Function at 0x4b3e60
Capabilities:
Create service
Get common file path
Modify service
Persist via windows service
Start service

Disassembly:
push ebp
lea ebp, [esp - 0xc14]
sub esp, 0xc14
push 0xffffffffffffffff
push 0x6324ae
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x6a6040]
xor eax, ebp
mov dword [ebp + 0xc10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], 0
xor eax, eax
mov dword [ebp - 4], 0
mov word [ebp], ax
lea eax, [ebp]
push 0x608
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4b3eca
cmp eax, 0x608
jbe 0x4b3ed0
xor eax, eax
mov word [ebp], ax
lea edx, [ebp]
lea ecx, [ebp - 0x34]
call fcn.004b7ca0
mov dword [ebp - 0x2c], 1
push 0x65cca8
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x34]
call fcn.005a6ce0
mov ebx, eax
mov byte [ebp - 4], 3
mov ecx, dword [0x6ad854]
test ecx, ecx
je 0x4b3f21
lock inc dword [ecx]
mov esi, dword [ecx + 0xc]
or edi, 0xffffffff
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b3f29
push ecx
call fcn.005a47b0
jmp 0x4b3f29
mov esi, 0x651f68
or edi, 0xffffffff
mov edx, esi
lea ecx, [ebp - 0x18]
call fcn.004b7ca0
mov dword [ebp - 0x2c], 3
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x30]
mov ecx, ebx
push eax
call fcn.005a6c40
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b3f63
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b3f63
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x4b3f79
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b3f79
push ecx
call fcn.005a47b0
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x4b3f93
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b3f93
push ecx
call fcn.005a47b0
push ecx
lea ecx, [ebp - 0x14]
call fcn.005cab40
add esp, 4
mov ebx, eax
mov byte [ebp - 4], 9
mov ecx, dword [0x6ad854]
test ecx, ecx
je 0x4b3fc6
lock inc dword [ecx]
mov esi, dword [ecx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b3fcb
push ecx
call fcn.005a47b0
jmp 0x4b3fcb
mov esi, 0x651f68
mov edx, esi
lea ecx, [ebp - 0x18]
call fcn.004b7ca0
mov dword [ebp - 0x2c], 7
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
call fcn.005a6c40
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b4005
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b4005
push ecx
call fcn.005a47b0
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x4b401f
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b401f
push ecx
call fcn.005a47b0
call fcn.005a45d0
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0xe
test eax, eax
je 0x4b4052
push str._SystemRoot__system32_
mov ecx, eax
call fcn.005a5480
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x4b4057
cmp dword [esi + 0xc], 0
jne 0x4b4057
push ecx
mov ecx, esi
call fcn.005a47b0
xor esi, esi
mov dword [ebp - 0x24], esi
push 0
lea edx, [ebp - 0x24]
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x14]
call fcn.005b43d0
add esp, 4
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x14], 0
test ecx, ecx
je 0x4b4093
lock inc dword [ecx]
mov dword [ebp - 0x18], ecx
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b409b
push ecx
call fcn.005a47b0
jmp 0x4b409b
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], 0xf
test ecx, ecx
je 0x4b40b8
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b40b8
push ecx
call fcn.005a47b0
push 0x6ad854
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0x18]
call fcn.005a6c40
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x4b40de
lock inc dword [ecx]
mov ebx, ecx
mov ecx, dword [ebp - 0x34]
jmp 0x4b40e0
xor ebx, ebx
mov dword [ebp - 0x24], ebx
test ecx, ecx
je 0x4b40f6
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b40f6
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x4b410c
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b410c
push ecx
call fcn.005a47b0
test esi, esi
je 0x4b4121
mov eax, edi
lock xadd dword [esi], eax
dec eax
jne 0x4b4121
push ecx
mov ecx, esi
call fcn.005a47b0
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4b4131
mov edx, dword [eax + 0xc]
jmp 0x4b4136
mov edx, 0x651f68
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x4b4142
mov ecx, dword [eax + 0xc]
jmp 0x4b4147
