Function at 0x4037c9
Capabilities:
Create service
Modify service

Disassembly:
mov eax, 0x1a84
call fcn.00404210
mov eax, dword [0x40704c]
xor eax, esp
mov dword [esp + 0x1a80], eax
push ebp
push esi
mov esi, ecx
call fcn.00401610
push 0x3ff
lea eax, [esp + 0x128c]
push eax
xor ebp, ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x403838
push 0x100
lea ecx, [esp + 0x8c]
push ecx
mov ecx, esi
call fcn.00401570
mov edx, dword [esi + 8]
push eax
push edx
push str.Unable_to_install__s____s_n
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fwprintf]
add esp, 0x10
pop esi
mov eax, 0xc8
pop ebp
mov ecx, dword [esp + 0x1a80]
xor ecx, esp
call fcn.004041ee
add esp, 0x1a84
ret
push ebx
push edi
lea eax, [esp + 0x1290]
push 0x5c
push eax
call dword [sym.imp.MSVCR90.dll_wcsrchr]
add esp, 8
mov edi, eax
call fcn.00402c30
test eax, eax
je 0x403921
xor ecx, ecx
mov word [esp + 0x290], cx
cmp edi, ebp
je 0x4038bc
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call ebx
lea edx, [esp + 0x1290]
mov edi, 1
push edx
sub edi, eax
call ebx
add eax, edi
push eax
lea eax, [esp + 0x1294]
push eax
lea ecx, [esp + 0x298]
push ecx
call dword [sym.imp.MSVCR90.dll_wcsncat]
mov edi, dword [sym.imp.MSVCR90.dll_wcscat_s]
push 0x405d14
lea edx, [esp + 0x2a0]
push 0x400
push edx
call edi
add esp, 0x18
jmp 0x4038c2
mov edi, dword [sym.imp.MSVCR90.dll_wcscat_s]
push 0x405d10
lea eax, [esp + 0xa94]
push 0x400
push eax
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
lea ecx, [esp + 0x129c]
push ecx
lea edx, [esp + 0xaa0]
push 0x400
push edx
call edi
push 0x405d08
lea eax, [esp + 0xaac]
push 0x400
push eax
call edi
lea ecx, [esp + 0x2b4]
push ecx
lea edx, [esp + 0xab8]
push 0x400
push edx
call edi
add esp, 0x30
jmp 0x40398e
mov ebx, dword [sym.imp.MSVCR90.dll_wcscpy_s]
push str._SystemRoot_System32_
lea eax, [esp + 0x294]
push 0x400
push eax
call ebx
add esp, 0xc
cmp edi, ebp
je 0x40395c
add edi, 2
push edi
lea ecx, [esp + 0x294]
push 0x400
push ecx
call dword [sym.imp.MSVCR90.dll_wcscat_s]
add esp, 0xc
lea edx, [esp + 0x290]
push edx
lea eax, [esp + 0xa94]
push 0x400
push eax
call ebx
push str.__SystemRoot_System32_bcmwltry.exe
lea ecx, [esp + 0xaa0]
push 0x400
push ecx
call dword [sym.imp.MSVCR90.dll_wcscat_s]
add esp, 0x18
mov ecx, esi
mov dword [esp + 0x10], ebp
call fcn.00402f70
test eax, eax
je 0x4039b1
mov edx, dword [esi + 0x5c]
push ebp
push 0x405c88
push edx
call fcn.00403180
add esp, 0xc
jmp 0x4039b4
mov dword [esi + 0x5c], ebp
push 0xf003f
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [esp + 0x14], eax
cmp eax, ebp
je 0x403b9e
mov edx, dword [esi + 0x50]
cmp edx, 1
je 0x4039da
cmp edx, 2
jne 0x4039e6
mov ecx, dword [esi + 0x54]
cmp ecx, ebp
je 0x4039ea
cmp ecx, 1
je 0x4039ea
xor ecx, ecx
jmp 0x4039ed
lea ecx, [esi + 0x60]
mov edi, dword [esi + 0x6c]
push edi
mov edi, dword [esi + 0x68]
push edi
mov edi, dword [esi + 0x64]
push edi
push ecx
mov ecx, dword [esi + 0x5c]
push ecx
lea ecx, [esp + 0xaa4]
push ecx
mov ecx, dword [esi + 0x58]
push ecx
mov ecx, dword [esi + 0x54]
push ecx
mov ecx, dword [esi + 8]
push edx
mov edx, dword [esi + 0x4c]
push edx
mov edx, dword [esi + 4]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
cmp edi, ebp
je 0x403a91
cmp dword [esi + 0xc], ebp
mov ebp, dword [sym.imp.MSVCR90.dll_fwprintf]
mov ebx, dword [sym.imp.MSVCR90.dll___iob_func]
lea eax, [esi + 0xc]
je 0x403a6f
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x403a6f
push 0x100
lea eax, [esp + 0x94]
push eax
mov ecx, esi
call fcn.00401570
push eax
push 0x405c38
call ebx
add eax, 0x40
push eax
call ebp
add esp, 0xc
mov ecx, dword [esi + 8]
push ecx
push str._s_installed._n
call ebx
add eax, 0x40
push eax
call ebp
add esp, 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, 1
jmp 0x403ac6
push 0x100
lea edx, [esp + 0x94]
push edx
mov ecx, esi
call fcn.00401570
mov ebx, dword [sym.imp.MSVCR90.dll___iob_func]
push eax
push str.CreateService_failed____s_n
call ebx
mov ebp, dword [sym.imp.MSVCR90.dll_fwprintf]
add eax, 0x40
push eax
call ebp
mov edi, dword [esp + 0x1c]
add esp, 0xc
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x403b80
mov edx, dword [esi]
mov edx, dword [edx + 0x34]
push 7
lea eax, [esp + 0x294]
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x3c]
push 0xffffffffffffffff
push 4
push str.Service_installed
mov ecx, esi
call edx
call fcn.00402ba0
test eax, eax
je 0x403bcd
push 0x405c34
lea eax, [esp + 0x1c]
push 0x27
push eax
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
mov esi, dword [sym.imp.MSVCR90.dll_wcscat_s]
push 0x405be8
lea ecx, [esp + 0x28]
push 0x27
push ecx
call esi
push 0x405be4
lea edx, [esp + 0x34]
push 0x27
push edx
call esi
mov ecx, 0xa
mov esi, str.nt_authority_system
lea edi, [esp + 0x8c]
push 0x405668
lea eax, [esp + 0x90]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.00402a10
add esp, 0x30
test eax, eax
je 0x403bcd
push str.Set_RunAs_password_failed____n
call ebx
add eax, 0x40
push eax
call ebp
add esp, 8
mov eax, 0xc8
mov ecx, dword [esp + 0x1a90]
pop edi
pop ebx
pop esi
pop ebp
xor ecx, esp
call fcn.004041ee
add esp, 0x1a84
ret
push 0x100
lea ecx, [esp + 0x94]
push ecx
mov ecx, esi
call fcn.00401570
push eax
push 0x4053a8
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fwprintf]
add esp, 0xc
jmp 0x403b80
xor eax, eax
jmp 0x403b85