Function at 0x406ec0
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push 0xf00
mov eax, 0x42810e
call fcn.004162d9
push 0x42d414
call fcn.004087f7
pop ecx
mov edi, 0x200
push edi
lea eax, [ebp - 0xefc]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x406f2b
push 0x100
push 0x43a5c8
call fcn.00405cb8
pop ecx
pop ecx
push eax
push 0x42ca28
call fcn.004087f7
pop ecx
push eax
push 0x42d3f0
call fcn.004087f7
pop ecx
push eax
call fcn.004170f9
add esp, 0xc
jmp 0x407166
push 0x22
pop eax
mov word [ebp - 0x714], ax
xor eax, eax
mov word [ebp - 0x712], ax
lea eax, [ebp - 0xefc]
push eax
lea eax, [ebp - 0x714]
push edi
push eax
call fcn.0041895f
push 0x42d3ec
lea eax, [ebp - 0x714]
push edi
push eax
call fcn.0041895f
lea eax, [ebp - 0x114]
push 0x104
push eax
call fcn.00405d37
add esp, 0x20
test al, al
je 0x407166
lea eax, [ebp - 0xafc]
push 0x1f4
push eax
call fcn.00405e9c
pop ecx
pop ecx
test al, al
je 0x407166
mov edi, 0x100
lea eax, [ebp - 0x314]
push edi
push eax
call fcn.00405f5c
pop ecx
pop ecx
test al, al
je 0x407166
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
lea ecx, [ebp - 0xf08]
mov dword [ebp - 0xf00], eax
call fcn.0040cd22
mov dword [ebp - 4], esi
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0xf08]
call fcn.0040d63c
cmp dword [ebp - 0xf00], esi
je 0x407136
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x714]
push eax
push 1
push 2
push 0x10
push 0xf01ff
lea eax, [ebp - 0x314]
push eax
mov eax, dword [ebp - 0xf08]
lea ecx, [ebp - 0xf08]
call dword [eax + 8]
push eax
push dword [ebp - 0xf00]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, eax
cmp ebx, esi
jne 0x4070bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x407089
push 2
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0xf00]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
cmp ebx, esi
je 0x407089
lea eax, [ebp - 0x314]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x714]
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
push 0x43a5c8
call fcn.00405cb8
pop ecx
pop ecx
push eax
push 0x42d3c8
call fcn.004087f7
pop ecx
push eax
call fcn.004170f9
pop ecx
pop ecx
push dword [ebp - 0xf00]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x407157
lea eax, [ebp - 0xafc]
mov dword [ebp - 0xf0c], eax
lea eax, [ebp - 0xf0c]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
call fcn.0040183e
cmp al, 1
jne 0x40710b
mov ecx, dword [0x43c180]
mov eax, dword [ecx]
call dword [eax + 4]
push 3
mov edi, eax
mov esi, dword [edi]
push 0x10022
push 0x42b6dc
call fcn.004087f7
pop ecx
push eax
push ebx
mov ecx, edi
call dword [esi + 0x178]
push 0x42ca28
call fcn.004087f7
pop ecx
push eax
push 0x42d3b0
call fcn.004087f7
pop ecx
push eax
call fcn.004170f9
pop ecx
pop ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4070aa
push edi
push 0x43a5c8
call fcn.00405cb8
pop ecx
pop ecx
push eax
push 0x42d38c
call fcn.004087f7
pop ecx
push eax
call fcn.004170f9
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf08]
call fcn.0040d56e
call fcn.0041635c
ret