Function at 0x50d030
Capabilities:
Check for time delay via gettickcount
Check if file exists
Copy file
Create service
Delete file
Modify service
Persist via windows service
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56755c
mov eax, dword fs:[0]
push eax
mov eax, 0x1038
call fcn.00512250
mov eax, dword [0x5df7e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x1034], esi
test esi, esi
jne 0x50d099
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_faild.__ld_
call fcn.004c1030
add esp, 8
or eax, 0xffffffff
jmp 0x50d669
push 0xf01ff
push dword [0x5e5048]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, eax
test edi, edi
je 0x50d1fb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x103c], eax
lea eax, [ebp - 0x1030]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ecx, dword [ebp - 0x102c]
cmp ecx, 1
je 0x50d1fb
cmp ecx, 3
jne 0x50d146
nop dword [eax]
push str.stop_pending...
call fcn.004c1030
mov eax, 0xcccccccd
add esp, 4
mul dword [ebp - 0x1018]
shr edx, 3
cmp edx, 0x3e8
jae 0x50d11a
mov edx, 0x3e8
jmp 0x50d128
cmp edx, 0x2710
mov eax, 0x2710
cmova edx, eax
push edx
call ebx
lea eax, [ebp - 0x1030]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x50d189
cmp dword [ebp - 0x102c], 3
je 0x50d0f0
lea eax, [ebp - 0x1030]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x50d1a7
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push dword [ebp - 0x1034]
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_faild.__ld_
call fcn.004c1030
add esp, 8
mov eax, 0xfffffffe
jmp 0x50d669
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.QueryServiceStatusEx_failed___d__n
call fcn.004c1030
add esp, 8
mov eax, 0xfffffff6
jmp 0x50d669
cmp dword [ebp - 0x102c], 1
je 0x50d1fb
push dword [ebp - 0x1018]
call ebx
lea eax, [ebp - 0x1030]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x50d36e
cmp dword [ebp - 0x102c], 1
je 0x50d35c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x103c]
cmp eax, 0x7530
ja 0x50d345
cmp dword [ebp - 0x102c], 1
jne 0x50d1b0
push 0x400
lea eax, [ebp - 0x810]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x1038]
push eax
call fcn.0050c720
add esp, 4
mov dword [ebp - 4], 0
call fcn.0050d690
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test al, al
je 0x50d3a2
push dword [ebp - 0x1038]
lea eax, [ebp - 0x810]
push eax
push str.copy_file_from__s_to__s
call fcn.004c1030
add esp, 0xc
push dword [ebp - 0x1038]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x50d2d8
push dword [ebp - 0x1038]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x50d2d8
mov eax, dword [ebp - 0x1038]
xorps xmm0, xmm0
mov dword [ebp - 0x1028], eax
mov eax, 0x214
mov word [ebp - 0x1020], ax
lea eax, [ebp - 0x1030]
push eax
mov dword [ebp - 0x1030], 0
movlpd qword [ebp - 0x101e], xmm0
mov dword [ebp - 0x1016], 0
mov dword [ebp - 0x102c], 3
mov dword [ebp - 0x1024], 0
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push eax
push str.delete_dictory___d_.
call fcn.004c1030
add esp, 8
push 0
push dword [ebp - 0x1038]
lea eax, [ebp - 0x810]
mov esi, 0xa
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x50d39c
nop word [eax + eax]
mov eax, esi
dec esi
test eax, eax
je 0x50d39c
call ebx
cmp eax, 0x20
jne 0x50d38c
push str.file_is_using
call fcn.004c1030
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [ebp - 0x1038]
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x50d300
jmp 0x50d39c
push str.Wait_timed_out
call fcn.004c1030
add esp, 4
mov eax, 0xfffffff4
jmp 0x50d669
push str.service_is_stoped.
call fcn.004c1030
add esp, 4
jmp 0x50d1fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_faild_2.__ld_
call fcn.004c1030
add esp, 8
mov eax, 0xfffffff5
jmp 0x50d669
call ebx
push eax
push str.copy_fail.__ld_
call fcn.004c1030
add esp, 8
mov esi, dword [ebp - 0x1034]
test edi, edi
jne 0x50d47c
lea ecx, [ebp - 0x1040]
call fcn.004baf80
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1040]
push dword [ebp - 0x1038]
push str.__s_
push eax
call fcn.004c0530
add esp, 0xc
mov eax, dword [0x5e5048]
push edi
push edi
push 0x5bd23c
push edi
push edi
push dword [ebp - 0x1040]
push 1
push 2
push 0x10
push 0xf01ff
push eax
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
test edi, edi
je 0x50d43a
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x400
lea ecx, [ebp - 0x1010]
push ecx
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x103c], eax
lea eax, [ebp - 0x103c]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov byte [ebp - 4], 0
or eax, 0xffffffff
mov edx, dword [ebp - 0x1040]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x50d45c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
jne 0x50d47c
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push str.hService_is_null.
call fcn.004c1030
add esp, 4
lea esi, [edi - 3]
jmp 0x50d642
lea eax, [ebp - 0x1044]
xor esi, esi
push eax
push esi
push esi
push edi
mov dword [ebp - 0x103c], esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x50d4b4
call ebx
cmp eax, 0x7a
jne 0x50d4f8
push dword [ebp - 0x1044]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x103c], esi
lea eax, [ebp - 0x1044]
push eax
push dword [ebp - 0x1044]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x50d523
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push dword [ebp - 0x1034]
call esi
call ebx
push eax
push str.QueryServiceConfig_faild.__ld_
call fcn.004c1030
add esp, 8
mov esi, 0xfffffff9
jmp 0x50d642
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push dword [ebp - 0x1034]
call esi
call ebx
push eax
push str.QueryServiceConfig_is_not_ERROR_INSUFFICIENT_BUFFER.__ld_
call fcn.004c1030
add esp, 8
mov esi, 0xfffffffa
jmp 0x50d642
push dword [ebp - 0x103c]
mov esi, dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, 2
je 0x50d581
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x50d581
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push dword [ebp - 0x1034]
call esi
call ebx
push eax
push str.ChangeServiceConfig_faild.__ld_
call fcn.004c1030
add esp, 8
mov esi, 0xfffffff8
jmp 0x50d642
lea eax, [ebp - 0x1030]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x50d5be
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push dword [ebp - 0x1034]
call esi
call ebx
push eax
push str.QueryServiceStatus_faild.__ld_
call fcn.004c1030
add esp, 8
mov esi, 0xfffffffc
jmp 0x50d642
mov eax, dword [ebp - 0x102c]
cmp eax, 1
je 0x50d5f6
cmp eax, 3
je 0x50d5f6
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push dword [ebp - 0x1034]
call esi
call ebx
push eax
push str.dwCurrentState_is_running.__ld_
call fcn.004c1030
add esp, 8
mov esi, 2
jmp 0x50d642
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x50d62f
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push dword [ebp - 0x1034]
call esi
call ebx
push eax
push str.StartService_faild.__ld_
call fcn.004c1030
add esp, 8
mov esi, 0xfffffffb
jmp 0x50d642
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push dword [ebp - 0x1034]
call esi
xor esi, esi
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov eax, dword [ebp - 0x1038]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x50d667
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005121be
mov esp, ebp
pop ebp
ret