Function at 0x4a7fd3
Capabilities:
Create process on windows
Delete service
Self delete
Terminate process

Disassembly:
push 0x88
mov eax, 0x5257eb
call fcn.004d8abf
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov eax, dword [0x57d3e4]
xor esi, esi
cmp dword [eax - 0xc], esi
jne 0x4a802d
push 0x5621
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2c]
call fcn.00406620
mov dword [ebp - 4], esi
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, ebx
jmp 0x4a842f
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 4], 1
test esi, esi
jne 0x4a8084
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x5623
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2c]
call fcn.00406620
mov byte [ebp - 4], 2
jmp 0x4a8010
push 0xf01ff
push dword [0x57d3e4]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x4a80a7
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4a8103
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
je 0x4a80ff
cmp eax, 0x430
je 0x4a80ff
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x5632
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
mov ecx, ebx
call fcn.00406620
test edi, edi
je 0x4a80f3
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4a8026
test edi, edi
je 0x4a810a
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edx, edx
lea ecx, [ebp - 0x18]
call fcn.00428920
push ecx
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x546e14
call fcn.00406fea
push ecx
mov byte [ebp - 4], 4
mov ebx, esp
push ecx
mov ecx, dword [ebp - 0x18]
mov edi, esp
mov dword [ebp - 0x10], edi
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
mov ecx, ebx
mov dword [edi], eax
call fcn.004297db
pop ecx
mov byte [ebp - 4], 3
call fcn.00429843
pop ecx
pop ecx
test al, al
jne 0x4a81ab
push 0x563a
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2c]
call fcn.00406620
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x2c]
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00407189
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x1c]
jmp 0x4a842f
push ecx
mov ecx, dword [ebp - 0x18]
mov edi, esp
mov dword [ebp - 0x10], edi
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x20]
mov dword [edi], eax
call fcn.004297db
pop ecx
push 0
push str.ninite.
mov ecx, eax
call fcn.004045bb
mov ecx, dword [ebp - 0x20]
mov edi, eax
add ecx, 0xfffffff0
call fcn.00407189
cmp edi, 0xffffffff
jne 0x4a820d
push 0x563b
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x2c]
call fcn.00406620
mov byte [ebp - 4], 6
jmp 0x4a817a
lea eax, [ebp - 0x18]
mov edx, str._SystemRoot_System32cmd.exe__c__choice__T_2__D_y__del__F___
push eax
lea ecx, [ebp - 0x20]
call fcn.004093b4
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x14]
mov edx, eax
mov dword [esp], 0x550ab8
call fcn.00409442
pop ecx
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00407189
push ecx
mov ecx, dword [ebp - 0x14]
lea ebx, [ebp - 0x14]
mov edi, esp
mov dword [ebp - 0x10], edi
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x2c]
mov edx, ebx
mov dword [edi], eax
call fcn.00428612
pop ecx
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x2c], 0
jge 0x4a82ce
cmp dword [ebp - 0x28], 0
mov eax, 0x563f
cmovne eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x24]
mov edi, esp
mov dword [ebp - 0x10], edi
lea ecx, [ecx - 0x10]
call fcn.004070e7
add eax, 0x10
lea ecx, [ebp - 0x48]
mov dword [edi], eax
call fcn.00406620
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 0xb
call fcn.0040121b
mov ecx, dword [ebp - 0x40]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x14]
jmp 0x4a8189
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.00407189
push 0x44
pop edi
push edi
xor ebx, ebx
lea eax, [ebp - 0x94]
push ebx
push eax
call fcn.004d9f30
add esp, 0xc
mov dword [ebp - 0x94], edi
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x14]
cmp dword [eax - 4], 1
jle 0x4a831c
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00406d8c
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4a8390
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x564e
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x48]
call fcn.00406620
mov byte [ebp - 4], 0xd
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x48]
push eax
mov ecx, edi
call fcn.0040121b
mov ecx, dword [ebp - 0x40]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x4a83ec
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x4a83dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x564f
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x48]
call fcn.00406620
mov byte [ebp - 4], 0xe
jmp 0x4a8375
mov edi, dword [ebp - 0x1c]
lea ecx, [edi + 8]
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.0040687a
cmp dword [ebp - 0x38], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4a8401
push dword [ebp - 0x38]
call ebx
and dword [ebp - 0x38], 0
cmp dword [ebp - 0x3c], 0
je 0x4a8410
push dword [ebp - 0x3c]
call ebx
and dword [ebp - 0x3c], 0
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00407189
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
call fcn.004d8a8d
ret