Function at 0x401000
Capabilities:
Create directory
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x210
mov eax, dword [0x43000c]
mov edi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor eax, ebp
mov dword [ebp - 0x10], eax
push str.forceinstall
push dword [edi + 4]
call ebx
mov esi, eax
push 0x42bbb8
push dword [edi + 4]
call ebx
test esi, esi
je 0x4010a7
test eax, eax
je 0x4010a7
push 0x42bd96
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4011d4
push str.uninstall
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40132e
mov esi, dword [ebp + 8]
push str.check_cert
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp esi, 3
jl 0x401483
test eax, eax
jne 0x401483
push 0
push dword [edi + 0xc]
push dword [edi + 8]
call fcn.0040add0
add esp, 0xc
xor ebx, ebx
test eax, eax
sete bl
jmp 0x40180d
lea edi, [ebp - 0x21c]
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40118f
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x40118f
push edi
call fcn.004157a2
add esp, 4
add eax, 4
cmp eax, 0x103
ja 0x40118f
push str.logs
push edi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x40118f
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [0x43199c]
mov ecx, dword [0x430a44]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x401864
cmp dword [0x431588], 0
jne 0x40118f
sub esp, 0x14
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], str.maintenanceservice_install.log
mov dword [esp], 0x431794
call fcn.0040b790
add esp, 0x14
dec eax
cmp eax, 0x102
ja 0x40118f
push 0x43158c
push 0x42bcba
push edi
call fcn.0040c140
add esp, 0xc
test eax, eax
je 0x40118f
push 0x42ba6a
push 0x43158c
call fcn.00413f5c
add esp, 8
mov dword [0x431588], eax
push 0x431794
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x43199c]
mov ecx, dword [0x430a44]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4014f5
test esi, esi
je 0x40153c
push str.Installing_service...
push 0x431588
call fcn.0040b850
add esp, 8
mov eax, 1
jmp 0x401553
lea esi, [ebp - 0x21c]
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4012bc
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x4012bc
push esi
call fcn.004157a2
add esp, 4
add eax, 4
cmp eax, 0x103
ja 0x4012bc
push str.logs
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x4012bc
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [0x43199c]
mov ecx, dword [0x430a44]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4018f9
cmp dword [0x431588], 0
jne 0x4012bc
sub esp, 0x14
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], str.maintenanceservice_install.log
mov dword [esp], 0x431794
call fcn.0040b790
add esp, 0x14
dec eax
cmp eax, 0x102
ja 0x4012bc
push 0x43158c
push 0x42bcba
push esi
call fcn.0040c140
add esp, 0xc
test eax, eax
je 0x4012bc
push 0x42ba6a
push 0x43158c
call fcn.00413f5c
add esp, 8
mov dword [0x431588], eax
push 0x431794
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x43199c]
mov ecx, dword [0x430a44]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40165f
push str.Upgrading_service_if_installed...
push 0x431588
call fcn.0040b850
add esp, 8
push 0
call fcn.00402b50
add esp, 4
mov esi, eax
mov eax, dword [0x43199c]
mov ecx, dword [0x430a44]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4016a3
test esi, esi
je 0x4016ea
push str.The_service_was_upgraded_successfully
jmp 0x40158c
lea esi, [ebp - 0x21c]
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x401416
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x401416
push esi
call fcn.004157a2
add esp, 4
add eax, 4
cmp eax, 0x103
ja 0x401416
push str.logs
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x401416
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [0x43199c]
mov ecx, dword [0x430a44]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40194a
cmp dword [0x431588], 0
jne 0x401416
sub esp, 0x14
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], str.maintenanceservice_uninstall.log
mov dword [esp], 0x431794
call fcn.0040b790
add esp, 0x14
dec eax
cmp eax, 0x102
ja 0x401416
push 0x43158c
push 0x42bcba
push esi
call fcn.0040c140
add esp, 0xc
test eax, eax
je 0x401416
push 0x42ba6a
push 0x43158c
call fcn.00413f5c
add esp, 8
mov dword [0x431588], eax
push 0x431794
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x43199c]
mov ecx, dword [0x430a44]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4016fb
push str.Uninstalling_service...
push 0x431588
call fcn.0040b850
add esp, 8
call fcn.00404340
mov esi, eax
mov eax, dword [0x43199c]
mov ecx, dword [0x430a44]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40173f
test esi, esi
je 0x401786
push str.The_service_was_uninstalled_successfully
jmp 0x40158c
movsd xmm0, qword [0x4293d8]
movsd xmm1, qword [0x4293d0]
lea eax, [ebp - 0x21c]
movsd qword [ebp - 0x214], xmm0
movsd qword [ebp - 0x21c], xmm1
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x4014ee
mov eax, dword [0x43199c]
mov ecx, dword [0x430a44]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4018b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.StartServiceCtrlDispatcher_failed.____d_
push 0x431588
call fcn.0040b8d0
add esp, 0xc
xor ebx, ebx
jmp 0x40180d
push 0x43199c
call fcn.0040c696
add esp, 4
mov eax, dword [0x43199c]
cmp eax, 0xffffffff
jne 0x4011b0
mov dword [0x431588], 0
push 0x4021a0
call fcn.0040c8fc
add esp, 4
push 0x43199c
call fcn.0040c6e8
add esp, 4
test esi, esi
jne 0x4011b8
push str.Installing_service_with_force_specified...