mov ecx, 0x651f68
push ecx
push 0
call fcn.005c9e60
add esp, 8
mov dword [ebp - 4], 0x15
jmp 0x4b41e4
call fcn.005a45d0
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0x1a
test eax, eax
je 0x4b4217
push str.SYSTEMCurrentControlSetServicesEventLogApplication_
mov ecx, eax
call fcn.005a5480
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x4b421c
cmp dword [esi + 0xc], 0
jne 0x4b421c
push ecx
mov ecx, esi
call fcn.005a47b0
xor esi, esi
mov dword [ebp - 0x14], esi
push 0
mov edx, 0x6ad84c
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x18]
call fcn.005b47f0
add esp, 4
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x1c
push eax
lea ecx, [ebp - 0x14]
call fcn.005a6c40
push 3
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0x28]
push ecx
mov ecx, esp
test eax, eax
je 0x4b425e
lock inc dword [eax]
jmp 0x4b4260
xor eax, eax
mov dword [ecx], eax
push ecx
lea ecx, [ebp - 0x50]
call fcn.005eacb0
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x50], 0x66eac0
test ecx, ecx
je 0x4b4288
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b4288
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b429e
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b429e
push ecx
call fcn.005a47b0
mov byte [ebp - 4], 0x20
test esi, esi
je 0x4b42b7
mov eax, edi
lock xadd dword [esi], eax
dec eax
jne 0x4b42b7
push ecx
mov ecx, esi
call fcn.005a47b0
push 7
push ecx
mov esi, esp
call fcn.005a45d0
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0x21
test eax, eax
je 0x4b42da
push str.TypesSupported
mov ecx, eax
call fcn.005a5480
jmp 0x4b42dc
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [esi], eax
test eax, eax
je 0x4b42fa
cmp dword [eax + 0xc], 0
jne 0x4b42fa
push ecx
mov ecx, eax
call fcn.005a47b0
mov dword [esi], 0
lea ecx, [ebp - 0x50]
call fcn.005eb370
push 0xa
push ecx
mov esi, esp
call fcn.005a45d0
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0x22
test eax, eax
je 0x4b4325
push str.CategoryCount
mov ecx, eax
call fcn.005a5480
jmp 0x4b4327
xor eax, eax
mov byte [ebp - 4], 0x20
mov dword [esi], eax
test eax, eax
je 0x4b4345
cmp dword [eax + 0xc], 0
jne 0x4b4345
push ecx
mov ecx, eax
call fcn.005a47b0
mov dword [esi], 0
lea ecx, [ebp - 0x50]
call fcn.005eb370
test ebx, ebx
je 0x4b436a
lock inc dword [ebx]
mov esi, dword [ebx + 0xc]
mov eax, edi
lock xadd dword [ebx], eax
dec eax
jne 0x4b436f
push ecx
mov ecx, ebx
call fcn.005a47b0
jmp 0x4b436f
mov esi, 0x651f68
push esi
push str.CategoryMessageFile
lea ecx, [ebp - 0x50]
call fcn.005eb2c0
test ebx, ebx
je 0x4b439a
lock inc dword [ebx]
mov esi, dword [ebx + 0xc]
mov eax, edi
lock xadd dword [ebx], eax
dec eax
jne 0x4b439f
push ecx
mov ecx, ebx
call fcn.005a47b0
jmp 0x4b439f
mov esi, 0x651f68
push esi
push str.EventMessageFile
lea ecx, [ebp - 0x50]
call fcn.005eb2c0
lea ecx, [ebp - 0x50]
call fcn.005eb0a0
test ebx, ebx
je 0x4b43ca
mov eax, edi
lock xadd dword [ebx], eax
dec eax
jne 0x4b43ca
push ecx
mov ecx, ebx
call fcn.005a47b0
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x4b43e0
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b43e0
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x4b4447
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b4447
push ecx
call fcn.005a47b0
jmp 0x4b4447
push 0xf003f
push 0
push 0
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4b4730
jmp 0x4b4483
call fcn.005a45d0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0x26
test eax, eax
je 0x4b44b9
push 0x662424
mov ecx, eax
call fcn.005a5480
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x4b44be
cmp dword [esi + 0xc], 0
jne 0x4b44be
push ecx
mov ecx, esi
call fcn.005a47b0
xor esi, esi
mov dword [ebp - 0x14], esi
xor eax, eax
mov dword [ebp - 4], 0x28
mov word [ebp], ax
lea eax, [ebp]
push 0x608
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4b44e7
cmp eax, 0x608
jbe 0x4b44ed
xor eax, eax
mov word [ebp], ax
lea edx, [ebp]
lea ecx, [ebp - 0x38]
call fcn.004b7ca0
or dword [ebp - 0x2c], 0x40
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x14]
call fcn.005a6c40
mov ebx, eax
mov byte [ebp - 4], 0x2a
call fcn.005a45d0
