Function at 0x435720
Capabilities:
Check if file exists
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0xf003f
push 0
mov edi, edx
mov dword [ebp - 0x818], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
push 0
mov dword [ebp - 0x814], edi
mov dword [ebp - 0x810], esi
mov dword [ebp - 0x80c], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x43579e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.LaunchService_OpenSCManager_FAILED_Error__d
push 0xb4
push str.ServiceProvider.cpp
call fcn.004c27e0
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046bea8
mov esp, ebp
pop ebp
ret
push 0xf01ff
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x4358c1
push str.LaunchService_OpenService_FAILED_Need_to_Try_Again
push 0xb4
push str.ServiceProvider.cpp
call fcn.004c27e0
add esp, 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4358b9
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x808], ax
lea eax, [ebp - 0x806]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x808]
push 0x4e8c40
push edi
push str.__s___s
push 0xffffffffffffffff
push eax
call fcn.0041a230
add esp, 0x14
lea eax, [ebp - 0x808]
push esi
push esi
push esi
push esi
push str.COM
push eax
push 1
push 2
push 0x110
push 0xf01ff
push dword [ebp - 0x818]
push dword [ebp - 0x810]
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
jne 0x435884
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.LaunchService_CreateService_Error_d
push 0xb4
push str.ServiceProvider.cpp
call fcn.004c27e0
add esp, 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046bea8
mov esp, ebp
pop ebp
ret
push str.LaunchService_CreateServices_OK
push 0xb4
push str.ServiceProvider.cpp
call fcn.004c27e0
mov eax, dword [ebp - 0x80c]
add esp, 0xc
mov dword [ebp - 0x810], eax
lea eax, [ebp - 0x810]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
jmp 0x4358d8
push edi
push str.LaunchService_FILE_is_Not_Exist_lpSvrExe__s
jmp 0x435858
push str.LaunchService_OpenService_OK
push 0xb4
push str.ServiceProvider.cpp
call fcn.004c27e0
add esp, 0xc
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
neg eax
sbb edi, edi
neg edi
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x80c], eax
call esi
push ebx
call esi
mov esi, dword [ebp - 0x80c]
push edi
push esi
push str.LaunchService_error_d_bSuc_d
push 0xb4
push str.ServiceProvider.cpp
call fcn.004c27e0
add esp, 0x14
test edi, edi
jne 0x435950
cmp esi, 0x420
je 0x435950
push str.LaunchService_run_service_as_cmd
push 0xb4
push str.ServiceProvider.cpp
call fcn.004c27e0
mov ecx, dword [ebp - 0x814]
add esp, 0xc
call fcn.0041bb50
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046bea8
mov esp, ebp
pop ebp
ret