Function at 0x402064
Capabilities:
Create service
Persist via windows service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push edi
lea eax, [ebp - 0x234]
push 0x200
xor edi, edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4020e4
push str.Service
lea ecx, [ebp - 0x24]
call fcn.00402785
push 0x100
push 0x4073c8
call fcn.00402674
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0xd]
call fcn.0040288f
mov ecx, eax
call fcn.00402b12
push dword [eax + 4]
push dword [eax]
push str.Unable_to_install__s____s_n
call fcn.00401c58
add esp, 0x10
lea ecx, [ebp - 0xc]
call fcn.00402776
lea ecx, [ebp - 0x24]
call fcn.00402776
jmp 0x40234b
push 3
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, edi
mov dword [ebp - 0x20], eax
je 0x40232d
push ebx
push esi
mov esi, str.Service
lea ecx, [ebp - 0xc]
push esi
call fcn.00402785
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0xd]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040288f
mov ecx, eax
call fcn.00402b12
mov ebx, dword [eax]
push esi
lea ecx, [ebp - 0x2c]
call fcn.00402785
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 1]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0040283d
mov ecx, eax
call fcn.00402abe
push edi
mov eax, dword [eax]
push edi
push 0x407504
push edi
lea ecx, [ebp - 0x234]
push edi
push ecx
push 1
push 2
push 0x10
push 0x14
push ebx
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebx, eax
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x1c], ebx
call fcn.00402776
lea ecx, [ebp - 0x2c]
call fcn.00402776
lea ecx, [ebp - 0x18]
call fcn.00402776
lea ecx, [ebp - 0xc]
call fcn.00402776
cmp ebx, edi
je 0x402302
push esi
lea ecx, [ebp - 0xc]
call fcn.00402785
lea eax, [ebp - 0xc]
lea ecx, [ebp - 1]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040288f
mov ecx, eax
call fcn.00402b12
push dword [eax + 4]
push dword [eax]
push str._s_installed._n
call fcn.00401c58
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.00402776
lea ecx, [ebp - 0xc]
call fcn.00402776
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x4022f7
push esi
lea ecx, [ebp - 0xc]
call fcn.00402785
lea eax, [ebp - 0xc]
lea ecx, [ebp - 1]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040288f
mov ecx, eax
call fcn.00402b12
push dword [eax + 4]
push dword [eax]
push str.Starting__s.
call fcn.00401c58
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.00402776
lea ecx, [ebp - 0xc]
call fcn.00402776
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
push 0x4074d0
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
call ebx
test eax, eax
je 0x40226e
cmp dword [0x4074d4], 2
jne 0x40226e
push 0x407124
call fcn.00401c58
mov dword [esp], 0x3e8
call edi
push 0x4074d0
push dword [ebp - 0x1c]
jmp 0x402242
cmp dword [0x4074d4], 4
push esi
jne 0x4022b6
lea ecx, [ebp - 0xc]
call fcn.00402785
lea eax, [ebp - 0xc]
lea ecx, [ebp - 1]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040288f
mov ecx, eax
call fcn.00402b12
push dword [eax + 4]
push dword [eax]
push str._n_s_started._n
call fcn.00401c58
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.00402776
lea ecx, [ebp - 0xc]
jmp 0x4022f2
lea ecx, [ebp - 0xc]
call fcn.00402785
lea eax, [ebp - 0xc]
lea ecx, [ebp - 1]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040288f
mov ecx, eax
call fcn.00402b12
push dword [eax + 4]
push dword [eax]
push str._n_s_failed_to_start._n
call fcn.00401c58
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.00402776
lea ecx, [ebp - 0xc]
call fcn.00402776
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x402320
push 0x100
push 0x4073c8
call fcn.00402674
pop ecx
pop ecx
push eax
push str.CreateService_failed____s_n
call fcn.00401c58
pop ecx
pop ecx
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebx
jmp 0x40234b
push 0x100
push 0x4073c8
call fcn.00402674
pop ecx
pop ecx
push eax
push str.OpenSCManager_failed____s_n
call fcn.00401c58
pop ecx
pop ecx
pop edi
leave
ret