Function at 0x43ba60
Capabilities:
Check os version
Create process on windows
Delete file
Delete service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c4
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x7ac], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43bacd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x49e950
push 0x49e944
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0xc
jmp 0x43c0c5
cmp dword [0x4c36c8], 1
jne 0x43bcb9
push 0x10
push 0x49e998
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43bb20
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x49e9b0
push 0x49e9bc
push 0x49e9a4
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0x10
jmp 0x43c0c5
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x43bb63
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x49ea08
push 0x49ea20
push 0x49e9fc
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0x10
jmp 0x43c0c5
mov edx, dword [ebp - 0x7ac]
cmp dword [edx + 0x34], 0
jle 0x43bca3
call fcn.0046a130
mov dword [ebp - 0x7b0], eax
lea eax, [ebp - 0x58c]
push eax
mov ecx, dword [ebp - 0x7b0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x7b0]
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x43bca3
mov dword [ebp - 0x594], 0
mov dword [ebp - 0x590], 0
call fcn.0046a130
mov dword [ebp - 0x7b4], eax
lea ecx, [ebp - 0x590]
push ecx
lea edx, [ebp - 0x594]
push edx
mov eax, dword [ebp - 0x58c]
push eax
mov ecx, dword [ebp - 0x7b4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x7b4]
mov eax, dword [edx + 0x70]
call eax
test eax, eax
jne 0x43bc0b
push 0x49ea60
push 0x49ea14
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 8
jmp 0x43bc96
cmp dword [ebp - 0x594], 0
je 0x43bc1d
cmp dword [ebp - 0x590], 0
jne 0x43bc48
mov ecx, dword [ebp - 0x590]
push ecx
mov edx, dword [ebp - 0x594]
push edx
push 0x49ea9c
push 0x49ea90
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0x10
jmp 0x43bc96
call fcn.0046a130
mov dword [ebp - 0x7b8], eax
push 1
mov eax, dword [ebp - 0x58c]
push eax
mov ecx, dword [ebp - 0x7b8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x7b8]
mov eax, dword [edx + 0x20]
call eax
test eax, eax
jne 0x43bc8e
push 0x49eacc
push 0x49eac0
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 8
xor ecx, ecx
jne 0x43bba0
mov edx, dword [ebp - 0x58c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 8], 0
jmp 0x43bec8
mov ecx, dword [ebp - 0x7ac]
cmp dword [ecx + 0x34], 0
jle 0x43bdf9
call fcn.0046a130
mov dword [ebp - 0x7bc], eax
lea edx, [ebp - 0x598]
push edx
mov eax, dword [ebp - 0x7bc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x7bc]
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x43bdf9
mov dword [ebp - 0x5a0], 0
mov dword [ebp - 0x59c], 0
call fcn.0046a130
mov dword [ebp - 0x7c0], eax
lea ecx, [ebp - 0x59c]
push ecx
lea edx, [ebp - 0x5a0]
push edx
mov eax, dword [ebp - 0x598]
push eax
mov ecx, dword [ebp - 0x7c0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x7c0]
mov eax, dword [edx + 0x70]
call eax
test eax, eax
jne 0x43bd61
push 0x49eb00
push 0x49eaf4
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 8
jmp 0x43bdec
cmp dword [ebp - 0x5a0], 0
je 0x43bd73
cmp dword [ebp - 0x59c], 0
jne 0x43bd9e
mov ecx, dword [ebp - 0x59c]
push ecx
mov edx, dword [ebp - 0x5a0]
push edx
push 0x49eb3c
push 0x49eb30
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0x10
jmp 0x43bdec
call fcn.0046a130
mov dword [ebp - 0x7c4], eax
push 1
mov eax, dword [ebp - 0x598]
push eax
mov ecx, dword [ebp - 0x7c4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x7c4]
mov eax, dword [edx + 0x20]
call eax
test eax, eax
jne 0x43bde4
push 0x49eb6c
push 0x49eb60
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 8
xor ecx, ecx
jne 0x43bcf6
mov edx, dword [ebp - 0x598]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4c36bc], 0
je 0x43bec8
push 0x10000
push str.ObHook
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43bec8
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x43be57
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_del_service_ObHook__0x_x
push 0x49eba4
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 8], 0
push 0x104
lea eax, [ebp - 0x7a8]
push eax
call fcn.0040a790
add esp, 8
push str.ObHook.sys
push 0x104
lea ecx, [ebp - 0x7a8]
push ecx
call fcn.00472b79
add esp, 0xc
lea edx, [ebp - 0x7a8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x43bec8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_del_ObHook.sys__0x_x
push 0x49ec0c
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0xc
push 0x10
push 0x49ec54
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43bf0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x49ec78
push 0x49ec90
push 0x49ec6c
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0x10
jmp 0x43c0c5
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x43bf4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x49ecdc
push str.Couldnt_start_service__s__0x_x
push 0x49ecd0
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0x10
jmp 0x43c0c5
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], 0
xor ecx, ecx
mov word [ebp - 0x410], cx
push 0x3fe
push 0
lea edx, [ebp - 0x40e]
push edx
call fcn.00472990
add esp, 0xc
mov eax, dword [0x4c36a0]
push eax
push str._sSMain.exe__boot
lea ecx, [ebp - 0x410]
push ecx
call fcn.00441b10
add esp, 0xc
mov dword [ebp - 0x588], 0
push 0x118
push 0
lea edx, [ebp - 0x584]
push edx
call fcn.00472990
add esp, 0xc
mov dword [ebp - 0x588], 0x11c
lea eax, [ebp - 0x588]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x584], 5
jbe 0x43c009
lea ecx, [ebp - 0x410]
push ecx
mov ecx, dword [ebp - 0x7ac]
call fcn.0043b8e0
test eax, eax
je 0x43c009
mov dword [ebp - 0xc], 1
jmp 0x43c0c5
mov dword [ebp - 0x468], 0
push 0x40
push 0
lea edx, [ebp - 0x464]
push edx
call fcn.00472990
add esp, 0xc
mov dword [ebp - 0x420], 0
xor eax, eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x414], eax
lea ecx, [ebp - 0x420]
push ecx
lea edx, [ebp - 0x468]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x410]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x43c09c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x410]
push ecx
push str._s_0x_x
push 0x49ecf4
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0x10
jmp 0x43c0c5
mov edx, dword [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc], 1
xor ecx, ecx
jne 0x43ba8e
cmp dword [ebp - 8], 0
je 0x43c0dc
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x43c0f3
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret