Function at 0x4fb781
Capabilities:
Create service
Persist via windows service

Disassembly:
mov eax, 0x6048
call fcn.0054e7e0
mov eax, dword [0x5c9040]
xor eax, esp
mov dword [esp + 0x6044], eax
mov eax, dword [esp + 0x6050]
push ebx
mov ebx, dword [esp + 0x6050]
push ebp
push esi
push edi
mov ebp, ecx
mov dword [esp + 0x20], eax
push str.Advapi32.dll
mov dword [esp + 0x20], ebp
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ecx, ecx
mov dword [esp + 0x14], eax
mov edi, 0x1000
mov dword [esp + 0x18], ecx
push edi
cmp dword [0x5c9c58], ecx
jne 0x4fb866
lea eax, [esp + 0x54]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4fb81c
push ebp
push str.Unable_to_install__s___error:
push str.os_install_service
push 0x109
push str.srcliblibpaloswindowsos_service.c
push 0x5a9534
push 0x103
push eax
call fcn.004e8a0a
add esp, 0x20
jmp 0x4fbaf4
push 1
push 0x5843e0
mov edx, edi
lea ecx, [esp + 0x58]
call fcn.004ea0d4
mov ecx, 0x5a98f0
call fcn.004edcb1
push 1
push eax
mov edx, edi
lea ecx, [esp + 0x60]
call fcn.004ea0d4
mov ecx, ebx
call fcn.004edcb1
add esp, 0xc
lea ecx, [esp + 0x1054]
mov edx, edi
push eax
call fcn.004ea31a
pop ecx
pop ecx
jmp 0x4fb8f5
lea eax, [esp + 0x2054]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4fb8aa
call fcn.004fb67d
push eax
push ebp
push str.Unable_to_install__s____s_n
push str.os_install_service
push 0x116
push str.srcliblibpaloswindowsos_service.c
push 0x5a9534
push 3
push 0
call fcn.004e8a0a
add esp, 0x24
jmp 0x4fbaf4
push 0x5af2dc
lea eax, [esp + 0x2054]
push edi
push eax
call fcn.00537961
add esp, 0xc
mov ecx, 0x5a98f0
call fcn.004edc5a
push eax
lea eax, [esp + 0x2054]
push edi
push eax
call fcn.00537961
add esp, 0xc
mov ecx, ebx
call fcn.004edc5a
push eax
lea eax, [esp + 0x4054]
push edi
push eax
call fcn.00537885
add esp, 0xc
push str.ChangeServiceConfig2W
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edi, edi
mov dword [0x896778], eax
push 0xf003f
push edi
push edi
cmp dword [0x5c9c58], edi
jne 0x4fb922
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
jmp 0x4fb928
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x4fb95a
push str.OpenSCManager_error:
push str.os_install_service
push 0x129
push str.srcliblibpaloswindowsos_service.c
push 0x5a9534
push 0x103
push edi
call fcn.004e8a0a
add esp, 0x1c
jmp 0x4fbaf4
mov eax, dword [esp + 0x6064]
sub eax, 1
je 0x4fb972
sub eax, 1
jne 0x4fb979
mov eax, str.NT_AUTHORITYNetworkService
jmp 0x4fb97d
mov eax, str.NT_AUTHORITYLocalService
jmp 0x4fb97d
mov eax, dword [esp + 0x18]
cmp dword [0x5c9c58], 0
mov ecx, ebp
push edi
jne 0x4fb9b4
push edi
push edi
push edi
push edi
lea eax, [esp + 0x64]
push eax
push 1
push 2
push 0x10
lea eax, [esp + 0x1074]
push 0xf01ff
push eax
call fcn.004edcb1
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
jmp 0x4fb9e0
push eax
push edi
push edi
push edi
lea eax, [esp + 0x2064]
push eax
push 1
push 2
push 0x10
lea eax, [esp + 0x4074]
push 0xf01ff
push eax
call fcn.004edc5a
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebp, eax
test ebp, ebp
je 0x4fbac3
push dword [esp + 0x1c]
xor eax, eax
and dword [esp + 0x18], 0
lea edi, [esp + 0x28]
stosd dword es:[edi], eax
push str._s_service_installed._n
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, str.os_install_service
push edi
push 0x15e
push str.srcliblibpaloswindowsos_service.c
push 0x5a9534
push 6
push 0
call fcn.004e8a0a
add esp, 0x20
cmp dword [0x896778], 0
je 0x4fbab8
mov ecx, dword [esp + 0x20]
call fcn.004edc5a
mov dword [esp + 0x14], eax
xor esi, esi
lea eax, [esp + 0x14]
inc esi
push eax
push esi
push ebp
call dword [0x896778]
and dword [esp + 0x2c], 0
mov eax, 0x1388
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x38]
push 3
mov dword [esp + 0x3c], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x4c], esi
pop esi
mov dword [esp + 0x34], eax
lea eax, [esp + 0x24]
push eax
push 2
push ebp
mov dword [esp + 0x30], 0x15180
mov dword [esp + 0x3c], esi
call dword [0x896778]
test eax, eax
jne 0x4fbab8
push str.setServiceRecovery_error_n
push edi
push 0x179
push str.srcliblibpaloswindowsos_service.c
push 0x5a9534
push esi
push eax
call fcn.004e8a0a
add esp, 0x1c
push ebp
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4fbaed
call fcn.004fb67d
push eax
push str.CreateService_failed____s_n
push str.os_install_service
push 0x17e
push str.srcliblibpaloswindowsos_service.c
push 0x5a9534
push 3
push edi
call fcn.004e8a0a
add esp, 0x20
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [esp + 0x6054]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051b034
add esp, 0x6048
ret