Function at 0x417cd0
Capabilities:
Check os version
Modify service
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x854
mov eax, dword [0x448044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 2
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x83c], edi
cmp edi, ebx
je 0x41802d
push 0xf01ff
push 0x442c08
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x834], esi
cmp esi, ebx
je 0x41801f
push 0x11c
lea eax, [ebp - 0x128]
push ebx
push eax
call fcn.004279d0
add esp, 0xc
lea ecx, [ebp - 0x128]
push ecx
mov dword [ebp - 0x128], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 6
jb 0x417e29
push str._Resume_Protect__Set_reTry_Action.
call fcn.004042f0
mov eax, 1
mov dword [ebp - 0x830], eax
mov dword [ebp - 0x828], eax
mov eax, 0x3a98
mov dword [ebp - 0x824], eax
mov dword [ebp - 0x81c], eax
mov eax, 0x436474
add esp, 4
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], eax
lea eax, [ebp - 0x854]
push eax
push 2
lea edx, [ebp - 0x830]
push esi
mov dword [ebp - 0x82c], 0xea60
mov dword [ebp - 0x820], ebx
mov dword [ebp - 0x854], 0x15180
mov dword [ebp - 0x848], 3
mov dword [ebp - 0x844], edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x417e29
push 0xfe
lea edx, [ebp - 0x106]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x108], cx
call fcn.004279d0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x108]
push 0x443a78
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x108]
add esp, 0xc
push ecx
call fcn.004042f0
add esp, 4
push 0x206
lea eax, [ebp - 0x416]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x418], dx
call fcn.004279d0
add esp, 0xc
mov dword [ebp - 0x840], ebx
xor eax, eax
nop
movzx ecx, word [eax + str.SYSTEMCurrentControlSet_servicesWin_Win7]
mov word [ebp + eax - 0x418], cx
add eax, 2
cmp cx, bx
jne 0x417e50
lea ecx, [ebp - 0x840]
push ecx
lea edx, [ebp - 0x838]
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x418]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x417f1d
push 0x206
lea edx, [ebp - 0x20e]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x210], cx
call fcn.004279d0
add esp, 0xc
push str._C:Program_FilesWW2017CFwmcSystem7.exe_
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.004217d0
lea eax, [ebp - 0x210]
add esp, 0xc
lea edx, [eax + 2]
jmp 0x417ee0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x417ee0
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x838]
push ecx
lea edx, [ebp - 0x210]
push edx
push 2
push ebx
push 0x435a48
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x838]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x3fe
lea eax, [ebp - 0x816]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x818], dx
call fcn.004279d0
mov ebx, dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
mov esi, 1
lea esp, [esp]
mov ecx, dword [ebp - 0x834]
push 0
push 0
push ecx
call ebx
test eax, eax
jne 0x417fba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea edx, [ebp - 0x818]
push 0x443b80
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x818]
push eax
call fcn.004042f0
add esp, 0x14
cmp esi, 3
je 0x417fff
push 0x1388
call edi
inc esi
cmp esi, 3
jle 0x417f50
mov edx, dword [ebp - 0x83c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret
push esi
lea ecx, [ebp - 0x818]
push 0x443b38
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x818]
add esp, 0xc
push edx
call fcn.004042f0
mov eax, dword [ebp - 0x834]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x834]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x443bd8
jmp 0x418032
push str._Resume_Protect_
call fcn.004042f0
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret