Function at 0x4eb37c
Capabilities:
Create service
Delete service
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4eb384
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4eb71f
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea edx, [ebp - 0x18]
mov eax, dword [0x4f44ec]
mov eax, dword [eax]
call fcn.004683dc
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 4]
call fcn.00409624
lea eax, [ebp - 8]
mov edx, 0x4eb738
call fcn.004048c0
mov eax, dword [0x4f459c]
cmp dword [eax], 1
jne 0x4eb3f1
call sub.kernel32.dll_GetCurrentProcess
mov edi, eax
mov eax, edi
call fcn.004eb244
test al, al
je 0x4eb3f1
lea eax, [ebp - 8]
mov edx, 0x4eb748
call fcn.004048c0
push dword [ebp - 4]
push dword [ebp - 8]
push 0x4eb75c
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404bb8
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.004096d8
mov edx, dword [ebp - 0x1c]
mov eax, 0x4f790c
call fcn.0040487c
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [0x4f7910], eax
xor eax, eax
mov dword [0x4f7914], eax
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [0x4f7900], eax
cmp dword [0x4f7900], 0
jbe 0x4eb6b8
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x4f790c]
call fcn.00404cf8
push eax
push 0
push 3
push 1
push 0xf01ff
push 0x4eb764
mov eax, dword [ebp - 8]
call fcn.00404cf8
mov edi, eax
push edi
mov eax, dword [0x4f7900]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [0x4f7904], eax
cmp dword [0x4f7904], 0
jbe 0x4eb5a5
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [0x4f7904]
push eax
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4eb53a
push 0
push 0
push 3
mov eax, dword [0x4f7914]
push eax
push 0
push 0xc0000000
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov edx, 0x4eb788
call fcn.00404b44
mov eax, dword [ebp - 0x24]
call fcn.00404cf8
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [0x4f7908], eax
cmp dword [0x4f7908], 0xffffffff
jne 0x4eb6ec
push 0x10
call sub.kernel32.dll_GetLastError_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.0040910c
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x4eb798
call fcn.00404b44
mov edx, dword [ebp - 0x28]
mov ecx, 0x4eb7b4
mov eax, esi
call fcn.004ecf54
xor ebx, ebx
jmp 0x4eb6ec
call sub.kernel32.dll_GetLastError_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.0040910c
mov eax, dword [ebp - 0xc]
mov edx, 0x4eb7c4
call fcn.00404c44
jne 0x4eb567
lea eax, [ebp - 0xc]
mov edx, 0x4eb7d0
call fcn.004048c0
push 0x10
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4eb7ec
call fcn.00404b44
mov edx, dword [ebp - 0x30]
mov ecx, 0x4eb7b4
mov eax, esi
call fcn.004ecf54
mov eax, dword [0x4f7904]
push eax
call sub.advapi32.dll_DeleteService
mov eax, dword [0x4f7904]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor ebx, ebx
jmp 0x4eb6ec
push 0x10
mov ecx, 0x4eb7b4
mov edx, 0x4eb808
mov eax, esi
call fcn.004ecf54
push 0xf01ff
push edi
mov eax, dword [0x4f7900]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [0x4f7904], eax
push 0x4f7930
push 1
mov eax, dword [0x4f7904]
push eax
call sub.advapi32.dll_ControlService
xor ebx, ebx
cmp dword [0x4f7904], 0
jbe 0x4eb6a3
mov eax, dword [0x4f7904]
push eax
call sub.advapi32.dll_DeleteService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 1
jne 0x4eb61c
push 0x40
mov ecx, 0x4eb854
mov edx, 0x4eb86c
mov eax, esi
call fcn.004ecf54
cmp byte [ebp - 0xd], 0
jne 0x4eb696
call sub.kernel32.dll_GetLastError_1
mov dword [0x4f792c], eax
call sub.kernel32.dll_GetLastError_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.0040910c
mov eax, dword [ebp - 0xc]
mov edx, 0x4eb89c
call fcn.00404c44
jne 0x4eb659
lea eax, [ebp - 0xc]
mov edx, 0x4eb8ac
call fcn.004048c0
mov eax, dword [ebp - 0xc]
mov edx, 0x4eb8d0
call fcn.00404c44
jne 0x4eb675
lea eax, [ebp - 0xc]
mov edx, 0x4eb8e0
call fcn.004048c0
push 0x10
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4eb8f8
call fcn.00404b44
mov edx, dword [ebp - 0x34]
mov ecx, 0x4eb7b4
mov eax, esi
call fcn.004ecf54
mov eax, dword [0x4f7904]
push eax
call sub.advapi32.dll_CloseServiceHandle
jmp 0x4eb6ec
push 0x10
mov ecx, 0x4eb7b4
mov edx, 0x4eb91c
mov eax, esi
call fcn.004ecf54
jmp 0x4eb6ec
push 0x10
call sub.kernel32.dll_GetLastError_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x3c]
call fcn.0040910c
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp - 0x38]
mov edx, 0x4eb938
call fcn.00404b44
mov edx, dword [ebp - 0x38]
mov ecx, 0x4eb7b4
mov eax, esi
call fcn.004ecf54
xor ebx, ebx
mov eax, dword [0x4f7900]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4eb726
lea eax, [ebp - 0x3c]
mov edx, 0xa
call fcn.0040484c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040484c
ret