Function at 0x4335f1
Capabilities:
Create service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x10b0
call fcn.00442470
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, ecx
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x10a8], ecx
mov ebx, edx
xor ecx, ecx
mov dword [ebp - 0x10a0], ebx
mov dword [ebp - 0x1098], eax
mov esi, ecx
mov dword [ebp - 0x109c], ecx
push edi
cmp eax, 0xffffffff
je 0x4336d7
test ebx, ebx
je 0x4336d7
lea eax, [ebp - 0x108c]
mov dword [ebp - 0x108c], ecx
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupGetLineTextW]
test eax, eax
je 0x4336ab
mov eax, dword [ebp - 0x108c]
xor ecx, ecx
inc eax
push 2
pop edx
mov dword [ebp - 0x108c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044183a
mov edi, eax
mov dword [ebp - 0x10b0], edi
pop ecx
test edi, edi
je 0x4336d7
xor eax, eax
push eax
push dword [ebp - 0x108c]
push edi
push eax
push eax
push eax
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupGetLineTextW]
test eax, eax
jne 0x4336ec
push edi
call fcn.00441807
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x4336bc
push 0x57
pop esi
test esi, esi
jle 0x4336c7
movzx esi, si
or esi, 0x80070000
push esi
push 0x408d30
push 4
call fcn.0041ea5f
add esp, 0xc
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret 0xc
push 0x4059e8
push edi
jmp 0x433b0b
push edi
push 0x408d70
push 4
call fcn.0041ea5f
add esp, 0xc
xor eax, eax
push ebx
push eax
push edi
push dword [ebp - 0x1098]
call dword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x433b03
push edi
push dword [ebp - 0x1098]
mov dword [ebp - 0x1088], 1
call dword [sym.imp.SETUPAPI.dll_SetupGetLineCountW]
mov edi, eax
mov ecx, edi
mov dword [ebp - 0x10ac], edi
call fcn.0041de27
cmp edi, 1
jb 0x433b03
mov edi, dword [ebp - 0x1088]
mov ecx, edi
call fcn.0041dfa0
xor eax, eax
inc edi
push eax
push 0x105
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x1088], edi
push eax
push 1
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x433aeb
xor eax, eax
push eax
push 0x105
lea eax, [ebp - 0xc6c]
push eax
push 2
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x433aeb
xor eax, eax
push eax
push 0x105
lea eax, [ebp - 0xa5c]
push eax
push 3
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x433aeb
xor eax, eax
push eax
push 0x105
lea eax, [ebp - 0x63c]
push eax
push 4
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x433aeb
xor eax, eax
push eax
push 0x105
lea eax, [ebp - 0x84c]
push eax
push 5
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x433aeb
xor eax, eax
push eax
push 0x105
lea eax, [ebp - 0x42c]
push eax
push 6
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x433aeb
xor esi, esi
lea eax, [ebp - 0x1084]
push eax
lea edx, [ebp - 0x1090]
mov dword [ebp - 0x1090], esi
lea ecx, [ebp - 0x42c]
mov dword [ebp - 0x1084], esi
mov edi, esi
call fcn.004330a1
mov dword [ebp - 0x1080], esi
cmp dword [ebp - 0x1084], esi
jle 0x43391d
mov esi, dword [ebp - 0x1090]
mov ecx, dword [esi]
xor eax, eax
mov dword [ebp - 0x1094], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x109c]
jne 0x433870
sub ecx, edx
sar ecx, 1
test ecx, ecx
jle 0x4338cc
mov edx, 0x208
cmp edi, edx
jge 0x43390e
mov ecx, dword [ebp - 0x1094]
mov eax, dword [esi]
mov ax, word [eax + ecx*2]
mov word [ebp + edi*2 - 0x107c], ax
inc edi
inc ecx
mov dword [ebp - 0x1094], ecx
mov ecx, dword [esi]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x109c]
jne 0x4338b1
sub ecx, edx
sar ecx, 1
cmp dword [ebp - 0x1094], ecx
jl 0x433887
mov edx, 0x208
cmp edi, edx
jge 0x43390e
lea eax, [edi + edi]
inc edi
cmp eax, 0x410
jae 0x433b2e
xor ecx, ecx
add esi, 4
mov word [ebp + eax - 0x107c], cx
mov eax, dword [ebp - 0x1080]
inc eax
mov dword [ebp - 0x1080], eax
cmp eax, dword [ebp - 0x1084]
jl 0x433863
cmp edi, edx
jl 0x43391b
mov esi, 0x80004005
mov dword [ebp - 0x1080], esi
jmp 0x43393b
xor esi, esi
add edi, edi
mov dword [ebp - 0x1080], esi
cmp edi, 0x410
jae 0x433b2e
xor eax, eax
mov word [ebp + edi - 0x107c], ax
xor eax, eax
mov edi, eax
cmp dword [ebp - 0x1084], eax
jle 0x433975
mov ebx, dword [ebp - 0x1090]
xor esi, esi
cmp dword [ebx + edi*4], esi
je 0x433960
push dword [ebx + edi*4]
call fcn.00441807
pop ecx
mov dword [ebx + edi*4], esi
inc edi
cmp edi, dword [ebp - 0x1084]
jl 0x43394f
mov esi, dword [ebp - 0x1080]
mov ebx, dword [ebp - 0x10a0]
mov eax, dword [ebp - 0x1090]
test eax, eax
je 0x433986
push eax
call fcn.00441807
pop ecx
test esi, esi
js 0x433ae5
push 0x10
lea eax, [ebp - 0x10a4]
push eax
lea eax, [ebp - 0x63c]
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
mov dword [ebp - 0x1080], eax
cmp dword [ebp + 0x10], 0xffffffff
jne 0x4339cf
push 0x10
lea eax, [ebp - 0x10a4]
push eax
lea eax, [ebp - 0x84c]
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
mov dword [ebp + 0x10], eax
push 0xf003f
xor eax, eax
xor edi, edi
push eax
push eax
inc edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x433a7a
xor ecx, ecx
lea eax, [ebp - 0x107c]
push ecx
push 0x408c20
push eax
push ecx
push ecx
lea eax, [ebp - 0xa5c]
push eax
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 0xc6c]
push dword [ebp - 0x1080]
push 0xf003f
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
je 0x433a47
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x408aa0
lea eax, [ebp - 0x21c]
push eax
push 0x408c54
push 4
jmp 0x433a67
xor eax, eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x433a58
push 0x57
pop eax
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x408c70
push 2
call fcn.0041ea5f
add esp, 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
jmp 0x433aa2
xor esi, esi
mov edi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x433a8b
push 0x57
pop eax
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x408b00
push 2
call fcn.0041ea5f
add esp, 0x10
test edi, edi
jne 0x433ace
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x433ab7
push 0x57
pop esi
test esi, esi
jle 0x433ac6
movzx esi, si
or esi, 0x80070000
test edi, edi
jne 0x433ace
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x433ae5
mov ecx, dword [ebp - 0x10a8]
lea eax, [ebp - 0x21c]
push eax
mov edx, 0x104
call fcn.0040c010
mov edi, dword [ebp - 0x1088]
push ebx
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupFindNextLine]
test eax, eax
je 0x433b03
cmp edi, dword [ebp - 0x10ac]
jbe 0x433755
push 0x4059e8
xor eax, eax
push eax
call dword [sym.imp.msvcrt.dll_wcstok]
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x4336f7
push dword [ebp - 0x10b0]
call fcn.00441807
pop ecx
jmp 0x4336d7
call fcn.00441cda
int3