Function at 0x417f00
Capabilities:
Create service
Modify service

Disassembly:
push 0x70
mov eax, 0x4aa05f
call fcn.004a95a1
mov esi, ecx
mov dword [ebp - 0x5c], esi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x44], ecx
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x417f43
test byte [eax + 0x1c], 1
je 0x417f43
cmp byte [eax + 0x19], 5
jb 0x417f43
push ecx
push dword [eax + 0x14]
mov edx, 0x405830
push dword [eax + 0x10]
push 0x1c
pop ecx
call fcn.00416072
mov edi, 0x4b8970
lea ecx, [ebp - 0x50]
xor ebx, ebx
push edi
mov dword [ebp - 0x40], ebx
call fcn.00417475
push edi
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], ebx
call fcn.00417475
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
push 0x405768
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.0041706d
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x58]
mov eax, dword [esi + 0x24]
push dword [eax - 0xc]
push eax
call fcn.00416cb5
mov edi, dword [esi + 0x28]
mov ecx, edi
call fcn.00416ebc
test eax, eax
je 0x417fab
push edi
push eax
lea ecx, [ebp - 0x50]
call fcn.00416fca
test eax, eax
jne 0x417fba
push 0xf
push 0x4057b0
lea ecx, [ebp - 0x50]
call fcn.0041738c
mov edi, dword [esi + 0x2c]
mov ecx, edi
call fcn.00416ebc
test eax, eax
je 0x417fd6
push edi
push eax
lea ecx, [ebp - 0x4c]
call fcn.00416fca
test eax, eax
jne 0x417fde
lea ecx, [ebp - 0x4c]
call fcn.004171af
mov ecx, esi
call fcn.00417d7a
mov ecx, 0x405340
test eax, eax
jne 0x418406
mov edi, 0xf003f
push edi
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x48], eax
test eax, eax
jne 0x41814b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x40], esi
mov ecx, dword [0x4b70c8]
cmp ecx, 0x4b70c8
je 0x418044
test byte [ecx + 0x1c], 2
je 0x418044
cmp byte [ecx + 0x19], 2
jb 0x418044
push esi
push dword [ecx + 0x14]
mov edx, 0x405830
push dword [ecx + 0x10]
push 0x1d
pop ecx
call fcn.0041610f
lea edi, [ebp - 0x3c]
cmp esi, 5
jne 0x418141
mov esi, 0x4052c0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x40]
push 0x4b8970
lea ecx, [ebp - 0x48]
call fcn.00417475
push edi
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 4
push 0x405818
push eax
call fcn.0041a5a1
mov esi, dword [ebp - 0x48]
lea eax, [ebp - 0x3c]
add esp, 0xc
push ebx
mov ebx, dword [ebp - 0x5c]
mov ecx, ebx
push esi
push dword [ebx + 0x24]
push eax
call fcn.00417c6c
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x4180c4
test byte [eax + 0x1c], 2
je 0x4180c4
cmp byte [eax + 0x19], 2
jb 0x4180c4
push edi
push dword [ebx + 0x24]
mov edx, 0x405830
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x28
pop ecx
call fcn.00417794
lea ecx, [esi - 0x10]
call fcn.004174b0
mov edx, dword [0x4b70c8]
cmp edx, 0x4b70c8
je 0x418108
test byte [edx + 0x1c], 1
je 0x418108
movzx ecx, byte [edx + 0x19]
mov eax, edi
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
cmp ecx, eax
jb 0x418108
push edi
push dword [edx + 0x14]
push dword [edx + 0x10]
mov edx, 0x405830
push 0x29
pop ecx
call fcn.0041610f
mov ecx, dword [ebp - 0x58]
lea ecx, [ecx - 0x10]
call fcn.004174b0
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x418121
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x4c]
lea ecx, [ecx - 0x10]
call fcn.004174b0
mov ecx, dword [ebp - 0x50]
lea ecx, [ecx - 0x10]
call fcn.004174b0
mov eax, edi
call fcn.004a9550
ret 4
mov esi, 0x4052b0
jmp 0x41840b
push 0x4044b4
push 0x4057d0
push dword [ebp - 0x44]
push ebx
push ebx
push dword [0x4b99c0]
push 1
push 3
push 0x10
push 0xf01ff
push dword [ebp - 0x50]
push dword [esi + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x44], eax
test eax, eax
jne 0x4181d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40], eax
mov ecx, dword [0x4b70c8]
cmp ecx, 0x4b70c8
je 0x4181b9
test byte [ecx + 0x1c], 2
je 0x4181b9
cmp byte [ecx + 0x19], 2
jb 0x4181b9
push eax
push dword [esi + 0x24]
mov edx, 0x405830
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x1e
pop ecx
call fcn.00417794
push dword [ebp - 0x48]
mov esi, 0x4052a0
