Function at 0x449fa0
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483b58
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x4b9070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 0
call fcn.004520f0
mov esi, eax
mov ecx, esi
call fcn.00451e90
cmp byte [0x4bd608], 0
jne 0x44a045
mov ecx, 0xf0
call fcn.00452760
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 1
xorps xmm0, xmm0
movsd qword [ebp - 0x48], xmm0
test eax, eax
je 0x44a039
sub esp, 8
mov ecx, eax
movsd qword [esp], xmm0
push 0x4bd608
sub esp, 0xc
push 0x108
push str.C:BuildAgentwork4d643bb3f4c71f96Common_service.cpp
push 0x48
call fcn.00451f60
mov byte [ebp - 4], 0
mov dword [0x4beb7c], eax
jmp 0x44a04d
xor eax, eax
mov byte [ebp - 4], al
mov dword [0x4beb7c], eax
jmp 0x44a04d
xorps xmm0, xmm0
movsd qword [ebp - 0x48], xmm0
mov ecx, esi
call fcn.00451ea0
mov ecx, dword [0x4beb7c]
lea ecx, [ecx + 0xd0]
call fcn.00451e90
mov eax, dword [0x4beb7c]
mov eax, dword [eax]
mov esi, dword [eax + 0x48]
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x44a079
mov eax, dword [edi + 4]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041ab30
mov byte [ebp - 4], 2
push dword [eax]
push str.Installing_service___s_...
push dword [0x4beb7c]
call esi
mov edx, dword [ebp - 0x1c]
add esp, 0xc
add edx, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 3
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44a0b9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov ecx, dword [0x4beb7c]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x4beb7c]
lea ecx, [ecx + 0xd0]
call fcn.00451ea0
push 0
lea ecx, [ebp - 0x14]
call fcn.0041aef0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
jne 0x44a180
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, 0x104
or ecx, edx
jge 0x44a119
push 0x104
lea ecx, [ebp - 0x14]
call fcn.0041b7b0
mov eax, dword [ebp - 0x14]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
neg eax
sbb esi, esi
neg esi
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x14]
push dword [ecx - 8]
push ecx
call fcn.004603a0
mov edx, eax
add esp, 8
test edx, edx
js 0x44a780
mov ecx, dword [ebp - 0x14]
cmp edx, dword [ecx - 8]
jg 0x44a780
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 4
mov word [eax + edx*2], cx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x44a178
movzx eax, ax
or eax, 0x80070000
test esi, esi
je 0x44a76a
call fcn.004520f0
mov esi, eax
mov ecx, esi
call fcn.00451e90
cmp byte [0x4bd60b], 0
jne 0x44a1e1
mov ecx, 0xf0
call fcn.00452760
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 6
test eax, eax
je 0x44a1d6
movsd xmm0, qword [ebp - 0x48]
sub esp, 8
mov ecx, eax
movsd qword [esp], xmm0
push 0x4bd60b
sub esp, 0xc
push 0x111
push str.C:BuildAgentwork4d643bb3f4c71f96Common_service.cpp
push 0x48
call fcn.00451f60
jmp 0x44a1d8
xor eax, eax
mov byte [ebp - 4], 4
mov dword [0x4beb70], eax
mov ecx, esi
call fcn.00451ea0
mov ecx, dword [0x4beb70]
lea ecx, [ecx + 0xd0]
call fcn.00451e90
mov eax, dword [0x4beb70]
lea ecx, [ebp - 0x1c]
push dword [edi + 8]
mov eax, dword [eax]
mov esi, dword [eax + 0x48]
call fcn.0041ab30
mov byte [ebp - 4], 7
push dword [eax]
push str.Open_SCM_manager___s_...
push dword [0x4beb70]
call esi
mov edx, dword [ebp - 0x1c]
add esp, 0xc
add edx, 0xfffffff0
mov byte [ebp - 4], 8
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44a242
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
mov ecx, dword [0x4beb70]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x4beb70]
lea ecx, [ecx + 0xd0]
call fcn.00451ea0
mov ecx, dword [edi + 8]
push 0xf003f
push 0
call fcn.0044c500
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x34], edi
xor eax, eax
mov byte [ebp - 4], 9
test edi, edi
setne al
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x44a29d
movzx eax, ax
or eax, 0x80070000
cmp dword [ebp - 0x1c], 0
je 0x44a78a
call fcn.004520f0
mov esi, eax
mov ecx, esi
call fcn.00451e90
cmp byte [0x4bd605], 0
jne 0x44a308
mov ecx, 0xf0
call fcn.00452760
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0xa
test eax, eax
je 0x44a2fd
movsd xmm0, qword [ebp - 0x48]
sub esp, 8
mov ecx, eax
movsd qword [esp], xmm0
push 0x4bd605
sub esp, 0xc
push 0x11f
push str.C:BuildAgentwork4d643bb3f4c71f96Common_service.cpp
push 0x48
call fcn.00451f60
jmp 0x44a2ff
xor eax, eax
mov byte [ebp - 4], 9
mov dword [0x4beb74], eax
mov ecx, esi
call fcn.00451ea0
mov ecx, dword [0x4beb74]
lea ecx, [ecx + 0xd0]
call fcn.00451e90
mov eax, dword [0x4beb74]
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x18]
mov eax, dword [eax]
push dword [esi + 4]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x1c], eax
call fcn.0041ab30
mov byte [ebp - 4], 0xb
push dword [eax]
push str.Create_service___s_...
