Function at 0x416640
Capabilities:
Check os version
Modify service
Query service status
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x684
mov eax, dword [0x446044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 2
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x66c], edi
cmp edi, esi
je 0x416996
push 0xf01ff
push 0x440d18
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
cmp ebx, esi
je 0x41696f
push 0x11c
lea eax, [ebp - 0x128]
push esi
push eax
call fcn.00426670
add esp, 0xc
lea ecx, [ebp - 0x128]
push ecx
mov dword [ebp - 0x128], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 6
jb 0x416781
push str._Terminate_Protect__Clear_reTry_Action.
call fcn.00403960
mov eax, 0x435414
add esp, 4
mov dword [ebp - 0x67c], eax
mov dword [ebp - 0x678], eax
lea eax, [ebp - 0x680]
push eax
push 2
lea edx, [ebp - 0x628]
push ebx
mov dword [ebp - 0x628], esi
mov dword [ebp - 0x624], esi
mov dword [ebp - 0x620], esi
mov dword [ebp - 0x61c], esi
mov dword [ebp - 0x618], esi
mov dword [ebp - 0x614], esi
mov dword [ebp - 0x680], esi
mov dword [ebp - 0x674], 3
mov dword [ebp - 0x670], edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x416781
push 0xfe
lea edx, [ebp - 0x106]
xor ecx, ecx
push esi
push edx
mov word [ebp - 0x108], cx
call fcn.00426670
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x108]
push str._Terminate_Protect__Set_Actions_Result_0x_X_.
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x108]
add esp, 0xc
push ecx
call fcn.00403960
add esp, 4
push 0x206
lea eax, [ebp - 0x60e]
xor edx, edx
push esi
push eax
mov word [ebp - 0x610], dx
call fcn.00426670
add esp, 0xc
mov dword [ebp - 0x668], esi
xor eax, eax
jmp 0x4167b0
movzx ecx, word [eax + str.SYSTEMCurrentControlSet_servicesWin_Win7]
mov word [ebp + eax - 0x610], cx
add eax, 2
cmp cx, si
jne 0x4167b0
lea ecx, [ebp - 0x668]
push ecx
lea edx, [ebp - 0x664]
push edx
push esi
push 0xf003f
push esi
push esi
push esi
lea eax, [ebp - 0x610]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x416871
push 0x206
lea edx, [ebp - 0x20e]
xor ecx, ecx
push esi
push edx
mov word [ebp - 0x210], cx
call fcn.00426670
add esp, 0xc
push str._C:Program_FilesWW2017CFwmcSystem7X.exe_
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00420470
lea eax, [ebp - 0x210]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x416834
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x664]
push ecx
lea edx, [ebp - 0x210]
push edx
push 2
push esi
push 0x434a38
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x664]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f2
lea eax, [ebp - 0x406]
xor edx, edx
push esi
push eax
mov word [ebp - 0x408], dx
call fcn.00426670
add esp, 0xc
lea ecx, [ebp - 0x660]
push ecx
push 0xc8
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call edi
lea edx, [ebp - 0x644]
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x640], 1
je 0x416934
inc esi
push esi
lea eax, [ebp - 0x408]
push 0x4418d8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x408]
add esp, 0xc
push ecx
call fcn.00403960
add esp, 4
cmp esi, 0xa
je 0x41693b
cmp dword [ebp - 0x640], 3
je 0x41690f
lea edx, [ebp - 0x660]
push edx
push 0xc8
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x41692b
lea eax, [ebp - 0x408]
push str._Terminate_Protect__SERVICE_STOP_PENDING
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
push 0xbb8
call edi
cmp esi, 0xa
jle 0x4168a8
push 0x441978
jmp 0x416940
push 0x4419c0
call fcn.00403960
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [ebp - 0x66c]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e7be
mov esp, ebp
pop ebp
ret
push str._Terminate_Protect__Open_Win_Win7_Fail.
call fcn.00403960
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e7be
mov esp, ebp
pop ebp
ret
push str._Terminate_Protect_
call fcn.00403960
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.0041e7be
mov esp, ebp
pop ebp
ret