Function at 0x449850
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push 0xffffffffffffffff
push 0x4c513c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf0
push ebx
push ebp
xor ebx, ebx
push esi
mov dword [esp + 0xc], ebx
mov esi, 0xf
push edi
mov dword [esp + 0x18], ecx
mov dword [ecx], ebx
mov dword [esp + 0xa8], esi
mov dword [esp + 0xa4], ebx
mov byte [esp + 0x94], bl
mov dword [esp + 0x108], ebx
mov dword [esp + 0x8c], esi
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
mov eax, dword [esp + 0x114]
cmp dword [eax + 0x14], ebx
mov byte [esp + 0x108], 1
jne 0x4498e2
lea eax, [esp + 0xac]
push eax
call fcn.00447d90
add esp, 4
mov byte [esp + 0x108], 2
mov dword [esp + 0x10], 1
lea ecx, [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x11c]
lea edx, [esp + 0x94]
push edx
push ecx
push ebx
push eax
call fcn.0044b4f0
mov al, byte [esp + 0x24]
add esp, 0x14
test al, 1
mov dword [esp + 0x108], 1
mov ebp, 0x10
je 0x449932
cmp dword [esp + 0xc4], ebp
jb 0x449932
mov edx, dword [esp + 0xb0]
push edx
call fcn.00442830
add esp, 4
mov edi, dword [esp + 0x11c]
push 0xffffffffffffffff
push ebx
push edi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
call fcn.00401a00
mov dword [esp + 0x54], esi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
cmp dword [esp + 0x34], ebx
mov byte [esp + 0x108], 4
jne 0x449982
mov eax, dword [esp + 0x110]
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x2c]
call fcn.00401a00
jmp 0x4499cf
mov eax, 0x4e9138
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x449990
sub eax, edx
push eax
push ebx
push 0x4e9138
mov ecx, edi
call fcn.00405a90
mov esi, eax
cmp esi, 0xffffffff
je 0x4499ca
push esi
push ebx
push edi
lea ecx, [esp + 0x2c]
call fcn.00401a00
push 0xffffffffffffffff
add esi, 2
push esi
push edi
lea ecx, [esp + 0x48]
call fcn.00401a00
mov esi, 0xf
push 2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
mov dword [esp + 0x14], edi
cmp edi, ebx
mov byte [esp + 0x108], 5
je 0x449ce1
mov eax, 0x4f2fc0
mov dword [esp + 0x70], esi
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x449a03
sub eax, edx
push eax
push 0x4f2fc0
lea ecx, [esp + 0x60]
call fcn.00401ab0
mov edx, dword [esp + 0x110]
lea ecx, [esp + 0x58]
push ecx
push edx
lea eax, [esp + 0xec]
push eax
mov byte [esp + 0x114], 6
call fcn.00449210
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x84]
add esp, 0xc
cmp ecx, ebp
jae 0x449a56
lea edx, [esp + 0x78]
cmp dword [esp + 0x38], ebp
mov ecx, dword [esp + 0x24]
jae 0x449a64
lea ecx, [esp + 0x24]
cmp dword [eax + 0x18], ebp
jb 0x449a6e
mov eax, dword [eax + 4]
jmp 0x449a71
add eax, 4
push ebx
push ebx
push 0x4ee504
push ebx
push ebx
push edx
mov edx, dword [esp + 0x138]
push ebx
not edx
and edx, 1
or edx, 2
push edx
push ebp
push 2
push ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
cmp dword [esp + 0xfc], ebp
jb 0x449ab3
mov eax, dword [esp + 0xe8]
push eax
call fcn.00442830
add esp, 4
mov dword [esp + 0xfc], 0xf
mov dword [esp + 0xf8], ebx
mov byte [esp + 0xe8], bl
cmp dword [esp + 0x70], ebp
mov byte [esp + 0x108], 8
jb 0x449ae7
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.00442830
add esp, 4
cmp esi, ebx
mov dword [esp + 0x70], 0xf
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
je 0x449cdc
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call ebp
push edi
mov dword [esp + 0x1c], ebx
call ebp
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x14], edi
je 0x449c4a
push 0x4f2fc0
lea ecx, [esp + 0xb0]
call fcn.00401f20
mov eax, dword [esp + 0x110]
lea edx, [esp + 0xac]
push edx
push eax
lea ecx, [esp + 0xd0]
push ecx
mov byte [esp + 0x114], 9
call fcn.00449210
mov ecx, dword [eax + 0x18]
add esp, 0xc
cmp ecx, 0x10
jb 0x449b70
mov eax, dword [eax + 4]
jmp 0x449b73
add eax, 4
push 0x12
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
cmp dword [esp + 0xe0], 0x10
jb 0x449b99
mov edx, dword [esp + 0xcc]
push edx
call fcn.00442830
add esp, 4
cmp dword [esp + 0xc4], 0x10
mov dword [esp + 0xe0], 0xf
mov dword [esp + 0xdc], ebx
mov byte [esp + 0xcc], bl
jb 0x449bcc
mov eax, dword [esp + 0xb0]
push eax
call fcn.00442830
add esp, 4
cmp esi, ebx
je 0x449c47
cmp dword [esp + 0x50], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
je 0x449bff
cmp dword [esp + 0x54], 0x10
jb 0x449bed
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x10], ecx
jmp 0x449bf5
lea edx, [esp + 0x40]
mov dword [esp + 0x10], edx
lea eax, [esp + 0x10]
push eax
push 1
push esi
call edi
xor ecx, ecx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], ecx
mov eax, 1
mov dword [esp + 0x64], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x64], eax
lea eax, [esp + 0x58]
push eax
push 2
lea edx, [esp + 0x20]
mov dword [esp + 0x70], ecx
push esi
mov dword [esp + 0x28], 0xea60
mov dword [esp + 0x64], 0x15180
mov dword [esp + 0x74], edx
call edi
push esi
call ebp
mov edi, dword [esp + 0x14]
push edi
call ebp
mov eax, dword [esp + 0x54]
mov esi, 0x10
cmp eax, esi
jb 0x449c64
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00442830
add esp, 4
cmp dword [esp + 0x38], esi
mov edi, 0xf
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
jb 0x449c88
mov edx, dword [esp + 0x24]
push edx
call fcn.00442830
add esp, 4
cmp dword [esp + 0x8c], esi
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
jb 0x449caa
mov eax, dword [esp + 0x78]
push eax
call fcn.00442830
add esp, 4
cmp dword [esp + 0xa8], esi
mov dword [esp + 0x8c], edi
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
jb 0x449cd5
mov ecx, dword [esp + 0x94]
push ecx
call fcn.00442830
add esp, 4
mov al, 1
jmp 0x449d79
mov esi, 0xf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, ebx
mov edx, dword [esp + 0x18]
mov dword [edx], eax
je 0x449cf8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [esp + 0x54], ebp
jb 0x449d0b
mov eax, dword [esp + 0x40]
push eax
call fcn.00442830
add esp, 4
cmp dword [esp + 0x38], ebp
mov dword [esp + 0x54], esi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
jb 0x449d2a
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00442830
add esp, 4
cmp dword [esp + 0x8c], ebp
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
jb 0x449d4c
mov edx, dword [esp + 0x78]
push edx
call fcn.00442830
add esp, 4
cmp dword [esp + 0xa8], ebp
mov dword [esp + 0x8c], esi
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
jb 0x449d77
mov eax, dword [esp + 0x94]
push eax
call fcn.00442830
add esp, 4
xor al, al
mov ecx, dword [esp + 0x100]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xfc
ret 0x14