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0x2b
test eax, eax
je 0x4b4543
push 0x662424
mov ecx, eax
call fcn.005a5480
mov dword [ebp - 0x24], eax
test eax, eax
je 0x4b454a
cmp dword [eax + 0xc], 0
jne 0x4b454a
push ecx
mov ecx, eax
call fcn.005a47b0
mov dword [ebp - 0x24], 0
push 0
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 0x2c
push eax
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
call fcn.005a6c40
sub esp, 8
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x34]
push 0x5c
push 0x2f
call fcn.005acc00
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x34]
call fcn.005a44c0
or dword [ebp - 0x2c], 0x20
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x4b4598
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b4598
push ecx
call fcn.005a47b0
lea edx, [ebp - 0x30]
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x3c]
call fcn.005b43d0
add esp, 4
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x4b45c0
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b45c0
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x4b45d6
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b45d6
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x4b45ec
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b45ec
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x4b4602
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b4602
push ecx
call fcn.005a47b0
mov byte [ebp - 4], 0x34
test esi, esi
je 0x4b461b
mov eax, edi
lock xadd dword [esi], eax
dec eax
jne 0x4b461b
push ecx
mov ecx, esi
call fcn.005a47b0
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x4b462a
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x30], eax
jmp 0x4b4631
mov dword [ebp - 0x30], 0x651f68
mov ecx, dword [0x6ad850]
test ecx, ecx
je 0x4b4652
lock inc dword [ecx]
mov esi, dword [ecx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b4657
push ecx
call fcn.005a47b0
jmp 0x4b4657
mov esi, 0x651f68
mov ecx, dword [0x6ad84c]
test ecx, ecx
je 0x4b4678
lock inc dword [ecx]
mov ebx, dword [ecx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b467d
push ecx
call fcn.005a47b0
jmp 0x4b467d
mov ebx, 0x651f68
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x30]
push 1
push 2
push 0x10
push 0xf003f
push esi
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, eax
test ebx, ebx
je 0x4b4760
mov ecx, dword [0x6ad858]
test ecx, ecx
je 0x4b46cb
lock inc dword [ecx]
mov esi, dword [ecx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b46d0
push ecx
call fcn.005a47b0
jmp 0x4b46d0
mov esi, 0x651f68
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], esi
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
push dword [ebp - 0x18]
call esi
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x4b470d
lock xadd dword [ecx], edi
dec edi
jne 0x4b470d
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xc10]
xor ecx, ebp
call fcn.00606a47
lea esp, [ebp + 0xc14]
pop ebp
ret
push 0xffffffffffffffff
push str.OpenSCManager__
lea ecx, [ebp - 0x20]
call fcn.005d1470
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0x25
push eax
lea ecx, [ebp - 0x5c]
call fcn.0041aad0
push 0x6a3c84
lea eax, [ebp - 0x5c]
push eax
call fcn.006089ec
push str.CreateService_
lea ecx, [ebp - 0x2c]
call fcn.005a5400
mov esi, eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x35
push 0x6ad84c
call fcn.005a5bd0
call fcn.004b7c70
add esp, 4
lea ecx, [ebp - 0x24]
mov edx, eax
call fcn.004b7da0
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x36
push eax
mov ecx, esi
call fcn.005a6c40
push 0x662438
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x37
push ecx
mov ecx, eax
call fcn.005a6ce0
push 0xffffffffffffffff
mov ecx, eax
mov byte [ebp - 4], 0x38
call fcn.005a5da0
push eax
lea ecx, [ebp - 0x20]
call fcn.005d1470
lea ecx, [ebp - 0x30]
call fcn.004250c0
lea ecx, [ebp - 0x14]
call fcn.004250c0
lea ecx, [ebp - 0x24]
call fcn.004250c0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x3d
call fcn.004250c0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x64]
call fcn.0041aad0
push 0x6a3c84
lea eax, [ebp - 0x64]
push eax
call fcn.006089ec
int3