Function at 0x42f8d0
Capabilities:
Create service
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fd6b
mov eax, dword fs:[0]
push eax
sub esp, 0x164
mov eax, dword [0x468738]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 0x168], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x164], edx
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x154], ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x150], edi
mov dword [ebp - 0x14c], edi
mov dword [ebp - 0x148], edi
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 4], edi
mov dword [ebp - 0x13c], edi
mov dword [ebp - 0x138], edx
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x42f962
sub eax, dword [ebp - 0x138]
sar eax, 1
je 0x42fa00
push 0x2c
lea ebx, [ebp - 0x150]
call fcn.004368d0
mov ecx, dword [ebp - 0x14c]
mov ebx, dword [ebp - 0x150]
sub ecx, ebx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add esp, 4
add eax, edx
je 0x42f9bd
lea ecx, [ebx + 0x10]
mov edx, dword [ecx]
add ecx, 0x1c
dec eax
lea edi, [edi + edx + 1]
jne 0x42f9b1
inc edi
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
mov dword [ebp - 0x138], edi
neg ecx
or ecx, eax
push ecx
call fcn.00437647
add esp, 4
mov dword [ebp - 0x13c], eax
push eax
lea eax, [ebp - 0x138]
lea ebx, [ebp - 0x150]
call fcn.00436530
mov ebx, dword [ebp - 0x16c]
add esp, 4
mov eax, dword [ebx + 4]
test eax, eax
je 0x42fa0e
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ecx, ecx
push ecx
push ecx
mov eax, esi
and eax, 0x10000000
cmp ecx, eax
mov eax, dword [ebp - 0x13c]
push eax
mov eax, dword [ebp - 0x154]
push ecx
push ecx
mov ecx, dword [ebp - 0x15c]
push ecx
mov ecx, dword [ebp - 0x168]
sbb edx, edx
push 1
neg edx
mov dword [ebp - 0x140], edx
mov edx, dword [ebp - 0x164]
and esi, 0xefffffff
push esi
push edx
mov edx, dword [ebx]
push 0xf003f
push eax
push ecx
push edx
mov dword [ebx + 4], 0
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebx + 4], eax
test eax, eax
je 0x42fb20
mov ecx, dword [ebp - 0x160]
mov esi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
lea edx, [ebp - 0x158]
push edx
push 1
push eax
mov dword [ebp - 0x158], ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42faab
call edi
mov dword [ebp - 0x134], eax
test eax, eax
jne 0x42fb2c
push 0x11c
lea eax, [ebp - 0x130]
push 0
push eax
call fcn.00443550
add esp, 0xc
lea ecx, [ebp - 0x130]
push ecx
mov dword [ebp - 0x130], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx eax, byte [ebp - 0x12c]
movzx edx, byte [ebp - 0x128]
movzx ecx, byte [ebp - 0x16]
shl eax, 8
or eax, edx
movzx edx, byte [ebp - 0x1c]
shl eax, 8
or eax, ecx
shl eax, 8
or eax, edx
cmp eax, 0x6000100
jb 0x42fb2c
cmp eax, 0xffffffff
ja 0x42fb2c
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0x140]
push eax
push 3
push ecx
call esi
test eax, eax
jne 0x42fb2c
call edi
jmp 0x42fb26
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x13c]
test eax, eax
je 0x42fb3f
push eax
call fcn.00439ca1
add esp, 4
mov esi, dword [ebp - 0x150]
test esi, esi
je 0x42fb8e
mov ebx, dword [ebp - 0x14c]
cmp esi, ebx
je 0x42fb85
mov edi, 7
cmp dword [esi + 0x14], 8
jb 0x42fb69
mov edx, dword [esi]
push edx
call fcn.00438b4b
add esp, 4
xor eax, eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], 0
mov word [esi], ax
add esi, 0x1c
cmp esi, ebx
jne 0x42fb58
mov esi, dword [ebp - 0x150]
push esi
call fcn.00438b4b
add esp, 4
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004377c1
mov esp, ebp
pop ebp
ret 0x18