + 0x4265ff], 0x5c
je 0x4082b7
push 0x421628
push 0x104
push esi
call fcn.0040681c
add esp, 0xc
push dword [ebp + 0xe4]
push 0x104
push esi
call fcn.0040681c
push dword [ebp + 0xe8]
push 0x104
push esi
call fcn.0040681c
push 0x180
push esi
call fcn.00420656
add esp, 0x20
push 0
push esi
push dword [ebp + 0xd8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40835d
mov eax, dword [0x42ad44]
xor eax, dword [0x42a58c]
push 0x2ee
mov dword [0x42ad44], eax
call eax
mov eax, dword [0x42a58c]
xor dword [0x42ad44], eax
push esi
call fcn.00418243
pop ecx
push 0
push esi
push dword [ebp + 0xd8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40835d
push dword [ebp - 0x5c]
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push dword [ebp + 0xd8]
push str.Copy_from___s__to___s__failed__Load_denied.___lu_
push 1
call fcn.00415908
add esp, 0x14
jmp 0x408521
push esi
push str.Verifying_MD5_match_for___s_._n
call fcn.00406774
cmp dword [ebp - 0x58], 0
pop ecx
pop ecx
je 0x408398
push dword [ebp - 0x58]
call fcn.0041731d
mov dword [esp], 0x421544
push esi
call fcn.0041779a
push eax
push str.reopen_f_x_n
push 4
mov dword [ebp - 0x58], eax
call fcn.00415908
add esp, 0x14
mov ecx, dword [ebp - 0x58]
test ecx, ecx
mov byte [ebp + 0xac], 0x32
mov byte [ebp + 0xad], 0
je 0x4083bc
lea eax, [ebp + 0xac]
push eax
push esi
call fcn.00407f93
pop ecx
pop ecx
push 0x10
lea eax, [ebp + 0xac]
push eax
lea eax, [ebp + 0xbc]
push eax
call fcn.004178f0
add esp, 0xc
test eax, eax
je 0x4083f8
push dword [ebp - 0x5c]
call edi
push dword [ebp + 0xd8]
push esi
push str._s_does_not_match__s__Load_denied.
push 1
call fcn.00415908
add esp, 0x10
jmp 0x408521
lea eax, [ebp - 0x54]
push eax
push str.calling_CreateService__s
call fcn.00406774
pop ecx
pop ecx
xor eax, eax
push eax
xor ecx, ecx
cmp ebx, eax
push eax
setne cl
push eax
push eax
push eax
push esi
push 1
lea eax, [ebp - 0x54]
inc ecx
inc ecx
neg ebx
sbb ebx, ebx
push ecx
and ebx, 0xfffffff1
add ebx, 0x10
push ebx
mov ebx, 0xf01ff
push ebx
push eax
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x408468
push esi
push dword [ebp + 0xec]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.error_gle_ld_boe_ld_fn_s
call fcn.00406774
add esp, 0x10
mov eax, 0xffad
cmp dword [ebp + 0xec], 0
jmp 0x4084a9
push eax
call edi
xor esi, esi
cmp dword [ebp - 0x58], esi
je 0x40848a
push dword [ebp - 0x58]
call fcn.0041731d
mov dword [esp], str.closed_n
push 4
call fcn.00415908
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
cmp ebx, esi
jne 0x4084c9
cmp dword [ebp + 0xec], esi
mov eax, 0xffaf
je 0x4084b0
mov dword [0x42ad08], eax
push eax
push 0x429ba0
call fcn.00405dc1
pop ecx
push eax
push 2
call fcn.00415908
add esp, 0xc
jmp 0x40851c
push esi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x4084ff
cmp dword [ebp + 0xec], esi
mov eax, 0xffae
je 0x4084e8
mov dword [0x42ad08], eax
push eax
push 0x429ba0
call fcn.00405dc1
pop ecx
push eax
push 2
call fcn.00415908
add esp, 0xc
cmp dword [ebp + 0xf0], esi
je 0x408519
lea eax, [ebp - 0x54]
push eax
push str.Loaded_and_Started__s
push esi
call fcn.00415908
add esp, 0xc
push ebx
call edi
push dword [ebp - 0x5c]
call edi
pop edi
mov ecx, dword [ebp + 0xcc]
pop esi
pop ebx
call fcn.004169c5
add ebp, 0xd0
leave
ret