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x41840f
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], ebx
push eax
push edi
push ebx
push dword [ebp - 0x58]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
mov dword [ebp - 0x40], ecx
test ecx, ecx
jne 0x4181fc
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x4c]
lea edi, [ebp - 0x3c]
mov esi, 0x405290
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [eax - 0xc], 0
je 0x41828b
mov dword [ebp - 0x54], eax
mov eax, dword [0x4b70c8]
mov edi, 0x4b70c8
cmp eax, edi
je 0x418241
test byte [eax + 0x1c], 2
je 0x418241
cmp byte [eax + 0x19], 4
jb 0x418241
push dword [eax + 0x14]
mov edx, 0x405830
push dword [eax + 0x10]
push 0x1f
pop ecx
call fcn.00416054
mov esi, dword [ebp - 0x44]
lea eax, [ebp - 0x54]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x418293
mov eax, dword [0x4b70c8]
cmp eax, edi
je 0x418298
test byte [eax + 0x1c], 2
je 0x418298
cmp byte [eax + 0x19], 3
jb 0x418298
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x4b70c8]
mov edx, 0x405830
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x20
pop ecx
call fcn.0041610f
jmp 0x418293
mov esi, dword [ebp - 0x44]
mov edi, 0x4b70c8
mov eax, dword [0x4b70c8]
mov ecx, 0x7530
mov dword [ebp - 0x1c], ebx
xor edx, edx
mov dword [ebp - 0x28], ecx
inc edx
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], 3
mov dword [ebp - 0x6c], ecx
cmp eax, edi
je 0x4182eb
test byte [eax + 0x1c], 2
je 0x4182eb
cmp byte [eax + 0x19], 4
jb 0x4182eb
push dword [eax + 0x14]
mov edx, 0x405830
push dword [eax + 0x10]
push 0x21
pop ecx
call fcn.00416054
lea eax, [ebp - 0x7c]
push eax
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x418330
mov eax, dword [0x4b70c8]
cmp eax, edi
je 0x418330
test byte [eax + 0x1c], 2
je 0x418330
cmp byte [eax + 0x19], 3
jb 0x418330
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x4b70c8]
mov edx, 0x405830
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x22
pop ecx
call fcn.0041610f
push ebx
push 0x2019d
push 2
mov edx, 0x405808
mov ecx, esi
call fcn.004954ee
test eax, eax
jne 0x418370
mov eax, dword [0x4b70c8]
cmp eax, edi
je 0x418375
test byte [eax + 0x1c], 2
je 0x418375
cmp byte [eax + 0x19], 3
jb 0x418375
push dword [eax + 0x14]
mov edx, 0x405830
push dword [eax + 0x10]
push 0x23
pop ecx
call fcn.00416054
mov eax, dword [0x4b70c8]
mov dword [ebp - 0x44], 1
cmp eax, edi
je 0x41839f
test byte [eax + 0x1c], 2
je 0x41839f
cmp byte [eax + 0x19], 4
jb 0x41839f
push dword [eax + 0x14]
mov edx, 0x405830
push dword [eax + 0x10]
push 0x24
pop ecx
call fcn.00416054
lea eax, [ebp - 0x44]
push eax
push 5
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x4183e4
mov eax, dword [0x4b70c8]
cmp eax, edi
je 0x4183e4
test byte [eax + 0x1c], 2
je 0x4183e4
cmp byte [eax + 0x19], 3
jb 0x4183e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x4b70c8]
mov edx, 0x405830
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x25
pop ecx
call fcn.0041610f
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [ebp - 0x40]
test edi, edi
jne 0x41805c
mov esi, 0x405350
jmp 0x418408
mov esi, ecx
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x40]
test edi, edi
jne 0x41805c
mov esi, dword [ebp - 0x5c]
lea eax, [ebp - 0x3c]
push ebx
push ebx
mov ecx, esi
push dword [esi + 0x24]
push eax
call fcn.00417c6c
lea ecx, [ebp - 0x3c]
mov edx, 0x405340
mov eax, dword [edx + ebx*4]
cmp eax, dword [ecx + ebx*4]
jne 0x418483
inc ebx
cmp ebx, 4
jne 0x418435
mov edx, dword [0x4b70c8]
cmp edx, 0x4b70c8
je 0x418108
test byte [edx + 0x1c], 2
je 0x4180d2
cmp byte [edx + 0x19], bl
jb 0x4180d2
push dword [esi + 0x24]
push dword [edx + 0x14]
push dword [edx + 0x10]
push 0x26
mov edx, 0x405830
pop ecx
call fcn.00416072
jmp 0x4180cc
mov edx, dword [0x4b70c8]
cmp edx, 0x4b70c8
je 0x418108
test byte [edx + 0x1c], 2
je 0x4180d2
cmp byte [edx + 0x19], 4
jb 0x4180d2
push dword [esi + 0x24]
push dword [edx + 0x14]
push dword [edx + 0x10]
push 0x27
jmp 0x418473