Function at 0x4106e0
Capabilities:
Access the windows event log
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b68f1
mov eax, dword fs:[0]
push eax
sub esp, 0x30c
mov eax, dword [0x506054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x310], 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x410810
call fcn.0040bd30
mov ecx, eax
test ecx, ecx
je 0x4112cc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2e8], eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x2e8]
push str.GetModuleFileName_failed_with_error__d
push eax
call fcn.0040b570
mov esi, dword [ebp - 0x2e8]
add esp, 0xc
cmp dword [esi - 4], 1
jle 0x410793
push dword [esi - 0xc]
lea ecx, [ebp - 0x2e8]
call fcn.0040b4a0
mov esi, dword [ebp - 0x2e8]
push 0x4ede8c
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov edi, eax
test edi, edi
je 0x4107f6
push esi
push 0x4ed750
lea eax, [ebp - 0xb0]
push 0x50
push eax
call fcn.00410230
add esp, 0x10
mov dword [ebp - 0x2bc], 0x4ede8c
lea eax, [ebp - 0xb0]
mov dword [ebp - 0x2c0], eax
lea eax, [ebp - 0x2c0]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jmp 0x410f6e
call fcn.0040bd30
mov ecx, eax
test ecx, ecx
je 0x4112cc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2ec], eax
lea eax, [ebp - 0x2b8]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x2ec]
push str.__s_
push eax
call fcn.0040b570
mov esi, dword [ebp - 0x2ec]
add esp, 0xc
cmp dword [esi - 4], 1
jle 0x41086f
push dword [esi - 0xc]
lea ecx, [ebp - 0x2ec]
call fcn.0040b4a0
mov esi, dword [ebp - 0x2ec]
mov eax, dword [esi - 0xc]
inc eax
push esi
push eax
lea eax, [ebp - 0x2b8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x314], ebx
test ebx, ebx
jne 0x41098a
call fcn.0040bd30
mov ecx, eax
test ecx, ecx
je 0x4112fe
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2e8], eax
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x2e8]
push str.OpenSCManager_failed_with_error__d
push eax
call fcn.0040b570
mov edi, dword [ebp - 0x2e8]
add esp, 0xc
cmp dword [edi - 4], 1
jle 0x410900
push dword [edi - 0xc]
lea ecx, [ebp - 0x2e8]
call fcn.0040b4a0
mov edi, dword [ebp - 0x2e8]
push 0x4ede8c
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov ebx, eax
test ebx, ebx
je 0x410963
push edi
push 0x4ed750
lea eax, [ebp - 0xb0]
push 0x50
push eax
call fcn.00410230
add esp, 0x10
mov dword [ebp - 0x2bc], 0x4ede8c
lea eax, [ebp - 0xb0]
mov dword [ebp - 0x2c0], eax
lea eax, [ebp - 0x2c0]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
or ebx, 0xffffffff
mov byte [ebp - 4], 1
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x410f5c
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x410f5c
cmp dword [esi - 4], 1
jle 0x4109a4
push dword [esi - 0xc]
lea ecx, [ebp - 0x2ec]
call fcn.0040b4a0
mov esi, dword [ebp - 0x2ec]
push 0
push 0
push 0
push 0
push 0
push esi
push 1
push 2
push 0x10
push 0xf01ff
push 0x4ede8c
push 0x4ede8c
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
or ebx, 0xffffffff
mov dword [ebp - 0x2e8], eax
test eax, eax
jne 0x410f94
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x431
jne 0x410e6a
push 0xf01ff
push 0x4ede8c
push dword [ebp - 0x314]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2e8], eax
test eax, eax
je 0x410f4e
lea ecx, [ebp - 0x2f0]
mov dword [ebp - 0x2f0], 0
push ecx
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x410cac
call edi
cmp eax, 0x7a
jne 0x410cac
mov eax, dword [ebp - 0x2f0]
push eax
push 0
mov dword [ebp - 0x308], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov eax, dword [ebp - 0x308]
test eax, eax
je 0x410ca6
test edi, edi
je 0x410ca6
lea ecx, [ebp - 0x2f0]
push ecx
push eax
push edi
push dword [ebp - 0x2e8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x410aa3
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push str.QueryServiceConfig_failed___d_
call fcn.0040be80
add esp, 8
jmp 0x410cac
mov edx, dword [edi + 0xc]
test edx, edx
jne 0x410aae
xor ecx, ecx
jmp 0x410ac2
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410ab3
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2ec]
call fcn.0040b8e0
mov esi, dword [ebp - 0x2ec]
cmp dword [esi - 0xc], 0
jl 0x410af8
push 0x4edff0
push esi
call dword [sym.imp.VCRUNTIME140.dll_wcsstr]
add esp, 8
test eax, eax
je 0x410af8
sub eax, esi
sar eax, 1
je 0x410ca6
mov byte [ebp - 4], 3
mov ecx, dword [esi - 0x10]
mov dword [ebp - 0x2e4], 0
test ecx, ecx
je 0x410b18
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x410b2e
call fcn.0040bd30
