Function at 0x41682b
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push ebp
push ebx
mov edx, 0xe
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x416832
call fcn.00428690
push 0x30
call fcn.00403bcb
mov ebx, dword [0x45b328]
cmp ebx, 2
jle 0x4168ca
mov ebx, dword [esp]
imul ebx, dword [esp]
mov dword [esp], ebx
push 1
push dword [0x45b328]
call fcn.00421180
mov dword [esp], eax
mov ebx, dword [esp]
mov ebp, dword [0x45b7ac]
imul ebx, ebx, 0xc
add ebp, ebx
mov edx, dword [ebp + 4]
push edx
call fcn.004286f0
pop edx
push eax
push edx
call fcn.004287f0
lea eax, [esp + 0xc]
push eax
call fcn.00428730
mov ebx, dword [esp]
mov ebp, dword [0x45b7ac]
imul ebx, ebx, 0xc
add ebp, ebx
mov edx, dword [ebp + 8]
push edx
call fcn.004286f0
pop edx
push eax
push edx
call fcn.004287f0
lea eax, [esp + 0x10]
push eax
call fcn.00428730
jmp 0x4168e6
mov edx, str.Health_Key_Authentication_Protocol
lea ecx, [esp + 8]
call fcn.0041f008
mov edx, 0x457644
lea ecx, [esp + 0xc]
call fcn.0041f008
push edx
call fcn.004286f0
pop edx
push eax
push edx
call fcn.004286f0
pop edx
push eax
push edx
call fcn.004286f0
pop edx
push eax
push edx
call fcn.004286f0
pop edx
push eax
push edx
call fcn.004286f0
pop edx
push eax
push edx
call fcn.004286f0
pop edx
push eax
call fcn.00420b56
call fcn.0041f362
add dword [esp], edx
call fcn.004207e0
call fcn.0041f362
add dword [esp], edx
call fcn.0041fbc0
lea eax, [esp + 0x28]
push eax
call fcn.00428730
push dword [esp + 0x24]
mov edx, 0x457024
pop ecx
call fcn.0041f390
jne 0x416996
mov edx, dword [esp + 0x24]
push edx
call fcn.004286f0
pop edx
push eax
push edx
call fcn.004287f0
lea eax, [0x45b2e8]
push eax
call fcn.00428730
mov eax, dword [0x45b2e8]
push eax
lea ebp, [esp + 0x18]
pop eax
mov dword [ebp], eax
lea eax, [0x41b3f0]
push eax
pop eax
mov dword [ebp + 4], eax
lea eax, [esp + 0x14]
push eax
call sub.ADVAPI32.DLL_StartServiceCtrlDispatcherW
jmp 0x416cff
call fcn.0040f3b9
mov dword [esp + 0x10], 0
push edx
call fcn.004286f0
pop edx
push eax
call fcn.00416f04
push edx
call fcn.004286f0
pop edx
push eax
call fcn.0040308a
pop eax
lea eax, [esp + 0x24]
push eax
call fcn.00428730
push edx
call fcn.004286f0
pop edx
push eax
push dword [esp + 0x24]
push edx
call fcn.004286f0
pop edx
push eax
push edx
call fcn.004286f0
pop edx
push eax
call fcn.00420990
call fcn.0041f362
add dword [esp], edx
call fcn.00423eec
call fcn.0041f380
and eax, eax
je 0x416a01
jmp 0x416a1d
mov ebx, dword [esp + 0x10]
inc ebx
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x10]
cmp ebx, 0xc8
jle 0x416a1b
jmp 0x401266
jmp 0x4169a3
push dword [esp + 0x20]
call fcn.0040eaf0
push edx
call fcn.004286f0
pop edx
push eax
push 0
push edx
call fcn.004286f0
pop edx
push eax
call fcn.00416f04
mov edx, str.ntdll.dll
push edx
call fcn.004287f0
call fcn.0041f362
add dword [esp], edx
call fcn.00423f11
call fcn.0041f380
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x28]
and ebx, ebx
jne 0x416a7e
mov eax, 0x457c78
push eax
mov eax, str._yyyy__mm__dd__hh:_ii:_ss
push eax
call fcn.00425603
mov dword [esp + 0x28], eax
push dword [esp + 0x28]
push 0
push dword [esp + 0x28]
call fcn.00423fb5
push dword [esp + 0x28]
