Function at 0x414f49
Capabilities:
Copy file
Create service
Persist via windows service

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
call fcn.0045e790
mov ebp, dword [0x47356c]
mov ebx, dword [ebp + 0x20]
cmp ebx, 0x2580
jg 0x414f76
mov eax, str.WofAdk
push eax
call fcn.0041e0a4
and eax, eax
jne 0x414f76
jmp 0x414f7d
mov eax, 1
jmp 0x414f7f
xor eax, eax
and eax, eax
je 0x414f98
mov ebp, dword [0x473558]
mov dword [ebp + 0x9c], 1
jmp 0x415264
mov eax, 0x463436
push eax
call fcn.0041e0a4
and eax, eax
je 0x4150ed
push edx
call fcn.0045e620
pop edx
push eax
mov eax, str.InternalName
push eax
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 0x18]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.driverswof.sys
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00427c26
call fcn.0045e850
mov edx, 0x461c9e
pop ecx
push ecx
call fcn.0044e340
mov ecx, eax
call fcn.0044e300
je 0x415017
mov ebp, dword [0x473558]
mov dword [ebp + 0x9c], 1
jmp 0x415264
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x46ba58
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 0x18]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.driverswof.sys
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00422512
call fcn.0045e850
push edx
call fcn.0045e620
pop edx
push eax
push 0x46ba58
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 8]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.Tools_
push edx
call fcn.0045e6f0
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 0x24]
push edx
call fcn.0045e6f0
mov edx, str.DISMwofadk.sys
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00422512
call fcn.0044e2d2
add dword [esp], edx
call fcn.0044e2d2
add dword [esp + 4], edx
call fcn.0042f9ac
call fcn.0044e2f0
mov ebx, eax
cmp ebx, 1
jge 0x4150ed
mov ebp, dword [0x473558]
mov dword [ebp + 0x9c], 1
jmp 0x415264
mov ebp, dword [0x47356c]
mov ebx, dword [ebp + 0x20]
cmp ebx, 0x1b58
jle 0x415262
mov eax, str.No_Wof_driver_found_
push eax
call fcn.004280d3
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 0xc]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, 0x462e2a
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00417bc9
call fcn.0044e2f0
and eax, eax
je 0x415262
call fcn.0040297d
push edx
call fcn.0045e620
pop edx
push eax
push 0
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 0x18]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.driverswofadk.sys
push edx
call fcn.0045e6f0
call fcn.0045e850
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 0xc]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, 0x462e2a
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.0044e2d2
add dword [esp + 4], edx
call sub.kernel32.dll_CopyFileW
call fcn.0044e2f0
push 0xf000f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [esp], eax
cmp dword [esp], 0
je 0x415262
push 0
push 0
push 0
push 0
push 0
mov eax, str.system32DRIVERSwofadk.sys
push eax
push 1
push 0
push 2
push 0
push 0
mov eax, str.WofAdk
push eax
push dword [esp + 0x30]
call sub.advapi32.dll_CreateServiceW
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x41525a
push dword [esp + 4]
call sub.advapi32.dll_CloseServiceHandle
mov ebp, dword [0x473558]
mov dword [ebp + 0x9c], 1
mov eax, str.Succesfully_installed_WofADK_
push eax
call fcn.004280d3
push dword [esp]
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
add esp, 8
pop ebx
pop ebp
ret