Function at 0x413170
Capabilities:
Create service
Delete service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x452074]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x118
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
add esp, 4
xor eax, eax
test esi, esi
jne 0x4131b0
mov dword [0x1a37aec], 0xfffffffd
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041abcf
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x105], eax
mov dword [esi + 0x109], eax
mov dword [esi + 0x10d], eax
push 0x105
mov dword [esi + 0x111], eax
push 0
mov word [esi + 0x115], ax
push esi
mov byte [esi + 0x117], al
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4133d5
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x413200
sub ecx, edx
je 0x4133d5
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x413214
sub ecx, edx
je 0x413233
nop
cmp byte [ecx + esi], 0x5c
lea eax, [ecx + esi]
je 0x413230
sub ecx, 1
jne 0x413220
jmp 0x413233
mov byte [eax], 0
push edi
push str.kernel32
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x413269
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x413269
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
cmp dword [ebp - 8], 0
mov eax, 0x44870c
jne 0x413279
mov eax, 0x445387
push ebx
push eax
push str.HwRwDrv
push esi
push str._s_s_s.sys
push 0x104
push esi
call fcn.00401e40
add esp, 0x18
mov ebx, 1
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [esi + 0x108], eax
test eax, eax
je 0x41335c
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea esp, [esp]
push 0
push 0
push 0
push 0
push 0
push esi
push 0
push 3
push 1
push 0xf01ff
push str.HwRwDrv
push str.HwRwDrv
push dword [esi + 0x108]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [esi + 0x10c], eax
test eax, eax
jne 0x413316
push 0xf01ff
push str.HwRwDrv
push dword [esi + 0x108]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [esi + 0x10c], eax
test eax, eax
je 0x413354
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x41338d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x41338d
push dword [esi + 0x10c]
cmp ebx, 1
jne 0x413352
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push dword [esi + 0x10c]
call edi
jmp 0x4132c0
call edi
push dword [esi + 0x108]
call edi
mov eax, dword [esi + 0x114]
test eax, eax
jne 0x41336b
mov eax, 0xfffffff7
push esi
mov dword [0x1a37aec], eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041abcf
mov esp, ebp
pop ebp
ret
push dword [esi + 0x10c]
call edi
push dword [esi + 0x108]
call edi
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..HwRwDrv
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x110], eax
cmp eax, 0xffffffff
je 0x41335c
pop ebx
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041abcf
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.msvcrt.dll_free]
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov dword [0x1a37aec], 0xfffffff5
xor eax, eax
pop esi
call fcn.0041abcf
mov esp, ebp
pop ebp
ret