Function at 0x439d20
Capabilities:
Continue service
Create process on windows
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov dword [ebp - 0x8c], ecx
mov byte [ebp - 0xd], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0x8c]
call fcn.00439b00
movzx eax, al
test eax, eax
je 0x439dc9
mov dword [ebp - 0x88], 0
push 0x40
push 0
lea ecx, [ebp - 0x84]
push ecx
call fcn.004ad2c0
add esp, 0xc
mov dword [ebp - 0x3c], 0
xor edx, edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x88], 0x44
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x88]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x439dc0
mov byte [ebp - 0xd], 1
jmp 0x439dc4
mov byte [ebp - 0xd], 0
jmp 0x439f5b
push SysReAllocString
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x439f5b
push 0xf01ff
push str.NPACSVC3
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x439f3d
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov eax, dword [ebp - 0x28]
push eax
push 0x4f6518
call fcn.00405640
add esp, 8
cmp dword [ebp - 0x28], 7
jne 0x439eb5
lea ecx, [ebp - 0x2c]
push ecx
push 3
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov edx, dword [ebp - 0x28]
push edx
push 0x4f6548
call fcn.00405640
add esp, 8
cmp dword [ebp - 0x28], 4
je 0x439eaf
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, 0xa
div ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3e8
jae 0x439e85
mov dword [ebp - 0xc], 0x3e8
jmp 0x439e95
cmp dword [ebp - 0xc], 0x1388
jbe 0x439e95
mov dword [ebp - 0xc], 0x1388
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x439e5e
mov byte [ebp - 0xd], 1
jmp 0x439f2a
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x439f2a
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x28], 4
je 0x439f26
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, 0xa
div ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3e8
jae 0x439efc
mov dword [ebp - 0xc], 0x3e8
jmp 0x439f0c
cmp dword [ebp - 0xc], 0x1388
jbe 0x439f0c
mov dword [ebp - 0xc], 0x1388
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x439ed5
mov byte [ebp - 0xd], 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 4], 0
jmp 0x439f4a
push str.Service_is_NOT_installed__n
call fcn.00405640
add esp, 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 8], 0
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 4