Function at 0x402c90
Capabilities:
Copy file
Create service
Delete file
Modify service
Move file
Set registry value
Stop service

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x454
mov eax, dword [0x431014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
push 0xf003f
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test eax, eax
je 0x402d32
mov esi, eax
lea edi, [ebp - 0x426]
push 0x105
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x402d73
push 0xf01ff
push str.MozillaMaintenance
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x402db4
cmp eax, 0x424
je 0x402db4
mov eax, dword [0x4329d4]
mov ecx, dword [0x431bbc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x403aee
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_open_service.____lu_
jmp 0x402da0
mov eax, dword [0x4329d4]
mov ecx, dword [0x431bbc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x403a68
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_open_service_manager.____lu_
push 0x4327c8
call fcn.004086b0
add esp, 0xc
xor edi, edi
jmp 0x403491
mov eax, dword [0x4329d4]
mov ecx, dword [0x431bbc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x403aab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_obtain_module_filename_when_attempting_to_install_service.____lu_
push 0x4327c8
call fcn.004086b0
add esp, 0xc
xor edi, edi
jmp 0x40348a
test ebx, ebx
je 0x40313f
mov ecx, ebx
lea ebx, [ebp - 0x21c]
mov dword [ebx], 0
mov dword [ebp - 0x460], ecx
mov edx, ebx
call fcn.00404630
mov edi, eax
mov eax, dword [ebx]
test eax, eax
je 0x402de6
push eax
cmp dword [ebp + 8], 0
je 0x4033c2
push edi
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
sub esp, 0x34
xorps xmm0, xmm0
movups xmmword [esp + 0x20], xmm0
mov dword [esp + 0x1c], edi
movaps xmm0, xmmword [0x429a50]
movups xmmword [esp + 0xc], xmm0
mov dword [esp], esi
mov dword [esp + 0x30], 0
mov dword [esp + 8], str.Mozilla_Maintenance_Service
mov dword [esp + 4], str.MozillaMaintenance
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
je 0x403408
mov ebx, eax
lea edi, [ebp - 0x21c]
mov dword [edi], 0
mov ecx, eax
mov edx, edi
call fcn.00404630
mov ecx, dword [edi]
test ecx, ecx
je 0x4031bc
push ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
test eax, eax
je 0x4031fa
mov eax, dword [0x4329d4]
mov ecx, dword [0x431bbc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x403c80
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_set_security_ACE_on_service_handle__the_service_will_not_be_able_to_be_started_from_unelevated_processes._This_error_should_never_happen.____lu_
push 0x4327c8
call fcn.004086b0
add esp, 0xc
mov ecx, ebx
call fcn.00402780
xor edi, edi
inc edi
jmp 0x403483
xor edi, edi
inc edi
jmp 0x40348a
mov eax, dword [0x4329d4]
mov ecx, dword [0x431bbc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x403cc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_create_Windows_service._This_error_should_never_happen_since_a_service_install_should_only_be_called_when_elevated.____lu_
jmp 0x402da0
push 0x4329d4
call fcn.0040a2c7
add esp, 4
cmp dword [0x4329d4], 0xffffffff
jne 0x402d53
mov dword [0x4327c8], 0
push 0x402500
call fcn.0040a48c
add esp, 4
push 0x4329d4
call fcn.0040a319
add esp, 4
jmp 0x402d53
push 0x4329d4
call fcn.0040a2c7
add esp, 4
cmp dword [0x4329d4], 0xffffffff
jne 0x402d94
mov dword [0x4327c8], 0
push 0x402500
call fcn.0040a48c
add esp, 4
push 0x4329d4
call fcn.0040a319
add esp, 4
jmp 0x402d94
push 0x4329d4
call fcn.0040a2c7
add esp, 4
cmp dword [0x4329d4], 0xffffffff
jne 0x402d24
mov dword [0x4327c8], 0
push 0x402500
call fcn.0040a48c
add esp, 4
push 0x4329d4
call fcn.0040a319
add esp, 4
jmp 0x402d24
push 0x4329d4
call fcn.0040a2c7
add esp, 4
cmp dword [0x4329d4], 0xffffffff
jne 0x4031e1
mov dword [0x4327c8], 0
push 0x402500
call fcn.0040a48c
add esp, 4
push 0x4329d4
call fcn.0040a319
add esp, 4
jmp 0x4031e1
push 0x4329d4
call fcn.0040a2c7
add esp, 4
cmp dword [0x4329d4], 0xffffffff
jne 0x403429
mov dword [0x4327c8], 0
push 0x402500
call fcn.0040a48c
add esp, 4
push 0x4329d4
call fcn.0040a319
add esp, 4
jmp 0x403429