Function at 0x4019c0
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x458cf0
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x47b008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0043ff6f
cmp dword [eax], 3
jne 0x4022f7
call fcn.0043ff75
mov eax, dword [eax]
mov edx, dword [eax + 4]
mov ecx, edx
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401a20
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.00402450
call fcn.0043ff75
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov ecx, edx
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401a60
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00402450
lea ecx, [ebp - 0x28]
call fcn.004040a0
test al, al
je 0x402246
lea ecx, [ebp - 0xd0]
call fcn.00403590
lea ecx, [ebp - 0xb8]
call fcn.00403590
lea ecx, [ebp - 0xa0]
call fcn.00403590
push 0xd
xor eax, eax
mov dword [ebp - 0x108], 0
push 0x46b614
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x104], 7
mov word [ebp - 0x118], ax
call fcn.00402450
push 0xb
xor eax, eax
mov dword [ebp - 0xf0], 0
push 0x46b630
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.00402450
push 0x12
xor eax, eax
mov dword [ebp - 0xd8], 0
push str.2345BrowserServcie
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.00402450
lea ecx, [ebp - 0xe8]
call fcn.00402420
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x401b4c
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0xd0]
call fcn.00402450
lea ecx, [ebp - 0x100]
call fcn.00402420
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x401b70
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0xb8]
call fcn.00402450
lea ecx, [ebp - 0x118]
call fcn.00402420
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x401b94
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.00402450
mov dword [ebp - 4], 8
mov edx, dword [ebp - 0xd4]
cmp edx, 8
jb 0x401bea
mov ecx, dword [ebp - 0xe8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401be0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402317
push edx
push ecx
call fcn.0043c039
add esp, 8
xor eax, eax
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
mov dword [ebp - 4], 0xc
mov edx, dword [ebp - 0xec]
cmp edx, 8
jb 0x401c4e
mov ecx, dword [ebp - 0x100]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401c44
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40231c
push edx
push ecx
call fcn.0043c039
add esp, 8
xor eax, eax
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
mov dword [ebp - 4], 0x10
mov edx, dword [ebp - 0x104]
cmp edx, 8
jb 0x401cb2
mov ecx, dword [ebp - 0x118]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401ca8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402321
push edx
push ecx
call fcn.0043c039
add esp, 8
xor eax, eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 7
mov word [ebp - 0x118], ax
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push str.install
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.0043fde1
add esp, 8
test eax, eax
jne 0x401f75
sub esp, 8
call fcn.00402c80
add esp, 4
mov ecx, eax
call fcn.00403220
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
call fcn.00402c80
push ecx
push esi
mov ecx, eax
call fcn.00402d80
mov bl, al
call fcn.00402c80
mov ecx, eax
call fcn.004032c0
test bl, bl
je 0x402119
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xd0]
call fcn.004128a0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x402119
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push 0
cmovae edx, dword [ebp - 0x28]
lea ecx, [ebp - 0xb8]
cmp dword [ebp - 0xa4], 8
lea eax, [ebp - 0xd0]
push 0
cmovae ecx, dword [ebp - 0xb8]
cmp dword [ebp - 0xbc], 8
push 0x46e6e8
cmovae eax, dword [ebp - 0xd0]
push 0
push 0x46ec5c
push edx
push 1
push 2
push 0x110
push 0xf01ff
push ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
jne 0x401dcd
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x402119
cmp dword [ebp - 0x8c], 8
lea eax, [ebp - 0xa0]
cmovae eax, dword [ebp - 0xa0]
mov dword [ebp - 0x194], eax
lea eax, [ebp - 0x194]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
lea ecx, [ebp - 0xd0]
call fcn.00412d10
push str.2345Explorer
lea ecx, [ebp - 0x88]
call fcn.004023d0
push str._012_2345explorer_service
lea ecx, [ebp - 0x70]
call fcn.004023d0
push str.t.keansoft.cn
lea ecx, [ebp - 0x58]
call fcn.004023d0
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x190]
call fcn.00412f30
mov dword [ebp - 4], 0x1c
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x401e93
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401e89
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402326
push edx
push ecx
call fcn.0043c039
add esp, 8
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov dword [ebp - 4], 0x20
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x401ee8
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401ede
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40232b
push edx
push ecx
call fcn.0043c039
add esp, 8
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
mov dword [ebp - 4], 0x24
mov edx, dword [ebp - 0x74]
cmp edx, 8
jb 0x401f40
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401f36
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402330
push edx
push ecx
call fcn.0043c039
add esp, 8
xor eax, eax
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
lea ecx, [ebp - 0x190]
mov dword [ebp - 4], 0xffffffff
call fcn.00413470
mov dword [ebp - 4], 0x28
jmp 0x402107
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push str.uninstall
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.0043fde1
add esp, 8
test eax, eax
jne 0x402119
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xd0]
call fcn.004128a0
push str.2345Explorer
lea ecx, [ebp - 0x58]
call fcn.004023d0
push str._012_2345explorer_service
lea ecx, [ebp - 0x70]
call fcn.004023d0
push str.t.keansoft.cn
lea ecx, [ebp - 0x88]
call fcn.004023d0
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x190]
call fcn.00412f30
mov dword [ebp - 4], 0x29
mov edx, dword [ebp - 0x74]
cmp edx, 8
jb 0x40202d
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402023
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402335
push edx
push ecx
call fcn.0043c039
add esp, 8
xor eax, eax
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
mov dword [ebp - 4], 0x2d
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x402085
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40207b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40233a
push edx
push ecx
call fcn.0043c039
add esp, 8
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
mov dword [ebp - 4], 0x31
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x4020da
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4020d0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40233f
push edx
push ecx
call fcn.0043c039
add esp, 8
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
lea ecx, [ebp - 0x190]
mov dword [ebp - 4], 0xffffffff
call fcn.00413870
mov dword [ebp - 4], 0x35
lea ecx, [ebp - 0x190]
call fcn.004132e0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0x37
mov edx, dword [ebp - 0x8c]
cmp edx, 8
jb 0x402160
mov ecx, dword [ebp - 0xa0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402156
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402344
push edx
push ecx
call fcn.0043c039
add esp, 8
xor eax, eax
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 7
mov word [ebp - 0xa0], ax
mov byte [ebp - 4], 0x3b
mov edx, dword [ebp - 0xa4]
cmp edx, 8
jb 0x4021c1
mov ecx, dword [ebp - 0xb8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4021b7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402349
push edx
push ecx
call fcn.0043c039
add esp, 8
xor eax, eax
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], ax
mov byte [ebp - 4], 0x3f
mov edx, dword [ebp - 0xbc]
cmp edx, 8
jb 0x402222
mov ecx, dword [ebp - 0xd0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402218
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40234e
push edx
push ecx
call fcn.0043c039
add esp, 8
xor eax, eax
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 7
mov word [ebp - 0xd0], ax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0x43
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x402287
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40227d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402353
push edx
push ecx
call fcn.0043c039
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 0x47
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x4022dc
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4022d2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402358
push edx
push ecx
call fcn.0043c039
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043bff8
mov esp, ebp
pop ebp
ret 0x10
call fcn.00440186
call fcn.00440186
call fcn.00440186
call fcn.00440186
call fcn.00440186
call fcn.00440186
call fcn.00440186
call fcn.00440186
call fcn.00440186
call fcn.00440186
call fcn.00440186
call fcn.00440186
call fcn.00440186
call fcn.00440186
int3