Function at 0x4089c0
Capabilities:
Create service
Delete service
Modify service
Persist via windows service
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0671
mov eax, dword fs:[0]
push eax
sub esp, 0x50c
mov eax, dword [0x508164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp + 0x20]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x4c0]
call fcn.0040c040
lea eax, [ebp + 0x38]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x4e8]
call fcn.0040c040
lea eax, [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x518]
call fcn.0040c040
lea eax, [ebp + 8]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x500]
call fcn.0040c040
xor eax, eax
mov dword [ebp - method.jze::SingleService_unsigned_int___stdcall_WorkThread_void____class_CService_.virtual_0], vtable.jze::SingleService_unsigned_int___stdcall_WorkThread_void____class_CService_.0
mov dword [ebp - 0x4a4], 0
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 7
mov word [ebp - 0x480], ax
lea eax, [ebp - 0x500]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x468]
call fcn.0040c040
lea eax, [ebp - 0x518]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x450]
call fcn.0040c040
lea eax, [ebp - 0x4c0]
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0x438]
call fcn.0040c040
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - fcn.00406a90], 0x4ea1ac
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x414], 0x64
mov dword [ebp - 0x484], 0
test ecx, ecx
jne 0x408b37
push 0x400
push ecx
lea eax, [ebp - 0x410]
push eax
call fcn.004a5f00
add esp, 0xc
lea eax, [ebp - 0x410]
push 0x200
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x410]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408b20
sub ecx, edx
lea eax, [ebp - 0x410]
sar ecx, 1
jmp 0x408b4b
cmp dword [ebp - 0x4d4], 8
lea eax, [ebp - 0x4e8]
cmovae eax, dword [ebp - 0x4e8]
push ecx
push eax
lea ecx, [ebp - 0x480]
call fcn.0040beb0
lea eax, [ebp - 0x4a8]
mov dword [ebp - 0x4a0], 0x10
lea ecx, [ebp - 0x500]
mov dword [ebp - 0x49c], 1
mov dword [ebp - 0x498], 5
mov dword [ebp - 0x494], 0
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x488], 0
mov dword [0x50fb18], eax
call fcn.0040c2c0
lea ecx, [ebp - 0x518]
call fcn.0040c2c0
lea ecx, [ebp - 0x4e8]
call fcn.0040c2c0
lea ecx, [ebp - 0x4c0]
call fcn.0040c2c0
cmp esi, 1
jne 0x408df7
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0xf003f
push 0
push 0
call ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x408ce2
cmp dword [ebp - 0x454], 8
lea ecx, [ebp - 0x468]
push 1
cmovae ecx, dword [ebp - 0x468]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
setne cl
mov byte [ebp - 0x4c5], cl
test eax, eax
je 0x408c3b
push eax
call edi
mov cl, byte [ebp - 0x4c5]
test cl, cl
jne 0x408ce2
cmp dword [ebp - 0x46c], 8
lea edx, [ebp - 0x480]
push 0
cmovae edx, dword [ebp - 0x480]
lea ecx, [ebp - 0x450]
cmp dword [ebp - 0x43c], 8
lea eax, [ebp - 0x468]
push 0
cmovae ecx, dword [ebp - 0x450]
cmp dword [ebp - 0x454], 8
push 0
cmovae eax, dword [ebp - 0x468]
push 0
push 0x4ea178
push edx
push 1
push 2
push 0x10
push 0xf01ff
push ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ecx, eax
mov dword [ebp - 0x4d0], ecx
test ecx, ecx
je 0x408cdf
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
cmovae eax, dword [ebp - 0x438]
mov dword [ebp - 0x4cc], eax
lea eax, [ebp - 0x4cc]
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push dword [ebp - 0x4d0]
call edi
push esi
call edi
push 0x20000002
push 0
push 0
call ebx
mov ebx, eax
mov dword [ebp - 0x4cc], ebx
test ebx, ebx
je 0x408f53
cmp dword [ebp - 0x454], 8
lea ecx, [ebp - 0x468]
push 0x36
cmovae ecx, dword [ebp - 0x468]
