Function at 0x41dbc8
Capabilities:
Check if file exists
Get common file path
Get file attributes
Modify service
Query service configuration
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
cmp esi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], str.Error
je 0x41de34
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, edi
mov dword [ebp - 0x10], eax
je 0x41de34
push ebx
push 0xf01ff
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
cmp ebx, edi
mov dword [ebp - 0xc], ebx
jne 0x41dc27
mov dword [ebp - 4], 0x42df1c
jmp 0x41de2a
cmp dword [ebp + 0xc], edi
jne 0x41de4e
cmp dword [ebp + 0x10], edi
jne 0x41dccd
lea eax, [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x41de21
mov eax, dword [ebp - 0x28]
mov dword [esi], eax
dec eax
mov dword [ebp - 8], 1
je 0x41dcc1
dec eax
je 0x41dcb5
dec eax
je 0x41dca9
dec eax
je 0x41dc9d
dec eax
je 0x41dc91
dec eax
je 0x41dc85
dec eax
je 0x41dc79
mov dword [ebp - 4], 0x42df18
jmp 0x41de21
mov dword [ebp - 4], str.PAUSED
jmp 0x41de21
mov dword [ebp - 4], str.PAUSE_PENDING
jmp 0x41de21
mov dword [ebp - 4], str.CONTINUE_PENDING
jmp 0x41de21
mov dword [ebp - 4], str.RUNNING
jmp 0x41de21
mov dword [ebp - 4], str.STOP_PENDING
jmp 0x41de21
mov dword [ebp - 4], str.START_PENDING
jmp 0x41de21
mov dword [ebp - 4], str.STOPPED
jmp 0x41de21
lea eax, [ebp + 0x14]
push eax
push edi
push edi
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x41de21
push dword [ebp + 0x14]
mov eax, dword [0x4324d8]
push 8
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x41de1f
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x14]
push edi
push dword [ebp - 0xc]
call ebx
test eax, eax
je 0x41de0e
cmp dword [ebp + 0x10], 1
mov eax, dword [edi + 4]
mov dword [ebp - 8], 1
mov dword [esi], eax
jne 0x41dd88
sub eax, 0
je 0x41dd7c
dec eax
je 0x41dd70
dec eax
je 0x41dd64
dec eax
je 0x41dd58
dec eax
je 0x41dd4c
mov dword [ebp - 4], 0x42df18
jmp 0x41de0e
mov dword [ebp - 4], str.DISABLED
jmp 0x41de0e
mov dword [ebp - 4], str.DEMAND
jmp 0x41de0e
mov dword [ebp - 4], str.AUTO
jmp 0x41de0e
mov dword [ebp - 4], str.SYSTEM
jmp 0x41de0e
mov dword [ebp - 4], str.BOOT
jmp 0x41de0e
push dword [edi + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x234]
push eax
mov dword [ebp - 4], eax
call ebx
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x41de0e
lea eax, [ebp - 0x130]
push eax
xor eax, eax
push eax
push eax
push 0x25
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.drivers_
lea eax, [ebp - 0x130]
push eax
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x130]
push eax
call esi
push str..sys
lea eax, [ebp - 0x130]
push eax
call esi
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41de0e
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x234]
push eax
call ebx
mov eax, dword [0x4324d8]
push edi
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor edi, edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
cmp dword [ebp + 0x18], edi
pop edi
pop esi
je 0x41de47
push dword [ebp - 4]
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 8]
leave
ret 0x14
cmp dword [ebp + 0x10], edi
jne 0x41dedd
lea eax, [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x41de21
mov esi, dword [esi]
cmp esi, 4
mov eax, dword [ebp - 0x28]
mov dword [ebp + 0x14], eax
jne 0x41de90
cmp eax, 1
jne 0x41de83
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
jmp 0x41dec6
cmp eax, 7
jne 0x41de21
lea eax, [ebp - 0x2c]
push eax
push 3
jmp 0x41debf
cmp esi, 1
jne 0x41dea7
cmp eax, 4
je 0x41de9f
cmp eax, 7
jne 0x41de21
lea eax, [ebp - 0x2c]
push eax
push 1
jmp 0x41debf
cmp esi, 7
jne 0x41de21
cmp eax, 4
jne 0x41de21
lea eax, [ebp - 0x2c]
push eax
push 2
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp eax, edi
mov dword [ebp - 8], eax
je 0x41de21
mov dword [ebp - 4], 0x42dc48
jmp 0x41de21
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi]
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
je 0x41de21
mov dword [ebp - 8], 1
jmp 0x41ded1