Function at 0x45adc0
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4cacd7
mov eax, dword fs:[0]
push eax
sub esp, 0x640
mov eax, dword [0x500770]
xor eax, esp
mov dword [esp + 0x638], eax
push ebx
push esi
push edi
mov eax, dword [0x500770]
xor eax, esp
push eax
lea eax, [esp + 0x650]
mov dword fs:[0], eax
mov edi, ecx
call fcn.00488fda
test eax, eax
je 0x45b0b2
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x74]
call eax
test eax, eax
mov dword [esp + 0x14], eax
je 0x45b0b2
mov ecx, dword [edi + 0x388]
mov esi, dword [eax + 0x1d0c]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0xf0
push ecx
add esi, 0x10
call ebx
test eax, eax
push 0
setne dl
push 0
mov byte [esi + 0x3f], dl
mov eax, dword [edi + 0x3dc]
push 0xf0
push eax
call ebx
push 0
test eax, eax
setne cl
push 0
mov byte [esi + 0x40], cl
mov edx, dword [edi + 0x334]
push 0xf0
push edx
call ebx
push 0
test eax, eax
setne al
push 0
mov byte [esi + 0x41], al
mov ecx, dword [edi + 0x1e4]
push 0xf0
push ecx
mov byte [esp + 0x23], 0
mov byte [esp + 0x21], 0
mov byte [esp + 0x22], 0
call ebx
test eax, eax
je 0x45aeab
mov byte [esp + 0x12], 1
mov edx, dword [edi + 0x238]
push 0
push 0
push 0xf0
push edx
call ebx
test eax, eax
je 0x45aed0
mov byte [esp + 0x13], 1
mov byte [esp + 0x11], 1
mov byte [esp + 0x12], 1
mov eax, dword [edi + 0x28c]
push 0
push 0
push 0xf0
push eax
call ebx
test eax, eax
je 0x45aef5
mov byte [esp + 0x13], 1
mov byte [esp + 0x11], 1
mov byte [esp + 0x12], 0
mov ecx, dword [edi + 0x2e0]
push 0
push 0
push 0xf0
push ecx
call ebx
test eax, eax
je 0x45af16
mov bl, 1
mov byte [esp + 0x11], 0
mov al, bl
jmp 0x45af1e
mov al, byte [esp + 0x12]
mov bl, byte [esp + 0x13]
test al, al
mov eax, dword [esp + 0x14]
setne dl
mov byte [esi + 0x3e], dl
mov edi, dword [eax + 0x1d0c]
call fcn.00404500
xor ecx, ecx
test bl, bl
setne cl
xor edi, edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], ecx
push 0xf003f
push str.ServicesActive
push edi
mov dword [esp + 0x664], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
cmp esi, edi
je 0x45b0b2
push esi
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov edi, eax
mov dword [esp + 0x20], edi
push 0xf01ff
push str.PeanuthullDDNSCore
push esi
mov byte [esp + 0x664], 1
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x45afab
test edi, edi
je 0x45af9f
push edi
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x45b0b2
push 0
push 0
push 0
xor eax, eax
cmp dword [esp + 0x20], 1
push 0
push 0
setne al
push 0
push 0
push 0xffffffffffffffff
add eax, 2
push eax
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test edi, edi
je 0x45afe3
push edi
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
xor edi, edi
mov dword [esp + 0x20], edi
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call ebx
push esi
mov dword [esp + 0x18], 0
call ebx
cmp byte [esp + 0x11], 0
mov dword [esp + 0x1c], 0
jne 0x45b042
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x4e55c0
call fcn.00401f00
push ecx
mov byte [esp + 0x660], 2
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.SOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN
call fcn.00401f00
mov byte [esp + 0x660], 1
call fcn.004106a0
add esp, 8
jmp 0x45b0a7
push 0x618
lea edx, [esp + 0x30]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00401f00
push ecx
mov byte [esp + 0x660], 3
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4e55c0
call fcn.00401f00
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push str.SOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN
mov byte [esp + 0x668], 4
call fcn.00401f00
mov byte [esp + 0x664], 1
call fcn.00410760
add esp, 0xc
test edi, edi
je 0x45b0b2
push edi
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov ecx, dword [esp + 0x650]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x638]
xor ecx, esp
call fcn.004a74b2
mov esp, ebp
pop ebp
ret