push dword [0x4beb74]
call dword [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
add esp, 0xc
add edx, 0xfffffff0
mov byte [ebp - 4], 0xc
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44a370
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 9
mov ecx, dword [0x4beb74]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x4beb74]
lea ecx, [ecx + 0xd0]
call fcn.00451ea0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 2
test ecx, ecx
je 0x44a3a6
mov edx, dword [esi + 4]
jmp 0x44a3ab
mov ecx, dword [esi + 4]
mov edx, ecx
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x14]
push 1
push 2
push 0x20
push eax
push ecx
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
mov dword [ebp - 0x38], esi
xor eax, eax
mov byte [ebp - 4], 0xd
test esi, esi
setne al
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x44a3ed
movzx eax, ax
or eax, 0x80070000
cmp dword [ebp - 0x28], 0
je 0x44a7a0
call fcn.004520f0
mov ecx, eax
mov dword [ebp - 0x28], eax
call fcn.00451e90
cmp byte [0x4bd60a], 0
jne 0x44a459
mov ecx, 0xf0
call fcn.00452760
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0xe
test eax, eax
je 0x44a44e
movsd xmm0, qword [ebp - 0x48]
sub esp, 8
mov ecx, eax
movsd qword [esp], xmm0
push 0x4bd60a
sub esp, 0xc
push 0x128
push str.C:BuildAgentwork4d643bb3f4c71f96Common_service.cpp
push 0x50
call fcn.00451f60
jmp 0x44a450
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [0x4beb60], eax
mov ecx, dword [ebp - 0x28]
call fcn.00451ea0
mov ecx, dword [0x4beb60]
lea ecx, [ecx + 0xd0]
call fcn.00451e90
mov eax, dword [0x4beb60]
mov eax, dword [eax]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x44a48c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041ab30
mov byte [ebp - 4], 0xf
push dword [eax]
push str.Create_service___s__:_OK
push dword [0x4beb60]
call dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
add esp, 0xc
add edx, 0xfffffff0
mov byte [ebp - 4], 0x10
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44a4ca
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xd
mov ecx, dword [0x4beb60]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x4beb60]
lea ecx, [ecx + 0xd0]
call fcn.00451ea0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x44a613
mov dword [ebp - 0x1c], eax
call fcn.004520f0
mov ecx, eax
mov dword [ebp + 0x10], eax
call fcn.00451e90
cmp byte [0x4bd602], 0
jne 0x44a55a
mov ecx, 0xf0
call fcn.00452760
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0x11
test eax, eax
je 0x44a54f
movsd xmm0, qword [ebp - 0x48]
sub esp, 8
mov ecx, eax
movsd qword [esp], xmm0
push 0x4bd602
sub esp, 0xc
push 0x12d
push str.C:BuildAgentwork4d643bb3f4c71f96Common_service.cpp
push 0x48
call fcn.00451f60
jmp 0x44a551
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [0x4beb78], eax
mov ecx, dword [ebp + 0x10]
call fcn.00451ea0
mov ecx, dword [0x4beb78]
lea ecx, [ecx + 0xd0]
call fcn.00451e90
mov eax, dword [0x4beb78]
lea ecx, [ebp - 0x28]
mov eax, dword [eax]
mov eax, dword [eax + 0x48]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x18]
push dword [eax + 4]
call fcn.0041ab30
mov byte [ebp - 4], 0x12
push dword [eax]
push str.Change_service_config___s_...
push dword [0x4beb78]
call dword [ebp + 0x10]
mov edx, dword [ebp - 0x28]
add esp, 0xc
add edx, 0xfffffff0
mov byte [ebp - 4], 0x13
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44a5c3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xd
mov ecx, dword [0x4beb78]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x4beb78]
lea ecx, [ecx + 0xd0]
call fcn.00451ea0
lea eax, [ebp - 0x1c]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
neg eax
sbb ebx, ebx
neg ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x44a608
movzx eax, ax
or eax, 0x80070000
test ebx, ebx
je 0x44a7b6
or ebx, 0xffffffff
test esi, esi
je 0x44a622
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
jmp 0x44a628
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x44a62f
push edi
call esi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x14
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x44a64b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
push eax
lea ecx, [ebp - 0x20]
call fcn.00416db0
push 0x4b6c64
mov eax, ecx
push eax
call fcn.0045807a
push 0x80070057
call fcn.00416dd0
push eax
lea ecx, [ebp - 0x24]
call fcn.00416db0
push 0x4b6c64
mov eax, ecx
push eax
call fcn.0045807a
push eax
lea ecx, [ebp - 0x2c]
call fcn.00416db0
push 0x4b6c64
mov eax, ecx
push eax
call fcn.0045807a
push eax
lea ecx, [ebp - 0x30]
call fcn.00416db0
push 0x4b6c64
mov eax, ecx
push eax
call fcn.0045807a
int3