Function at 0x417be0
Capabilities:
Modify service
Start service

Disassembly:
push ebp
mov ebp, esp
jmp 0x417d8c
xor ebx, ebx
push 0x440818
xor esi, esi
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], esi
jmp 0x417c6c
mov dword [ebp - 4], ebx
push 0x417df5
ret
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x20]
je 0x417c39
jne 0x417c39
mov eax, dword [0xcf88c0]
sub edx, ebx
push 0x44fff0
mov eax, 0x697a29b8
mov edx, dword [0x1153c9b0]
sub byte [ebx], 0xc1
push edi
push 0x417d16
ret
push 0xffffffffffffffff
push 0x43d0f0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
jmp 0x418050
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x418007
ret
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x1c]
jmp 0x417f7c
mov ecx, dword [edi]
push 0
jmp 0x4180ae
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4180d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push 0x417d52
ret
push 0
push 0
push 0
je 0x417fd3
jne 0x417fd3
push 0x1153e550
mov eax, 0x102df868
mov ecx, dword [edi + 0x1b78]
cmp ebx, dword [ebp - 0xc18]
mov byte [ebp - 4], 0xad
sahf
jl 0x417ee6
invalid
cmc
pushfd
cmp dword [edi + 4], 2
je 0x417fde
mov eax, dword [edi + 8]
je 0x417e14
jne 0x417e14
mov edi, dword [0x11541f88]
mov dword [esi + 0xc], 0x11128b50
add byte gs:[eax], 0x8f
cmp dword [0x45094c], 0xfffffffe
mov dword [esi], 0x18
pop ss
mov dword [ebp - 0x30], ecx
push 0x417e9d
ret
push ecx
push 0x418086
ret
aas
add byte [eax + 0x40], ch
xor cl, byte [eax + eax - 0x54a21798]
add al, cl
and al, 0x68
les esp, [ebx + edi + 0x7840fc3]
add byte [eax], al
add byte [eax - 1], dl
adc eax, sym.imp.ADVAPI32.dll_CloseServiceHandle
cmp eax, ebx
je 0x417f8b
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
je 0x417fb7
jne 0x417fb7
cmp dword [ebp - 0x20c], ebx
push 0x4f58e0
bswap esi
js 0x417f6b
jle 0x418015
pop ebp
ret
push eax
push 2
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
lea ecx, [ebp - 0x34]
call fcn.0040e250
mov edi, dword [ebp - 0x1c]
xor ecx, ecx
je 0x417f63
jne 0x417f63
call dword [0x44b0e8]
lea ebp, [ebx + 1]
cmp edx, dword [eax + 0x3dc]
call 0x8d41c4ae
imul eax, dword [ecx], 0x3b
nop
fadd qword [ebx]
add byte [eax], al
imul esi, dword [ebx], 0xfffffff6
xor ebx, ebx
jmp 0x41801f
cmp esi, dword [edi + 0x4c]
fld dword [ebp - 0x88]
inc ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
je 0x417e69
jne 0x417e69
push 0xa0f188
mov edx, dword [edi + 0x67]
mov ecx, dword [ebp - 0x820]
jb 0x417ff9
cld
push edi
mov eax, dword [0x48d0b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
je 0x417c87
jne 0x417c87
push 0xeeb100
push 0x113ad330
mov eax, 0x103397e4
push 0x100adafc
adc al, 0xb1
jle 0x4180d8
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
je 0x417db9
jne 0x417db9
mov byte [ebp - 4], 0x9d
mov eax, 0x106df8a0
push 0xe3c580
mov dword [0xde5120], eax
mov eax, dword [0x6a006a]
push 0
push 0
push 0
jmp 0x417ec0
cmp esi, ebx
je 0x417ddd
push esi
je 0x417dd7
jne 0x417dd7
cmp byte [edx + 0x95], 0
cmp ebx, 0x113
adc al, 0xba
push es
pop edi
push 5
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, ebx
je 0x418029
mov edx, dword [ebp - 0x20]
push 0x17
push edx
je 0x417cb3
jne 0x417cb3
mov eax, 0x10534d98
push 0xa14700
mov dword [esi + ecx], 0x1025217c
add bl, bl
lea eax, [esi - 0x118]
push es
jg 0x418188
push cs
jl 0x41814f
and eax, 0x8ddb0210
xchg al, ch
invalid
dec ebp
mov byte [0x4d8d5011], al
int3
add cl, bl
inc eax
js 0x41813a
inc eax
xor cl, byte [esp + ecx*8 - 0x33333334]
int3
jae 0x41812b
add byte [ebx - 0x39b99d38], al
popfd
or byte [ebx + eax*8 - 0x75], 0x65
call 0xff3dc762
invalid