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x408dd5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x4a0]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x408dd2
cmp dword [ebp - 0x49c], 1
jne 0x408dd2
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x408dd2
lea eax, [ebp - 0x4a0]
xor ebx, ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp eax, 1
jne 0x408dcc
mov eax, dword [ebp - 0x414]
cmp eax, 0xffffffff
jle 0x408d95
cmp ebx, eax
jge 0x408dcc
inc ebx
mov eax, dword [ebp - 0x488]
add eax, 0x64
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
cmp dword [ebp - 0x49c], 4
je 0x408de2
lea eax, [ebp - 0x4a0]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp eax, 1
je 0x408d85
mov ebx, dword [ebp - 0x4cc]
push esi
call edi
push ebx
call edi
mov esi, 1
jmp 0x40901a
push esi
call edi
push dword [ebp - 0x4cc]
call edi
mov esi, 1
jmp 0x40901a
push 0x20000000
push 0
push 0
cmp esi, 2
jne 0x408f5d
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
mov edi, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test ebx, ebx
je 0x408ec8
cmp dword [ebp - 0x454], 8
lea ecx, [ebp - 0x468]
push 0x34
cmovae ecx, dword [ebp - 0x468]
push ecx
push ebx
call edi
mov edi, eax
test edi, edi
je 0x408ebf
lea eax, [ebp - 0x4a0]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x408ebc
cmp dword [ebp - 0x49c], 4
jne 0x408ebc
lea eax, [ebp - 0x4a0]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x408ebc
lea eax, [ebp - 0x4a0]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp eax, 1
jne 0x408ebc
nop word [eax + eax]
mov eax, dword [ebp - 0x488]
add eax, 0xa
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x49c], 1
je 0x408ebc
lea eax, [ebp - 0x4a0]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp eax, 1
je 0x408e90
push edi
call esi
push ebx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x408f53
cmp dword [ebp - 0x454], 8
lea ecx, [ebp - 0x468]
push 1
cmovae ecx, dword [ebp - 0x468]
push ecx
push ebx
call edi
test eax, eax
setne cl
mov byte [ebp - 0x4c5], cl
test eax, eax
je 0x408f0f
push eax
call esi
mov cl, byte [ebp - 0x4c5]
test cl, cl
je 0x408f53
cmp dword [ebp - 0x454], 8
lea eax, [ebp - 0x468]
push 0xf01ff
cmovae eax, dword [ebp - 0x468]
push eax
push ebx
call edi
mov edi, eax
test edi, edi
je 0x408f53
lea eax, [ebp - 0x4c4]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call esi
push ebx
call esi
mov esi, 1
jmp 0x40901a
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x408fc5
cmp dword [ebp - 0x454], 8
lea ecx, [ebp - 0x468]
push 0x34
cmovae ecx, dword [ebp - 0x468]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x408fb6
lea eax, [ebp - 0x4a0]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp eax, 1
jne 0x408faf
cmp dword [ebp - 0x49c], 4
movzx ebx, bl
cmove ebx, eax
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bl, bl
je 0x408fc5
xor esi, esi
jmp 0x40901a
cmp dword [ebp - 0x454], 8
lea eax, [ebp - 0x468]
mov dword [ebp - 0x4dc], 0x409490
cmovae eax, dword [ebp - 0x468]
mov dword [ebp - 0x4e0], eax
lea eax, [ebp - 0x4e0]
push eax
mov dword [ebp - 0x4d8], 0
mov dword [ebp - 0x4d4], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x408f53
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x438]
mov dword [ebp - method.jze::SingleService_unsigned_int___stdcall_WorkThread_void____class_CService_.virtual_0], vtable.jze::SingleService_unsigned_int___stdcall_WorkThread_void____class_CService_.0
call fcn.0040c2c0
lea ecx, [ebp - 0x450]
call fcn.0040c2c0
lea ecx, [ebp - 0x468]
call fcn.0040c2c0
lea ecx, [ebp - 0x480]
call fcn.0040c2c0
lea ecx, [ebp + 8]
call fcn.0040c2c0
lea ecx, [ebp + 0x20]
call fcn.0040c2c0
lea ecx, [ebp + 0x38]
call fcn.0040c2c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048d8b2
mov esp, ebp
pop ebp
ret