Function at 0x40b760
Capabilities:
Create service
Delete service
Modify service
Persist via windows service
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x4b6e40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push edi
push eax
mov dword [ebp - 0x434], ecx
mov edi, 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x40b7a1
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c3d0
mov esp, ebp
pop ebp
ret
push 0x201
lea ecx, [ebp - 0x414]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40b790
lea eax, [ebp - 0x414]
push eax
call fcn.00472340
lea eax, [ebp - 0x414]
push str.SMMON.EXE
push eax
call fcn.0041e470
lea ecx, [ebp - 0x414]
add esp, 0xc
mov byte [eax], 0
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x40b7e2
mov eax, dword [str.SMSRVNT.EXE]
push ebx
push esi
mov dword [ecx], eax
mov eax, dword [0x496ec4]
push 0xf003f
mov dword [ecx + 4], eax
mov eax, dword [0x496ec8]
push 0
push 0
mov dword [ecx + 8], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x40ba7a
push 0xf01ff
push str.smsrvnt
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x40b95c
mov eax, dword [ebp + 0x14]
cmp eax, 1
jne 0x40b89c
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x430]
push eax
push esi
call edi
test eax, eax
je 0x40b870
cmp dword [ebp - 0x42c], 4
jne 0x40b870
lea eax, [ebp - 0x430]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, edi
lea eax, [ebp - 0x430]
push eax
push esi
call edi
test eax, eax
je 0x40b887
cmp dword [ebp - 0x42c], 4
je 0x40b870
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
jmp 0x40b96c
cmp eax, 2
lea eax, [ebp - 0x430]
push eax
push esi
jne 0x40b910
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
call edi
test eax, eax
je 0x40b8d0
cmp dword [ebp - 0x42c], 4
jne 0x40b8d0
lea eax, [ebp - 0x430]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, edi
lea eax, [ebp - 0x430]
push eax
push esi
call edi
test eax, eax
je 0x40b8e7
cmp dword [ebp - 0x42c], 4
je 0x40b8d0
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop esi
pop ebx
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c3d0
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40ba6c
mov eax, dword [ebp - 0x42c]
cmp eax, 1
jne 0x40b94b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edi, [eax + 1]
push edi
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
jmp 0x40ba5c
cmp eax, 4
jne 0x40ba6c
lea edi, [eax - 1]
jmp 0x40ba6c
cmp dword [ebp + 0x14], 2
je 0x40ba73
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [0x496ee4]
movq xmm0, qword [str.Dialogic]
push 0x200
mov byte [ebp - 8], al
lea eax, [ebp - 0x210]
push 0
push eax
movq qword [ebp - 0x10], xmm0
call fcn.0041c510
add esp, 0xc
lea eax, [ebp - 0x10]
push 0xf01ff
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
je 0x40b9fa
push 0
call esi
xor ecx, ecx
mov al, byte [ebp + ecx - 0x10]
mov byte [ebp + ecx - 0x210], al
lea ecx, [ecx + 1]
test al, al
jne 0x40b9b1
lea ecx, [ebp - 0x10]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40b9d0
sub ecx, edx
mov byte [ebp + ecx - 0x210], al
mov eax, dword [str.LMHOSTS]
mov dword [ebp + ecx - 0x20f], eax
mov eax, dword [0x496eec]
mov dword [ebp + ecx - 0x20b], eax
jmp 0x40ba10
mov eax, dword [str.LMHOSTS]
mov dword [ebp - 0x210], eax
mov eax, dword [0x496eec]
mov dword [ebp - 0x20c], eax
mov edi, dword [sym.imp.ADVAPI32.dll_CreateServiceA]
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 0
push 0
lea eax, [ebp - 0x414]
push eax
push 1
push 2
push 0x110
push 0xf01ff
push str.Layered_Solutions_Monitor
push str.smsrvnt
push ebx
call edi
push 0
push 0xc8
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SleepEx]
test esi, esi
je 0x40ba16
xor edi, edi
push dword [ebp - 0x434]
push dword [ebp + 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
pop esi
pop ebx
mov eax, edi
xor ecx, ebp
pop edi
call fcn.0041c3d0
mov esp, ebp
pop ebp
ret