Function at 0x49b6e4
Capabilities:
Create service
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49ba6a
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402b4c
sub eax, 1
jae 0x49b714
call fcn.0049b6a4
jmp 0x49ba4c
push 0x104
push 0x4a5eb8
mov eax, dword [0x4a4668]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
call sub.kernel32.dll_GetLastError_1
mov edx, 0x4a5eb0
mov eax, 1
call fcn.00402bac
mov eax, dword [0x4a5eb0]
cmp byte [eax], 0x2f
sete al
sub al, 1
jb 0x49ba47
jne 0x49ba4c
call fcn.0049b1b4
mov word [0x4a5eb4], ax
mov ax, 0xa
call fcn.0049b1d8
mov eax, dword [0x4a35bc]
mov edx, 0x49ba80
call fcn.00404e0c
call fcn.004033a0
call fcn.00402904
movzx eax, word [0x4a5eb4]
call fcn.0049b1d8
mov eax, dword [0x4a5eb0]
movzx eax, byte [eax + 1]
sub al, 0x49
je 0x49b7b5
sub al, 0xc
je 0x49b931
sub al, 0x14
je 0x49b7b5
sub al, 0xc
je 0x49b931
jmp 0x49ba40
call fcn.0049b1b4
mov word [0x4a5eb4], ax
mov ax, 9
call fcn.0049b1d8
mov dword [0x4a5fc4], 3
mov eax, dword [0x4a5eb0]
call fcn.004049f0
cmp eax, 2
jle 0x49b7ff
mov eax, dword [0x4a5eb0]
movzx eax, byte [eax + 2]
sub al, 0x41
je 0x49b7f3
sub al, 0x20
jne 0x49b809
mov dword [0x4a5fc4], 2
jmp 0x49b809
mov dword [0x4a5fc4], 3
mov eax, dword [0x4a5fc4]
sub eax, 2
je 0x49b818
dec eax
je 0x49b833
jmp 0x49b84c
mov eax, dword [0x4a35bc]
mov edx, 0x49ba9c
call fcn.00404e0c
call fcn.004033a0
call fcn.00402904
jmp 0x49b84c
mov eax, dword [0x4a35bc]
mov edx, 0x49bae4
call fcn.00404e0c
call fcn.004033a0
call fcn.00402904
movzx eax, word [0x4a5eb4]
call fcn.0049b1d8
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [0x4a5fbc], eax
mov eax, dword [0x4a5fbc]
sub eax, 1
jae 0x49b87f
call fcn.0049b294
jmp 0x49ba4c
push 0
push 0
push 0
push 0
push 0
push 0x4a5eb8
push 1
mov eax, dword [0x4a5fc4]
push eax
push 0x110
push 0x10014
push 0x49bb24
push 0x49bb2c
mov eax, dword [0x4a5fbc]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [0x4a5fc0], eax
mov eax, dword [0x4a5fc0]
sub eax, 1
jae 0x49b8d9
mov eax, dword [0x4a5fbc]
push eax
call sub.advapi32.dll_CloseServiceHandle
call fcn.0049b294
jmp 0x49ba4c
mov eax, dword [0x4a5fbc]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [0x4a5fc0]
push eax
call sub.advapi32.dll_CloseServiceHandle
lea eax, [ebp - 4]
push eax
mov eax, 0x49bb2c
mov dword [ebp - 0xc], eax
mov eax, 0x49bb3c
mov dword [ebp - 8], eax
lea edx, [ebp - 0xc]
mov ecx, 1
mov eax, 0x49bb48
call fcn.0049b33c
mov edx, dword [ebp - 4]
mov eax, dword [0x4a35bc]
call fcn.00404e0c
call fcn.004033a0
call fcn.00402904
jmp 0x49ba4c
call fcn.0049b1b4
mov word [0x4a5eb4], ax
mov ax, 9
call fcn.0049b1d8
mov eax, dword [0x4a35bc]
mov edx, 0x49bb74
call fcn.00404e0c
call fcn.004033a0
call fcn.00402904
movzx eax, word [0x4a5eb4]
call fcn.0049b1d8
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [0x4a5fbc], eax
mov eax, dword [0x4a5fbc]
sub eax, 1
jae 0x49b991
call fcn.0049b294
jmp 0x49ba4c
push 0xf01ff
push 0x49bb2c
mov eax, dword [0x4a5fbc]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [0x4a5fc0], eax
mov eax, dword [0x4a5fc0]
sub eax, 1
jae 0x49b9ca
mov eax, dword [0x4a5fbc]
push eax
call sub.advapi32.dll_CloseServiceHandle
call fcn.0049b294
jmp 0x49ba4c
mov eax, dword [0x4a5fc0]
push eax
call sub.advapi32.dll_DeleteService
mov dword [0x4a5fc4], eax
mov eax, dword [0x4a5fc0]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [0x4a5fbc]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [0x4a5fc4]
sub eax, 1
jae 0x49ba01
call fcn.0049b294
jmp 0x49ba4c
lea eax, [ebp - 0x10]
push eax
mov eax, 0x49bb48
mov edx, 0x49bb2c
mov dword [ebp - 0xc], edx
mov edx, 0x49bb9c
mov dword [ebp - 8], edx
lea edx, [ebp - 0xc]
mov ecx, 1
call fcn.0049b33c
mov edx, dword [ebp - 0x10]
mov eax, dword [0x4a35bc]
call fcn.00404e0c
call fcn.004033a0
call fcn.00402904
jmp 0x49ba4c
call fcn.0049b554
jmp 0x49ba4c
call fcn.0049b6a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ba71
lea eax, [ebp - 0x10]
call fcn.00404730
lea eax, [ebp - 4]
call fcn.00404730
ret