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x4112d6
mov eax, dword [ecx]
call dword [eax + 0xc]
push dword [esi - 0xc]
add eax, 0x10
mov dword [ebp - 0x310], 2
push esi
push 1
mov edx, 0x4edff0
mov dword [ebp - 0x2e4], eax
lea ecx, [ebp - 0x2e4]
call fcn.004134b0
add esp, 0xc
mov byte [ebp - 4], 4
mov edi, dword [ebp - 0x2e4]
mov ecx, dword [edi - 0x10]
lea eax, [edi - 0x10]
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x2bc], eax
test ecx, ecx
je 0x410b8e
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x410ba4
call fcn.0040bd30
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x4112e0
mov eax, dword [ecx]
call dword [eax + 0xc]
push 1
push 0x4edff0
push dword [edi - 0xc]
add eax, 0x10
mov dword [ebp - 0x310], 3
mov edx, edi
mov dword [ebp - 0x30c], eax
lea ecx, [ebp - 0x30c]
call fcn.004134b0
mov eax, dword [ebp - 0x30c]
lea edi, [esi - 0x10]
add esp, 0xc
lea edx, [eax - 0x10]
mov dword [ebp - 0x308], edx
cmp edx, edi
je 0x410c47
cmp dword [edi + 0xc], 0
lea esi, [edi + 0xc]
jl 0x410c2c
mov ecx, dword [edx]
cmp ecx, dword [edi]
jne 0x410c2c
mov ecx, edx
call fcn.004135a0
mov dword [ebp - 0x2c4], eax
mov ecx, ebx
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x410c21
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x2c4]
lea esi, [eax + 0x10]
mov dword [ebp - 0x2ec], esi
jmp 0x410c41
push dword [eax - 0xc]
lea ecx, [ebp - 0x2ec]
push eax
call fcn.0040b8e0
mov esi, dword [ebp - 0x2ec]
mov edx, dword [ebp - 0x308]
mov dword [ebp - 0x310], 2
mov eax, ebx
mov byte [ebp - 4], 3
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x410c69
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, ebx
mov edx, dword [ebp - 0x2bc]
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x410c87
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp - 0x2e8]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x2e0]
mov dword [ebp - 0x2e0], 1
mov dword [ebp - 0x2f4], eax
lea eax, [ebp - 0x304]
push eax
push 2
push dword [ebp - 0x2e8]
mov dword [ebp - 0x2dc], 0x1d4c0
mov dword [ebp - 0x2d8], 1
mov dword [ebp - 0x2d4], 0x1d4c0
mov dword [ebp - 0x2d0], 1
mov dword [ebp - 0x2cc], 0x493e0
mov dword [ebp - 0x304], 0x384
mov dword [ebp - 0x300], 0
mov dword [ebp - 0x2fc], 0
mov dword [ebp - 0x2f8], 3
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x410e1d
call fcn.0040bd30
mov ecx, eax
test ecx, ecx
je 0x4112ea
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2e4], eax
mov byte [ebp - 4], 5
call edi
push eax
lea eax, [ebp - 0x2e4]
push str.ChangeServiceConfig2_failed_with_error__d
push eax
call fcn.0040b570
mov edi, dword [ebp - 0x2e4]
add esp, 0xc
cmp dword [edi - 4], 1
jle 0x410d91
push dword [edi - 0xc]
lea ecx, [ebp - 0x2e4]
call fcn.0040b4a0
mov edi, dword [ebp - 0x2e4]
push 0x4ede8c
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [ebp - 0x308], eax
test eax, eax
je 0x410e02
push edi
push 0x4ed750
lea eax, [ebp - 0xb0]
push 0x50
push eax
call fcn.00410230
add esp, 0x10
mov dword [ebp - 0x2bc], 0x4ede8c
lea eax, [ebp - 0xb0]
mov dword [ebp - 0x2c0], eax
lea eax, [ebp - 0x2c0]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push 1
push dword [ebp - 0x308]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push dword [ebp - 0x308]
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov byte [ebp - 4], 1
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x410e1d
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x2bc]
mov dword [ebp - 0x2bc], 1
push eax
push 3
push dword [ebp - 0x2e8]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x4112b9
call fcn.0040bd30
mov ecx, eax
test ecx, ecx
je 0x4112f4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2e4], eax
mov byte [ebp - 4], 6
jmp 0x4111f2
call fcn.0040bd30
mov ecx, eax
test ecx, ecx
je 0x4112fe
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2e4], eax
mov byte [ebp - 4], 7
call edi
push eax
lea eax, [ebp - 0x2e4]
push str.OpenSCManager_failed_with_error__d
push eax
call fcn.0040b570
mov edi, dword [ebp - 0x2e4]
add esp, 0xc
cmp dword [edi - 4], 1
jle 0x410ec2
push dword [edi - 0xc]
lea ecx, [ebp - 0x2e4]
call fcn.0040b4a0
mov edi, dword [ebp - 0x2e4]
push 0x4ede8c
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [ebp - 0x308], eax
test eax, eax
je 0x410f33
push edi
push 0x4ed750
lea eax, [ebp - 0xb0]
push 0x50
push eax
call fcn.00410230
add esp, 0x10
mov dword [ebp - 0x2bc], 0x4ede8c
lea eax, [ebp - 0xb0]
mov dword [ebp - 0x2c0], eax