push 0x431588
call fcn.0040b850
add esp, 8
mov eax, 2
push eax
call fcn.00402b50
add esp, 4
mov esi, eax
mov eax, dword [0x43199c]
mov ecx, dword [0x430a44]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x401607
test esi, esi
je 0x40164e
push str.The_service_was_installed_successfully
push 0x431588
call fcn.0040b850
add esp, 8
mov eax, dword [0x43199c]
mov ecx, dword [0x430a44]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x4015ca
mov eax, dword [0x431588]
xor ebx, ebx
test eax, eax
jne 0x4017ca
jmp 0x40180d
push 0x43199c
call fcn.0040c696
add esp, 4
mov eax, dword [0x43199c]
cmp eax, 0xffffffff
jne 0x4015b6
mov dword [0x431588], 0
push 0x4021a0
call fcn.0040c8fc
add esp, 4
push 0x43199c
call fcn.0040c6e8
add esp, 4
jmp 0x4015b6
push 0x43199c
call fcn.0040c696
add esp, 4
mov eax, dword [0x43199c]
cmp eax, 0xffffffff
jne 0x40157f
mov dword [0x431588], 0
push 0x4021a0
call fcn.0040c8fc
add esp, 4
push 0x43199c
call fcn.0040c6e8
add esp, 4
test esi, esi
jne 0x401587
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_install_service.____d_
jmp 0x401792
push 0x43199c
call fcn.0040c696
add esp, 4
mov eax, dword [0x43199c]
cmp eax, 0xffffffff
jne 0x4012dd
mov dword [0x431588], 0
push 0x4021a0
call fcn.0040c8fc
add esp, 4
push 0x43199c
call fcn.0040c6e8
add esp, 4
jmp 0x4012dd
push 0x43199c
call fcn.0040c696
add esp, 4
mov eax, dword [0x43199c]
cmp eax, 0xffffffff
jne 0x40131c
mov dword [0x431588], 0
push 0x4021a0
call fcn.0040c8fc
add esp, 4
push 0x43199c
call fcn.0040c6e8
add esp, 4
test esi, esi
jne 0x401324
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_upgrade_service.____d_
jmp 0x401792
push 0x43199c
call fcn.0040c696
add esp, 4
mov eax, dword [0x43199c]
cmp eax, 0xffffffff
jne 0x401437
mov dword [0x431588], 0
push 0x4021a0
call fcn.0040c8fc
add esp, 4
push 0x43199c
call fcn.0040c6e8
add esp, 4
jmp 0x401437
push 0x43199c
call fcn.0040c696
add esp, 4
mov eax, dword [0x43199c]
cmp eax, 0xffffffff
jne 0x401471
mov dword [0x431588], 0
push 0x4021a0
call fcn.0040c8fc
add esp, 4
push 0x43199c
call fcn.0040c6e8
add esp, 4
test esi, esi
jne 0x401479
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_uninstall_service.____d_
push 0x431588
call fcn.0040b8d0
add esp, 0xc
mov eax, dword [0x43199c]
mov ecx, dword [0x430a44]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x401824
mov eax, dword [0x431588]
mov ebx, 1
test eax, eax
je 0x40180d
push eax
call fcn.0041401f
add esp, 4
mov dword [0x431588], 0
push 0
push 0x431794
call fcn.00413928
add esp, 8
test eax, eax
je 0x401802
push 0x431794
push 0x43158c
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x40180d
push 0x43158c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ce4a
mov eax, ebx
add esp, 0x210
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x43199c
call fcn.0040c696
add esp, 4
mov eax, dword [0x43199c]
cmp eax, 0xffffffff
jne 0x4017bc
mov dword [0x431588], 0
push 0x4021a0
call fcn.0040c8fc
add esp, 4
push 0x43199c
call fcn.0040c6e8
add esp, 4
jmp 0x4017bc
push 0x43199c
call fcn.0040c696
add esp, 4
mov eax, dword [0x43199c]
cmp eax, 0xffffffff
jne 0x401127
mov dword [0x431588], 0
push 0x4021a0
call fcn.0040c8fc
add esp, 4
push 0x43199c
call fcn.0040c6e8
add esp, 4
cmp dword [0x431588], 0
jne 0x40118f
jmp 0x401130
push 0x43199c
call fcn.0040c696
add esp, 4
mov eax, dword [0x43199c]
cmp eax, 0xffffffff
jne 0x4014d5
mov dword [0x431588], 0
push 0x4021a0
call fcn.0040c8fc
add esp, 4
push 0x43199c
call fcn.0040c6e8
add esp, 4
jmp 0x4014d5
push 0x43199c
call fcn.0040c696
add esp, 4
mov eax, dword [0x43199c]
cmp eax, 0xffffffff
jne 0x401254
mov dword [0x431588], 0
push 0x4021a0
call fcn.0040c8fc
add esp, 4
push 0x43199c
call fcn.0040c6e8
add esp, 4
cmp dword [0x431588], 0
jne 0x4012bc
jmp 0x40125d
push 0x43199c
call fcn.0040c696
add esp, 4
mov eax, dword [0x43199c]
cmp eax, 0xffffffff
jne 0x4013ae
mov dword [0x431588], 0
push 0x4021a0
call fcn.0040c8fc
add esp, 4
push 0x43199c
call fcn.0040c6e8
add esp, 4
cmp dword [0x431588], 0
jne 0x401416
jmp 0x4013b7