Function at 0x40fb30
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497798
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4c606c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
cmp dword [edi + 0x10], 0
lea ebx, [edi + 0x10]
jne 0x40fc0f
lea ecx, [ebp - 0x48]
call fcn.0044b850
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x40fb85
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4ca1e0
call fcn.0040b1e0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupinstallerservicefactory.cpp
mov ecx, eax
call fcn.0040a3c0
mov edx, 0x4adac4
mov ecx, eax
call fcn.0040a3c0
push 0x129
mov ecx, eax
call fcn.00408a40
mov edx, str.:_Error___empty_service_path
mov ecx, eax
call fcn.0040a3c0
push eax
call fcn.0040a730
mov edx, dword [ebp - 0x34]
add esp, 4
cmp edx, 8
jb 0x40fc08
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40fbfe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ffa0
push edx
push ecx
call fcn.0045a3a4
add esp, 8
xor al, al
jmp 0x40ff82
push 0x60000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 1
test esi, esi
jne 0x40fcef
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x48]
mov esi, eax
call fcn.0044b850
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x40fc51
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4ca1e0
call fcn.0040b1e0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupinstallerservicefactory.cpp
mov ecx, eax
call fcn.0040a3c0
mov edx, 0x4adac4
mov ecx, eax
call fcn.0040a3c0
push 0x131
mov ecx, eax
call fcn.00408a40
mov edx, 0x4adc00
mov ecx, eax
call fcn.0040a3c0
mov edx, str.Error_opening_SCM:
mov ecx, eax
call fcn.0040a3c0
push esi
mov ecx, eax
call fcn.004138e0
push eax
call fcn.0040a730
mov edx, dword [ebp - 0x34]
add esp, 4
cmp edx, 8
jb 0x40fce8
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40fcde
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ffa5
push edx
push ecx
call fcn.0045a3a4
add esp, 8
xor bl, bl
jmp 0x40ff80
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 3
mov eax, edi
mov ecx, dword [edi + 0x14]
cmp ecx, 8
jb 0x40fd13
mov eax, dword [edi]
cmp word [eax], 0x22
jne 0x40fd34
lea eax, [ebp - 0x28]
cmp eax, edi
je 0x40fd65
cmp ecx, 8
jb 0x40fd27
mov edi, dword [edi]
push dword [ebx]
lea ecx, [ebp - 0x28]
push edi
call fcn.00407680
jmp 0x40fd65
push 1
push 0x4adf88
lea ecx, [ebp - 0x28]
call fcn.00407680
cmp dword [edi + 0x14], 8
jb 0x40fd4b
mov edi, dword [edi]
push dword [ebx]
lea ecx, [ebp - 0x28]
push edi
call fcn.00414d40
push 1
push 0x4adf88
lea ecx, [ebp - 0x28]
call fcn.00414d40
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x4ad60c
cmovae eax, dword [ebp - 0x28]
push 0
push 0
push 0
push 0
push eax
push 1
push 2
push 0x10
push 0xf01ff
push 0x4adf8c
push str.MBAMInstallerService
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
mov dword [ebp - 0x30], edi
mov byte [ebp - 4], 4
test edi, edi
jne 0x40fe8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x2c], 0
call fcn.0044b850
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x40fdd8
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4ca1e0
call fcn.0040b1e0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupinstallerservicefactory.cpp
mov ecx, eax
call fcn.0040a3c0
mov edx, 0x4adac4
mov ecx, eax
call fcn.0040a3c0
push 0x155
mov ecx, eax
call fcn.00408a40
mov edx, 0x4adc00
mov ecx, eax
call fcn.0040a3c0
mov edx, str.Error_creating
mov ecx, eax
call fcn.0040a3c0
mov edx, str.MBAMInstallerService
mov ecx, eax
call fcn.00413c50
mov edx, str.__status:
mov ecx, eax
call fcn.0040a3c0
push edi
mov ecx, eax
call fcn.004138e0
push eax
call fcn.0040a730
mov edx, dword [ebp - 0x34]
add esp, 4
cmp edx, 8
jb 0x40fe87
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40fe7d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ffaa
push edx
push ecx
call fcn.0045a3a4
add esp, 8
xor bl, bl
jmp 0x40ff4a
lea ecx, [ebp - 0x60]
call fcn.0044b850
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x40fea5
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4ca1e0
call fcn.0040b1e0
add esp, 4
mov edx, str.d:jenkinsworkspace_a_mb4_mbsetup_srcmbsetupinstallerservicefactory.cpp
mov ecx, eax
call fcn.0040a3c0
mov edx, 0x4adac4
mov ecx, eax
call fcn.0040a3c0
push 0x15a
mov ecx, eax
call fcn.00408a40
mov edx, 0x4adc00
mov ecx, eax
call fcn.0040a3c0
mov edx, str.Created_service
mov ecx, eax
call fcn.0040a3c0
mov edx, str.MBAMInstallerService
mov ecx, eax
call fcn.00413c50
push eax
call fcn.0040a730
mov edx, dword [ebp - 0x4c]
add esp, 4
cmp edx, 8
jb 0x40ff3c
mov ecx, dword [ebp - 0x60]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40ff32
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ffaf
push edx
push ecx
call fcn.0045a3a4
add esp, 8
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
mov bl, 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x40ff80
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40ff76
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ffb4
push edx
push ecx
call fcn.0045a3a4
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00459e83
mov esp, ebp
pop ebp
ret 4
call fcn.004750dc
call fcn.004750dc
call fcn.004750dc
call fcn.004750dc
call fcn.004750dc
int3