Function at 0x40d490
Capabilities:
Check os version
Modify service
Query service status
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x684
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 2
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x66c], edi
cmp edi, esi
je 0x40d7d6
push 0xf01ff
push 0x41af7c
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
cmp ebx, esi
je 0x40d7af
push 0x11c
lea eax, [ebp - 0x128]
push esi
push eax
call fcn.00414930
add esp, 0xc
lea ecx, [ebp - 0x128]
push ecx
mov dword [ebp - 0x128], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 6
jb 0x40d5c0
push str._t_t_t_Terminate_Protect__Clear_reTry_Action.
call fcn.004033d0
add esp, 4
lea eax, [ebp - 0x680]
push eax
push 2
lea edx, [ebp - 0x628]
push ebx
mov dword [ebp - 0x628], esi
mov dword [ebp - 0x624], esi
mov dword [ebp - 0x620], esi
mov dword [ebp - 0x61c], esi
mov dword [ebp - 0x618], esi
mov dword [ebp - 0x614], esi
mov dword [ebp - 0x680], esi
mov dword [ebp - 0x674], 3
mov dword [ebp - 0x670], edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x40d5c0
push 0xfe
lea edx, [ebp - 0x106]
xor ecx, ecx
push esi
push edx
mov word [ebp - 0x108], cx
call fcn.00414930
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x108]
push str._t_t_t_Terminate_Protect__Set_Actions_Result_0x_X_.
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x108]
add esp, 0xc
push ecx
call fcn.004033d0
add esp, 4
push 0x206
lea eax, [ebp - 0x60e]
xor edx, edx
push esi
push eax
mov word [ebp - 0x610], dx
call fcn.00414930
add esp, 0xc
mov dword [ebp - 0x668], esi
xor eax, eax
jmp 0x40d5f0
movzx ecx, word [eax + str.SYSTEMCurrentControlSet_servicesWin_Win7]
mov word [ebp + eax - 0x610], cx
add eax, 2
cmp cx, si
jne 0x40d5f0
lea ecx, [ebp - 0x668]
push ecx
lea edx, [ebp - 0x664]
push edx
push esi
push 0xf003f
push esi
push esi
push esi
lea eax, [ebp - 0x610]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d6b1
push 0x206
lea edx, [ebp - 0x20e]
xor ecx, ecx
push esi
push edx
mov word [ebp - 0x210], cx
call fcn.00414930
add esp, 0xc
push str._C:Program_FilesWW2017CFwmcSystem7X.exe_
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0040ed95
lea eax, [ebp - 0x210]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40d674
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x664]
push ecx
lea edx, [ebp - 0x210]
push edx
push 2
push esi
push 0x41d344
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x664]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f2
lea eax, [ebp - 0x406]
xor edx, edx
push esi
push eax
mov word [ebp - 0x408], dx
call fcn.00414930
add esp, 0xc
lea ecx, [ebp - 0x660]
push ecx
push 0xc8
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call edi
lea edx, [ebp - 0x644]
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x640], 1
je 0x40d774
inc esi
push esi
lea eax, [ebp - 0x408]
push 0x423958
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x408]
add esp, 0xc
push ecx
call fcn.004033d0
add esp, 4
cmp esi, 0xa
je 0x40d77b
cmp dword [ebp - 0x640], 3
je 0x40d74f
lea edx, [ebp - 0x660]
push edx
push 0xc8
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x40d76b
lea eax, [ebp - 0x408]
push str._t_t_t________________________SERVICE_STOP_PENDING_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
push 0xbb8
call edi
cmp esi, 0xa
jle 0x40d6e8
push 0x423a10
jmp 0x40d780
push str._t_t_t_Terminate_All_Service_
call fcn.004033d0
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [ebp - 0x66c]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
push str._t_t_t_Terminate_Protect__Open_Win_Win7_Fail.
call fcn.004033d0
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
push str._t_t_t_Terminate_Protect_
call fcn.004033d0
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret