Function at 0x47eab0
Capabilities:
Persist via run registry key
Query service configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47edcb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x42fb14]
call fcn.0042fc14
mov dword [ebp - 4], eax
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.0042fcb4
xor ecx, ecx
mov edx, 0x47ede4
mov eax, dword [ebp - 4]
call fcn.0042fd18
test al, al
je 0x47ec35
xor ebx, ebx
push ebp
mov eax, ebx
call fcn.0047e8ac
pop ecx
inc ebx
cmp ebx, 5
jne 0x47eb04
xor eax, eax
push ebp
push 0x47eb41
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x47ee14
mov eax, dword [ebp - 4]
call fcn.0042ff8c
mov edx, dword [ebp - 8]
mov dword [edx + 0x530], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47eb4b
xor eax, eax
push ebp
push 0x47eb79
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x47ee28
mov eax, dword [ebp - 4]
call fcn.0042ff8c
mov edx, dword [ebp - 8]
mov dword [edx + 0x534], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47eb83
xor eax, eax
push ebp
push 0x47ebb1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x47ee3c
mov eax, dword [ebp - 4]
call fcn.0042ff8c
mov edx, dword [ebp - 8]
mov dword [edx + 0x538], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ebbb
xor eax, eax
push ebp
push 0x47ebe9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x47ee4c
mov eax, dword [ebp - 4]
call fcn.0042ff8c
mov edx, dword [ebp - 8]
mov dword [edx + 0x53c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ebf3
mov eax, dword [ebp - 8]
mov byte [eax + 0x540], 0
xor eax, eax
push ebp
push 0x47ec2b
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x47ee5c
mov eax, dword [ebp - 4]
call fcn.0042ffc8
mov edx, dword [ebp - 8]
mov byte [edx + 0x540], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ec35
mov eax, dword [ebp - 4]
call fcn.0042fc84
xor ecx, ecx
mov edx, 0x47ee6c
mov eax, dword [ebp - 4]
call fcn.0042fd18
test al, al
je 0x47ec9a
xor eax, eax
push ebp
push 0x47ec78
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
mov edx, 0x47eea4
mov eax, dword [ebp - 4]
call fcn.0042ff00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ec8a
cmp dword [ebp - 0xc], 0
setne al
mov edx, dword [ebp - 8]
mov byte [edx + 0x541], al
mov eax, dword [ebp - 4]
call fcn.0042fc84
call fcn.0047e588
test al, al
je 0x47ed48
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jne 0x47ecca
mov eax, dword [ebp - 8]
mov byte [eax + 0x542], 0
push 0xf01ff
push 0x47eeac
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
jne 0x47ecec
mov eax, dword [ebp - 8]
mov byte [eax + 0x542], 0
jmp 0x47ed40
push 0xf01ff
push 0x47eeac
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
jne 0x47ed0e
mov eax, dword [ebp - 8]
mov byte [eax + 0x542], 0
jmp 0x47ed3a
lea eax, [ebp - 0x10]
push eax
push 0x24
lea eax, [ebp - 0x34]
push eax
push esi
call sub.advapi32.dll_QueryServiceConfigA
cmp dword [ebp - 0x30], 2
jne 0x47ed30
mov eax, dword [ebp - 8]
mov byte [eax + 0x542], 1
jmp 0x47ed3a
mov eax, dword [ebp - 8]
mov byte [eax + 0x542], 0
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
jmp 0x47edad
xor ecx, ecx
mov edx, 0x47eec0
mov eax, dword [ebp - 4]
call fcn.0042fd18
test al, al
je 0x47eda5
xor eax, eax
push ebp
push 0x47ed83
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
mov edx, 0x47ef00
mov eax, dword [ebp - 4]
call fcn.0042ff00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ed95
cmp dword [ebp - 0xc], 0
setne al
mov edx, dword [ebp - 8]
mov byte [edx + 0x542], al
mov eax, dword [ebp - 4]
call fcn.0042fc84
mov eax, dword [ebp - 4]
call fcn.00403320
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47edd2
lea eax, [ebp - 0xc]
call fcn.004040f4
ret