Function at 0x409bd0
Capabilities:
Create service
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x42b314]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x214], 0
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x409c45
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Aqav7mlxgpPfnxLXAuitsYmc5aW1rwfmpqpqnRJiWP2orhF8OX
push 0x345a
push 0x6976
push 0x4ef5
call fcn.00405240
add esp, 0x10
push eax
call fcn.00411246
add esp, 8
jmp 0x409ef7
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
jne 0x409c81
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.00411246
add esp, 8
jmp 0x409ef7
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jne 0x409e01
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x41f
je 0x409cda
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cay4yFVwhYnTuh7__DGiucJ1cN_Wmr8a0vEgp_eDY2eFkMjjW575a8k
push 0x11ba
push 0x471c
push 0x948
call fcn.004050a0
add esp, 0x10
push eax
call fcn.00411189
add esp, 8
push 0x10c
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x409d22
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cay4wmpUm5PVulOSvSOiss9jcdvf36sJ1O9_4_7HKB8
push 0x27a5
push 0x321
push 0x6342
call fcn.004050a0
add esp, 0x10
push eax
call fcn.00411189
add esp, 8
lea edx, [ebp - 0x224]
push edx
push 0x10c
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
test eax, eax
jne 0x409d77
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x513c
push str.FLa0X9Gko3MsBje0SqgsPBydIOKyfFSm_skqrfGYjnXmsirFMmnZea_jQw
push 0x2ebc
push 0x59bd
push 0x63b6
call fcn.004050a0
add esp, 0x14
push eax
call fcn.00411189
add esp, 8
mov edx, dword [ebp - 0x21c]
cmp dword [edx], 0
je 0x409dc5
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0x21c]
mov eax, dword [edx + 4]
push eax
push 0x15d5
push 0x3454
push str.Cay4yGNx153D41ue7mnjv9Z0dIOW1bdBm7gh46jGZXqZm8nT
push 0x381d
push 0xa2e
push 0x37bb
call fcn.004050a0
add esp, 0x18
push eax
call fcn.00411189
add esp, 0xc
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x5b0b
push 0x27b4
push str.Bqyuz2I1mZDORfU_i7jr8tjNZOezrgZ2u4g7dE
push 0x5d94
push 0x4b3b
push 0x5aea
call fcn.004050a0
add esp, 0x18
push eax
call fcn.00411189
add esp, 4
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
push 0
lea edx, [ebp - 0x210]
push edx
push 1
mov eax, dword [ebp + 0x10]
push eax
push 0x10
push 0xf01ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x409e67
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateService_failed_w_err_0x_08lx_n
call fcn.00411246
add esp, 8
jmp 0x409ef7
mov dword [ebp - 0x218], str.Enables_the_detection__download_and_installation_of_up_to_date_configuration_files._Stopping_or_disabling_this_service_may_prevent_you_from_getting_the_latest_updates__which_may_expose_your_computer_to_security_vulnerabilities_or_functional_flaws.
lea ecx, [ebp - 0x218]
push ecx
push 1
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x409e9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ChangeServiceConfig2_failed_w_err_0x_08lx_n
call fcn.00411246
add esp, 8
mov eax, dword [ebp + 8]
push eax
push str._s_is_installed._n
call fcn.00411246
add esp, 8
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
test eax, eax
jne 0x409ef7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x3d3c
push 0x1ad8
push str.EK23zGVpJrIrxLYAGir8JkdISakvBb3fwsr77HKjWSjci2CYG9YKf1qQ
push 0x3447
push 0x4934
push 0x567c
call fcn.004050a0
add esp, 0x18
push eax
call fcn.00411189
add esp, 8
cmp dword [ebp - 0x228], 0
je 0x409f17
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x228], 0
cmp dword [ebp - 0x214], 0
je 0x409f37
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x214], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fee0
mov esp, ebp
pop ebp
ret