Function at 0x45dc02
Capabilities:
Accept command line arguments
Create service
Delete service
Persist via windows service
Query service status
Start service

Disassembly:
push 0x74
mov eax, 0x51b684
call fcn.004d8af2
mov dword [ebp - 0x78], edx
mov esi, ecx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x68], esi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x3c], eax
cmp byte [0x57d3fd], bl
jne 0x45dc66
push 0x127
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x54]
call fcn.00406620
lea eax, [ebp - 0x54]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.0040121b
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
call fcn.00407189
mov eax, esi
jmp 0x45e242
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x5c], esi
mov dword [ebp - 4], 1
test esi, esi
jne 0x45dcd7
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x12a
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x54]
call fcn.00406620
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x54]
push eax
mov byte [ebp - 4], 2
call fcn.0040121b
mov ecx, dword [ebp - 0x4c]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x45e23f
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call ebx
push eax
lea eax, [ebp - 0x48]
push 0x5492c4
push eax
call fcn.004011e0
mov edi, eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 3
call fcn.004282f6
push edi
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x34]
call fcn.0040a037
add esp, 0x10
mov ecx, dword [ebp - 0x60]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x48]
lea ecx, [ecx - 0x10]
call fcn.00407189
xor edx, edx
lea ecx, [ebp - 0x44]
call fcn.00428920
push 4
mov byte [ebp - 4], 8
call fcn.004d8429
mov dword [ebp - 0x60], eax
pop ecx
mov dword [ebp - 0x30], eax
mov dword [eax], 0
push eax
mov byte [ebp - 4], 9
call ebx
push eax
lea eax, [ebp - 0x40]
push str._d__p
push eax
call fcn.004011e0
add esp, 0x10
and dword [ebp - 0x64], 0
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x40]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0xb
push eax
mov edx, 0x5447e8
lea ecx, [ebp - 0x68]
call fcn.004093b4
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x74]
mov edx, eax
mov dword [esp], str.___systemservice
call fcn.00409442
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x70]
mov ebx, dword [eax]
mov edx, str.Ninite_Temporary_Service
lea eax, [ebp - 0x34]
push eax
call fcn.004093b4
mov byte [ebp - 4], 0xe
mov edi, dword [eax]
lea ecx, [ebp - 0x6c]
lea eax, [ebp - 0x34]
mov edx, str.NiniteTempSys
push eax
call fcn.004093b4
add esp, 0xc
xor ecx, ecx
push 0x53d648
push ecx
push ecx
push ecx
push ecx
push ebx
push 1
push 2
push 0x10
push 0xf01ff
push edi
push dword [eax]
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
mov dword [ebp - 0x58], edi
mov ecx, dword [ebp - 0x6c]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x70]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x74]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x68]
add ecx, 0xfffffff0
call fcn.00407189
test edi, edi
jne 0x45dec5
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x14f
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x54]
call fcn.00406620
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x54]
push eax
mov byte [ebp - 4], 0x13
call fcn.0040121b
mov ecx, dword [ebp - 0x4c]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x45de90
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x40]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x30]
call fcn.004ab2ac
mov ecx, dword [ebp - 0x44]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x34]
lea ecx, [ecx - 0x10]
call fcn.00407189
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x45e23f
mov ebx, dword [ebp - 0x48]
push ebx
push dword [ebp - 0x64]
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x45df15
call fcn.00406710
push edi
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push 0x155
push ebx
push ecx
mov ecx, esp
call fcn.0040687a
mov ecx, dword [ebp - 0x38]
call fcn.00406620
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x45e213
push eax
jmp 0x45e20d
and dword [ebp - 0x30], 0
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x45df97
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x15b
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x54]
call fcn.00406620
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x54]
push eax
mov byte [ebp - 4], 0x14
call fcn.0040121b
mov ecx, dword [ebp - 0x4c]
lea ecx, [ecx - 0x10]
call fcn.00407189
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
test ebx, ebx
je 0x45df87
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x40]
lea ecx, [ecx - 0x10]
call fcn.00407189
jmp 0x45e226
push 7
xor eax, eax
lea edi, [ebp - 0x2c]
and dword [ebp - 0x48], eax
pop ecx
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x58]
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x45e1b0
cmp dword [ebp - 0x28], 1
je 0x45dffe
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp eax, 0x64
jb 0x45dfa7
cmp dword [ebp - 0x28], 1
je 0x45e006
push 0x16b
push 0x80004005
push ecx
mov ecx, esp
push str.Service_not_stopped
call fcn.00406fea
mov ecx, dword [ebp - 0x38]
call fcn.00406620
jmp 0x45e1ff
mov esi, dword [ebp - 0x60]
mov dword [ebp - 0x30], esi
jmp 0x45e009
mov esi, dword [ebp - 0x60]
xor edi, edi
cmp dword [esi], edi
jne 0x45e077
push 0x16e
push 0x80004005
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x54]
call fcn.00406620
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x54]
push eax
mov byte [ebp - 4], 0x16
call fcn.0040121b
mov ecx, dword [ebp - 0x4c]
lea ecx, [ecx - 0x10]
call fcn.00407189
push dword [ebp - 0x58]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
test ebx, ebx
je 0x45e05a
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x40]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x45e179
cmp dword [eax], edi
jmp 0x45e160
push dword [ebp - 0x78]
push 1
push 3
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push 0xf01ff
push dword [esi]
call edi
test eax, eax
jne 0x45e0cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x170
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x54]
call fcn.00406620
mov byte [ebp - 4], 0x17
jmp 0x45e11e
push dword [ebp - 0x3c]
push 2
push 3
push 0
push 0xf01ff
push dword [esi]
call edi
test eax, eax
jne 0x45e199
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x171
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x54]
call fcn.00406620
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x54]
push eax
call fcn.0040121b
mov ecx, dword [ebp - 0x4c]
lea ecx, [ecx - 0x10]
call fcn.00407189
push dword [ebp - 0x58]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
test ebx, ebx
je 0x45e14b
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x40]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x45e179
cmp dword [eax], 0
je 0x45e16d
mov eax, dword [ebp - 0x30]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 4
push dword [ebp - 0x30]
call fcn.004d840d
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x34]
lea ecx, [ecx - 0x10]
call fcn.00407189
push dword [ebp - 0x5c]
call esi
jmp 0x45e23f
mov eax, dword [ebp - 0x38]
xor edi, edi
lea ecx, [eax + 8]
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.0040687a
jmp 0x45e044
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
push 0x162
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
push eax
push ecx
mov ecx, esp
call fcn.0040687a
lea ecx, [ebp - 0x54]
call fcn.00406620
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x54]
push eax
mov byte [ebp - 4], 0x15
call fcn.0040121b
mov ecx, dword [ebp - 0x4c]
lea ecx, [ecx - 0x10]
call fcn.00407189
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
test ebx, ebx
je 0x45e213
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x40]
lea ecx, [ecx - 0x10]
call fcn.00407189
lea ecx, [ebp - 0x30]
call fcn.004ab2ac
mov ecx, dword [ebp - 0x44]
lea ecx, [ecx - 0x10]
call fcn.00407189
mov ecx, dword [ebp - 0x34]
lea ecx, [ecx - 0x10]
call fcn.00407189
push esi
call edi
mov eax, dword [ebp - 0x38]
call fcn.004d8aa1
ret