lea eax, [ebp - 0x2c0]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push 1
push dword [ebp - 0x308]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push dword [ebp - 0x308]
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov byte [ebp - 4], 1
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x410f4e
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x314]
call edi
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x410f78
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004364d3
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x2bc]
mov dword [ebp - 0x2bc], str.Provides_access_to_the_Razer_Stream_API
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x41109e
call fcn.0040bd30
mov ecx, eax
test ecx, ecx
je 0x411308
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2e4], eax
mov byte [ebp - 4], 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x2e4]
push str.ChangeServiceConfig2_failed_with_error__d
push eax
call fcn.0040b570
mov edi, dword [ebp - 0x2e4]
add esp, 0xc
cmp dword [edi - 4], 1
jle 0x411012
push dword [edi - 0xc]
lea ecx, [ebp - 0x2e4]
call fcn.0040b4a0
mov edi, dword [ebp - 0x2e4]
push 0x4ede8c
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [ebp - 0x308], eax
test eax, eax
je 0x411083
push edi
push 0x4ed750
lea eax, [ebp - 0xb0]
push 0x50
push eax
call fcn.00410230
add esp, 0x10
mov dword [ebp - 0x2c4], 0x4ede8c
lea eax, [ebp - 0xb0]
mov dword [ebp - 0x2c8], eax
lea eax, [ebp - 0x2c8]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push 1
push dword [ebp - 0x308]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push dword [ebp - 0x308]
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov byte [ebp - 4], 1
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x41109e
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x2e8]
lea eax, [ebp - 0x2e0]
mov dword [ebp - 0x2f4], eax
lea eax, [ebp - 0x304]
push eax
push 2
push edi
mov dword [ebp - 0x2e0], 1
mov dword [ebp - 0x2dc], 0x1d4c0
mov dword [ebp - 0x2d8], 1
mov dword [ebp - 0x2d4], 0x1d4c0
mov dword [ebp - 0x2d0], 1
mov dword [ebp - 0x2cc], 0x493e0
mov dword [ebp - 0x304], 0x384
mov dword [ebp - 0x300], 0
mov dword [ebp - 0x2fc], 0
mov dword [ebp - 0x2f8], 3
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x4111af
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x50e588]
cmp eax, dword [ecx + 4]
jle 0x41118a
push 0x50e588
call fcn.00436657
add esp, 4
cmp dword [0x50e588], 0xffffffff
jne 0x41118a
push 0x210
push 0
push 0x50e378
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call fcn.0040a390
push 0x4be580
call fcn.00436969
add esp, 4
push 0x50e588
call fcn.0043660d
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._Service__ChangeServiceConfig2_Error___ld
push 0x172
push str.c:workspacechromastreamJIRA_SOFTWARE_1689StreamServerSDKService.cpp
push 1
push 0x50e378
call fcn.0040a5d0
add esp, 0x18
lea eax, [ebp - 0x2bc]
mov dword [ebp - 0x2bc], 1
push eax
push 3
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x4112b9
call fcn.0040bd30
mov ecx, eax
test ecx, ecx
je 0x411312
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2e4], eax
mov byte [ebp - 4], 9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x2e4]
push str.ChangeServiceConfig2_failed_with_error__d
push eax
call fcn.0040b570
mov edi, dword [ebp - 0x2e4]
add esp, 0xc
cmp dword [edi - 4], 1
jle 0x41122d
push dword [edi - 0xc]
lea ecx, [ebp - 0x2e4]
call fcn.0040b4a0
mov edi, dword [ebp - 0x2e4]
push 0x4ede8c
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [ebp - 0x308], eax
test eax, eax
je 0x41129e
push edi
push 0x4ed750
lea eax, [ebp - 0xb0]
push 0x50
push eax
call fcn.00410230
add esp, 0x10
mov dword [ebp - 0x2c4], 0x4ede8c
lea eax, [ebp - 0xb0]
mov dword [ebp - 0x2c8], eax
lea eax, [ebp - 0x2c8]
push 0
push eax
push 0
push 2
push 0
push 0
push 0
push 1
push dword [ebp - 0x308]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push dword [ebp - 0x308]
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, ebx
mov byte [ebp - 4], 1
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4112b9
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x2e8]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
jmp 0x410f54
push 0x80004005
call fcn.0040bb00
push 0x80004005
call fcn.0040bb00
push 0x80004005
call fcn.0040bb00
push 0x80004005
call fcn.0040bb00
push 0x80004005
call fcn.0040bb00
push 0x80004005
call fcn.0040bb00
push 0x80004005
call fcn.0040bb00
push 0x80004005
call fcn.0040bb00
int3