push 1
push dword [esp + 0x28]
call fcn.00423fb5
push dword [esp + 0x28]
push 2
push dword [esp + 0x28]
call fcn.00423fb5
push edx
call fcn.004286f0
pop edx
push eax
call fcn.0041a92e
lea eax, [0x45b2e8]
push eax
call fcn.00428730
mov edx, dword [esp + 0x20]
push edx
call fcn.004286f0
pop edx
push eax
push edx
call fcn.004287f0
mov edx, 0x4570ce
push edx
call fcn.004287f0
mov edx, dword [0x45b2e8]
push edx
call fcn.004287f0
lea eax, [esp + 0x24]
push eax
call fcn.00428730
push 2
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerW
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
je 0x416ba6
push 0
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x34]
push eax
push 1
push 2
push 0x10
push 0xf01ff
mov eax, dword [esp + 0x30]
push eax
mov eax, dword [0x45b2e8]
push eax
push dword [esp + 0x5c]
call sub.ADVAPI32.DLL_CreateServiceW
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
je 0x416b9d
mov eax, dword [esp + 0xc]
push eax
lea ebp, [esp + 0x20]
pop eax
mov dword [ebp], eax
lea eax, [esp + 0x1c]
push eax
push 1
push dword [esp + 0x38]
call sub.ADVAPI32.DLL_ChangeServiceConfig2W
push dword [esp + 0x30]
call sub.ADVAPI32.DLL_CloseServiceHandle
push dword [esp + 0x2c]
call sub.ADVAPI32.DLL_CloseServiceHandle
push 2
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerW
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
je 0x416c09
push 0xf01ff
mov eax, dword [0x45b2e8]
push eax
push dword [esp + 0x34]
call sub.ADVAPI32.DLL_OpenServiceW
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
je 0x416c00
push 0
push 0
push dword [esp + 0x38]
call sub.ADVAPI32.DLL_StartServiceW
push dword [esp + 0x30]
call sub.ADVAPI32.DLL_CloseServiceHandle
push dword [esp + 0x2c]
call sub.ADVAPI32.DLL_CloseServiceHandle
push edx
call fcn.004286f0
pop edx
push eax
call fcn.00416f04
mov edx, str.wostmp_
push edx
call fcn.004287f0
lea eax, [esp + 0x38]
push eax
call fcn.00428730
push dword [esp + 0x34]
call fcn.00423ac8
push dword [esp + 0x34]
call fcn.00409814
push edx
call fcn.004286f0
pop edx
push eax
mov edx, dword [esp + 0x38]
push edx
call fcn.004286f0
pop edx
push eax
push edx
call fcn.004287f0
mov edx, 0x457192
push edx
call fcn.004287f0
push 1
push 0x7fffffff
call fcn.00421180
mov ebx, eax
push edx
call fcn.004286f0
pop edx
push eax
push edx
call fcn.004286f0
pop edx
push eax
mov eax, ebx
cdq
push edx
push eax
call fcn.00420460
pop eax
mov edx, 0x457192
push edx
call fcn.004287f0
push 1
push 0x7fffffff
call fcn.00421180
mov ebx, eax
push edx
call fcn.004286f0
pop edx
push eax
push edx
call fcn.004286f0
pop edx
push eax
mov eax, ebx
cdq
push edx
push eax
call fcn.00420460
pop eax
call fcn.00428880
push edx
call fcn.004286f0
pop edx
push eax
push edx
call fcn.004286f0
pop edx
push eax
call fcn.00420990
call fcn.0041f362
add dword [esp], edx
call fcn.0041f362
add dword [esp + 4], edx
call fcn.00424093
call fcn.0041f380
jmp 0x401266
xor eax, eax
push dword [esp + 0x24]
call fcn.004287c0
push dword [esp + 0x34]
call fcn.004287c0
push dword [esp + 0x20]
call fcn.004287c0
push dword [esp + 8]
call fcn.004287c0
push dword [esp + 0xc]
call fcn.004287c0
add esp, 0x38
pop ebx
pop ebp
ret