Function at 0x4ae384
Capabilities:
Create process on windows
Create service
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
xor eax, eax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x4ae6c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
mov byte [ebp - 0x25], 1
push 0x104
lea eax, [ebp - 0x15d]
push eax
mov eax, dword [0x4d4668]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
mov dword [ebp - 8], eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4ae3f7
cmp dword [ebp - 8], 0
jge 0x4ae402
mov al, 1
call fcn.004ae21c
mov byte [ebp - 1], 0
mov eax, dword [0x4d38f0]
cmp byte [eax], 0
je 0x4ae41b
lea eax, [ebp - 0x18]
mov edx, 0x4ae6dc
call fcn.004050dc
jmp 0x4ae428
lea eax, [ebp - 0x18]
mov edx, 0x4ae6fc
call fcn.004050dc
mov eax, dword [ebp - 0x18]
call fcn.00405304
dec eax
test eax, eax
jl 0x4ae45e
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov al, byte [eax + edx]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
mov byte [ebp + edx - 0x15d], al
inc dword [ebp - 0xc]
dec dword [ebp - 0x30]
jne 0x4ae440
lea edx, [ebp - 0x174]
mov eax, dword [0x4d3c74]
mov eax, dword [eax]
call fcn.0040a330
mov edx, dword [ebp - 0x174]
lea eax, [ebp - 0x1c]
mov ecx, 0x4ae710
call fcn.00405350
mov eax, dword [0x4d38f0]
cmp byte [eax], 0
jne 0x4ae493
cmp byte [ebp - 0x25], 0
je 0x4ae49c
mov dword [ebp - 0x2c], 3
jmp 0x4ae4a3
mov dword [ebp - 0x2c], 2
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x15d]
push eax
push 1
mov eax, dword [ebp - 0x2c]
push eax
push 0x110
push 0xf01ff
lea eax, [ebp - 0x1c]
call fcn.0040555c
push eax
lea eax, [ebp - 0x1c]
call fcn.0040555c
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0x14], eax
push 0x64
call sub.kernel32.dll_Sleep
cmp dword [ebp - 0x14], 0
jne 0x4ae5bb
mov eax, dword [0x4d38f0]
cmp byte [eax], 0
jne 0x4ae503
cmp byte [ebp - 0x25], 0
je 0x4ae50c
mov byte [ebp - 1], 0
jmp 0x4ae68e
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x431
jne 0x4ae5af
lea edx, [ebp - 0x178]
xor eax, eax
call fcn.00402f58
mov edx, dword [ebp - 0x178]
lea eax, [ebp - 0x18]
mov ecx, 0x4ae710
call fcn.00405350
push 1
push 0
push 0x4ae714
lea eax, [ebp - 0x18]
call fcn.0040555c
push eax
push 0x4ae728
lea eax, [ebp - 0x18]
call fcn.0040555c
push eax
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.shell32.dll_ShellExecuteA
push 0x3e8
call sub.kernel32.dll_Sleep
push 1
push 0
push 0x4ae730
lea eax, [ebp - 0x18]
call fcn.0040555c
push eax
push 0x4ae728
lea eax, [ebp - 0x18]
call fcn.0040555c
push eax
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.shell32.dll_ShellExecuteA
push 0x64
call sub.kernel32.dll_Sleep
xor eax, eax
call fcn.00449220
jmp 0x4ae68e
mov al, 1
call fcn.004ae21c
jmp 0x4ae68e
lea eax, [ebp - 0x18]
mov edx, 0x4ae74c
call fcn.004050dc
mov eax, dword [0x4d38f0]
cmp byte [eax], 0
je 0x4ae5df
lea eax, [ebp - 0x18]
mov edx, 0x4ae760
call fcn.004050dc
lea eax, [ebp - 0x18]
call fcn.0040555c
mov dword [ebp - 0x170], eax
lea eax, [ebp - 0x170]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push 1
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_StartServiceA
mov eax, dword [0x4d38f0]
cmp byte [eax], 0
jne 0x4ae615
cmp byte [ebp - 0x25], 0
je 0x4ae630
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4ae630
cmp dword [ebp - 0xc], 0x41d
je 0x4ae630
mov byte [ebp - 1], 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [0x4d38f0]
cmp byte [eax], 0
jne 0x4ae670
lea edx, [ebp - 0x20]
mov eax, 0x4ae77c
call fcn.00449128
test al, al
jne 0x4ae670
push 0x40
mov ecx, 0x4ae78c
mov dl, 1
mov eax, dword [0x44df70]
call fcn.0044dff4
push 0x64
call sub.kernel32.dll_Sleep
mov eax, dword [0x4d38f0]
cmp byte [eax], 0
jne 0x4ae68e
cmp byte [ebp - 0x25], 0
jne 0x4ae68e
xor eax, eax
call fcn.00449220
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae6cb
lea eax, [ebp - 0x178]
mov edx, 2
call fcn.00405068
lea eax, [ebp - 0x164]
call fcn.00405044
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00405068
ret