Function at 0x4020c0
Capabilities:
Create service
Persist via windows service
Query service status
Start service
Stop service

Disassembly:
push 0xffffffffffffffff
push 0x405ff8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov eax, dword [esp + 0x38]
push ebx
push ebp
push esi
test eax, eax
push edi
mov dword [esp + 0x18], ecx
je 0x4023a8
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x4023a8
xor eax, eax
mov ecx, 6
lea edi, [esp + 0x20]
push 0xf003f
mov dword [esp + 0x20], 0
push eax
rep stosd dword es:[edi], eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x4023a8
push 0x34
push str.SinforSP
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
jne 0x402157
push edi
call ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
je 0x4021e2
jmp 0x4023a8
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [esp + 0x1c]
push eax
push esi
call ebx
test eax, eax
jne 0x40217a
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
jmp 0x4023a8
cmp dword [esp + 0x20], 4
jne 0x4021dc
lea ecx, [esp + 0x1c]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4021a4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
jmp 0x4023a8
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
cmp eax, 1
jne 0x4021e2
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x20], 1
jne 0x4021cd
push esi
call ebp
push edi
xor esi, esi
call ebp
xor edi, edi
lea ecx, [esp + 0x1c]
push ecx
push esi
call ebx
cmp eax, 1
je 0x4021b1
jmp 0x4021e2
push esi
call ebp
push edi
call ebp
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x18]
push edx
push eax
call fcn.004023c0
xor edi, edi
cmp eax, edi
je 0x4023a8
lea ecx, [esp + 0x10]
call fcn.00402ad0
push 0x104
mov dword [esp + 0x44], edi
mov dword [esp + 0x18], edi
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
cmp esi, edi
je 0x402397
push 0xf003f
push str.SOFTWARESinforSSLPromote
push reloc.WS2_32.dll_bind
lea ecx, [esp + 0x1c]
call fcn.00402b90
cmp eax, edi
jne 0x40238d
lea ecx, [esp + 0x14]
mov edi, 0x104
push ecx
push esi
push str.SuperService
lea ecx, [esp + 0x1c]
call fcn.00402c90
cmp eax, 0xea
jne 0x4022a0
mov ebx, dword [sym.imp.MSVCRT.dll_realloc]
add edi, 0x104
push edi
push esi
call ebx
mov esi, eax
add esp, 8
test esi, esi
je 0x402397
lea edx, [esp + 0x14]
lea ecx, [esp + 0x10]
push edx
push esi
push str.SuperService
call fcn.00402c90
cmp eax, 0xea
je 0x40226e
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x40238d
push 0
push 0
push 0
push 0
push 0
push esi
push 1
push 2
push 0x110
push 0xf01ff
push str.supply_sslvpn_service_for_user_on_lower_right
push str.SinforSP
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
push esi
mov edi, eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
test edi, edi
jne 0x402314
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x40233d
push 0x34
push str.SinforSP
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x40233d
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40233a
cmp dword [esp + 0x20], 1
jne 0x402342
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x402342
push edi
call ebp
push ebx
call ebp
jmp 0x402397
push edi
call ebp
push ebx
call ebp
mov esi, dword [esp + 0x18]
push 0x1388
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x402397
test eax, eax
jne 0x402397
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x402375
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ecx, [esp + 0x10]
mov dword [esp + 0x40], 0xffffffff
call fcn.00402ae0
mov eax, 1
jmp 0x4023aa
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x40], 0xffffffff
call fcn.00402ae0
xor eax, eax
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 8