Function at 0x59c680
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push dword [0x7ac008]
xor ebx, ebx
push str.Installing_service__ls._n
call fcn.0063f38e
add esp, 8
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x59c6d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.Failed_to_open_Service_Control_Manager:__lu_n
call fcn.0063f38e
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x41765351
push 0x208
call fcn.004f3590
mov esi, eax
add esp, 8
mov dword [ebp - 0xc], esi
test esi, esi
jne 0x59c709
push 0x717d00
call fcn.0063f38e
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
lea eax, [esi + 0xe]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x104
jbe 0x59c73d
mov esi, 0xa1
push esi
push str.Failed_to_get_module_filename:__lu_n
call fcn.0063f38e
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x59c895
push 0x42765351
push 0x20c
call fcn.004f3590
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x59c774
mov esi, 0xa1
push esi
push str.Failed_to_allocate_memory_for_service_path:__lu_n
call fcn.0063f38e
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x59c895
push esi
push 0x6dd7ec
push 0x20c
push ebx
call fcn.004f3b60
add esp, 0x10
push 0
push 0
push 0
push 0
push dword [0x7ac010]
push ebx
push 1
push 2
push 0x10
push 0xf01ff
push dword [0x7ac00c]
push dword [0x7ac008]
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
jne 0x59c801
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x431
jne 0x59c7e7
push str.Service_already_installed._n
call fcn.0063f38e
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x59c895
push esi
push str.Failed_to_create_service:__lu_n
call fcn.0063f38e
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x59c895
lea eax, [ebp - 0x14]
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
push eax
push 2
push esi
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x59c856
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_set_the_recovery_options_for_service:__lu_n
call fcn.0063f38e
add esp, 8
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x717de8
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov esi, eax
test esi, esi
jne 0x59c886
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.Failed_to_set_Service_description_for_the_service:__lu_n
call fcn.0063f38e
add esp, 8
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
mov eax, dword [ebp - 4]
push eax
call edi
push dword [ebp - 0xc]
call fcn.004f3570
add esp, 4
test ebx, ebx
je 0x59c8ad
push ebx
call fcn.004f3570
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret