Function at 0x401528
Capabilities:
Create service
Get common file path
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
mov eax, dword [0x41f1c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x284], eax
xor eax, eax
push 0x256
mov word [ebp - 0x25c], ax
lea eax, [ebp - 0x25a]
push ebx
push eax
mov dword [ebp - 0x27c], esi
mov dword [ebp - 0x260], ebx
mov byte [ebp - 0x265], bl
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x26c], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x12c
lea eax, [ebp - 0x25c]
push eax
mov dword [ebp - 0x278], ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push ebx
lea eax, [ebp - 0x270]
push eax
push ebx
push ebx
push dword [ebp + 0xc]
push esi
push 0xffffffffffffffff
call fcn.0041196a
mov esi, eax
add esp, 0x1c
cmp esi, ebx
je 0x4015d8
push esi
push str.error__i_reading_driver_image_info_n
call fcn.00401225
pop ecx
pop ecx
jmp 0x401682
cmp byte [0x41f1e4], bl
jne 0x4015f4
push str.need_to_load_driver_but_not_administrator_n
mov esi, 0x522
call fcn.00401211
jmp 0x4019c3
mov eax, dword [ebp - 0x270]
cmp eax, 0x466b3f00
jae 0x401609
mov dword [ebp - 0x270], ebx
jmp 0x40161d
add eax, 0xb994c100
xor edx, edx
mov ecx, 0x15180
div ecx
mov dword [ebp - 0x270], eax
push dword [ebp - 0x270]
mov esi, str.pfmfs
push esi
push str._s__03Xsmx
call fcn.004137cd
push dword [ebp - 0x270]
mov dword [ebp - 0x264], eax
push esi
push str._s__03Xsmx.sys
call fcn.004137cd
push eax
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x25c]
push eax
push 0x4197b4
call fcn.004137cd
add esp, 0x24
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x264], ebx
je 0x40167f
cmp dword [ebp - 0x274], ebx
je 0x40167f
cmp eax, ebx
jne 0x40168a
push 0xe
pop esi
cmp esi, ebx
jne 0x4019c4
push str.systemcurrentcontrolset_services
push 0x80000002
call fcn.00410552
push dword [ebp - 0x264]
mov dword [ebp - 0x278], eax
push eax
call fcn.0041057f
mov edi, eax
add esp, 0x10
cmp edi, ebx
jne 0x401759
push 2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
cmp esi, ebx
jne 0x4016dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.error__i_opening_service_manager_for_create_n
call fcn.00401225
pop ecx
pop ecx
jmp 0x40172d
push ebx
push ebx
push ebx
push ebx
push dword [0x41f064]
push dword [ebp - 0x274]
push 1
push 3
push 1
push 0x20000000
push ebx
push dword [ebp - 0x264]
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
cmp eax, ebx
jne 0x40171f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.error__i_creating_driver_service_n
call fcn.00401225
pop ecx
pop ecx
jmp 0x401726
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x264]
push dword [ebp - 0x278]
call fcn.004105ac
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
jne 0x401759
push str.error_creating_or_opening_driver_key_n
call fcn.00401211
pop ecx
push 5
pop esi
jmp 0x4019c4
push dword [ebp - 0x274]
push str.ImagePath
push edi
call fcn.00410660
push dword [0x41f064]
push str.Group
push edi
call fcn.00410624
push 1
push str.Type
push edi
call fcn.00410609
push 3
push str.Start
push edi
call fcn.00410609
push 1
push str.ErrorControl
push edi
call fcn.00410609
push 0x419618
push edi
call fcn.0041069c
add esp, 0x44
push str.DependOnService
push edi
call fcn.0041069c
push str.DependOnGroup
push edi
call fcn.0041069c
push str.DeleteFlag
push edi
call fcn.0041069c
push dword [ebp - 0x26c]
lea eax, [ebp - 0x260]
push eax
call fcn.004107a0
mov esi, eax
add esp, 0x20
cmp esi, ebx
jne 0x401837
lea eax, [ebp - 0x280]
push eax
push dword [ebp + 0xc]
mov byte [ebp - 0x265], 1
push dword [ebp - 0x27c]
push dword [ebp - 0x260]
call fcn.004116b4
mov esi, eax
add esp, 0x10
cmp esi, ebx
jne 0x401825
mov eax, dword [ebp - 0x280]
cmp eax, dword [ebp + 0xc]
je 0x401825
push 0x27
pop esi
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x260]
call fcn.004108a7
add esp, 0xc
push dword [ebp - 0x260]
call fcn.00401453
or dword [ebp - 0x260], 0xffffffff
pop ecx
cmp esi, ebx
je 0x401867
push dword [ebp - 0x26c]
push esi
push str.error__i_creating_driver_file__s_n
call fcn.00401225
add esp, 0xc
jmp 0x4019c4
push 1
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x288], eax
cmp eax, ebx
jne 0x401892
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.error__i_opening_service_manager_n
call fcn.00401225
pop ecx
pop ecx
jmp 0x401903
push 0x10
push dword [ebp - 0x264]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x27c], eax
cmp eax, ebx
jne 0x4018bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.error__i_opening_driver_service_n
jmp 0x4018f0
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4018da
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x420
jne 0x4018da
xor esi, esi
push dword [ebp - 0x27c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp esi, ebx
je 0x4018f7
push esi
push str.error__i_loading_driver_via_service_manager_n
call fcn.00401225
pop ecx
pop ecx
push dword [ebp - 0x288]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp esi, ebx
jne 0x401918
lea eax, [ebp - 0x260]
push eax
call fcn.0040146d
pop ecx
cmp eax, ebx
je 0x40196c
push dword [ebp - 0x264]
call fcn.0041154f
pop ecx
cmp eax, ebx
je 0x401935
push eax
push str.error__i_direct_loading_driver_n
call fcn.00401225
pop ecx
pop ecx
lea eax, [ebp - 0x260]
push eax
call fcn.0040146d
pop ecx
cmp eax, ebx
je 0x40196c
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x260]
push eax
call fcn.0040146d
mov esi, eax
pop ecx
cmp esi, ebx
je 0x40196c
push esi
push str.error__i_opening_any_driver_n
jmp 0x4019bd
push dword [ebp - 0x264]
call fcn.00413c12
push ebx
push ebx
push ebx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x264]
push 2
push 0x222000
push dword [ebp - 0x260]
call fcn.004013f7
push dword [ebp - 0x260]
call fcn.00401453
lea eax, [ebp - 0x260]
push eax
call fcn.004014ea
mov esi, eax
add esp, 0x2c
cmp esi, ebx
je 0x4019c4
push esi
push str.error__i_opening_driver_n
call fcn.00401225
pop ecx
pop ecx
push 1
push str.DeleteFlag
push edi
call fcn.00410609
add esp, 0xc
cmp byte [ebp - 0x265], bl
je 0x4019e8
push dword [ebp - 0x26c]
call fcn.00410ae2
pop ecx
cmp esi, ebx
je 0x4019fe
push dword [ebp - 0x260]
call fcn.00401453
pop ecx
mov dword [ebp - 0x260], ebx
push dword [ebp - 0x278]
call fcn.00410531
push edi
call fcn.00410531
push dword [ebp - 0x264]
call fcn.0041273e
push dword [ebp - 0x274]
call fcn.0041273e
push dword [ebp - 0x26c]
call fcn.0041273e
mov eax, dword [ebp - 0x260]
mov ecx, dword [ebp - 0x284]
add esp, 0x14
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418842
leave
ret