Function at 0x4c4920
Capabilities:
Create service
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53a110
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x5ba11c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
call fcn.004d03a0
mov esi, eax
mov ecx, esi
call fcn.004d0140
cmp byte [0x5c2276], 0
jne 0x4c49c5
mov ecx, 0xf0
call fcn.004d0a00
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
xorps xmm0, xmm0
movsd qword [ebp - 0x38], xmm0
test eax, eax
je 0x4c49b9
sub esp, 8
mov ecx, eax
movsd qword [esp], xmm0
push 0x5c2276
sub esp, 0xc
push pe_nt_image_headers32
push 0x587964
push 0x48
call fcn.004d0210
mov byte [ebp - 4], 0
mov dword [0x5c53ec], eax
jmp 0x4c49cd
xor eax, eax
mov byte [ebp - 4], al
mov dword [0x5c53ec], eax
jmp 0x4c49cd
xorps xmm0, xmm0
movsd qword [ebp - 0x38], xmm0
mov ecx, esi
call fcn.004d0150
mov ecx, dword [0x5c53ec]
lea ecx, [ecx + 0xd0]
call fcn.004d0140
mov eax, dword [0x5c53ec]
mov eax, dword [eax]
mov edi, dword [eax + 0x48]
mov eax, dword [ebp + 0xc]
mov esi, eax
test eax, eax
jne 0x4c49fb
mov esi, dword [ebx + 4]
call fcn.0044d220
mov ecx, eax
test ecx, ecx
je 0x4c51b1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
push esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00452e50
test al, al
jne 0x4c4a2f
push esi
lea ecx, [ebp - 0x1c]
call fcn.00452330
mov byte [ebp - 4], 3
mov esi, dword [ebp - 0x1c]
push esi
push 0x58799c
push dword [0x5c53ec]
call edi
add esp, 0xc
add esi, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 4
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4c4a65
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov ecx, dword [0x5c53ec]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x5c53ec]
lea ecx, [ecx + 0xd0]
call fcn.004d0150
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.00452b60
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
jne 0x4c4b2d
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, 0x104
or ecx, edx
jge 0x4c4ac6
push 0x104
lea ecx, [ebp - 0x14]
call fcn.004536f0
mov eax, dword [ebp - 0x14]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
neg eax
sbb esi, esi
neg esi
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x14]
push dword [ecx - 8]
push ecx
call fcn.004f5e70
mov edx, eax
add esp, 8
test edx, edx
js 0x4c51d1
mov ecx, dword [ebp - 0x14]
cmp edx, dword [ecx - 8]
jg 0x4c51d1
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 5
mov word [eax + edx*2], cx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4c4b25
movzx eax, ax
or eax, 0x80070000
test esi, esi
je 0x4c51bb
call fcn.004d03a0
mov esi, eax
mov ecx, esi
call fcn.004d0140
cmp byte [0x5c2279], 0
jne 0x4c4b8e
mov ecx, 0xf0
call fcn.004d0a00
mov dword [ebp + 8], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x4c4b83
movsd xmm0, qword [ebp - 0x38]
sub esp, 8
mov ecx, eax
movsd qword [esp], xmm0
push 0x5c2279
sub esp, 0xc
push 0x111
push 0x587964
push 0x48
call fcn.004d0210
jmp 0x4c4b85
xor eax, eax
mov byte [ebp - 4], 5
mov dword [0x5c53e0], eax
mov ecx, esi
call fcn.004d0150
mov ecx, dword [0x5c53e0]
lea ecx, [ecx + 0xd0]
call fcn.004d0140
mov eax, dword [0x5c53e0]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax]
mov esi, dword [edx + 8]
mov edi, dword [eax + 0x48]
call fcn.0044d220
mov ecx, eax
test ecx, ecx
je 0x4c51db
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
push esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 8
call fcn.00452e50
test al, al
jne 0x4c4bea
push esi
lea ecx, [ebp + 8]
call fcn.00452330
mov byte [ebp - 4], 9
mov esi, dword [ebp + 8]
push esi
push 0x5879d0
push dword [0x5c53e0]
call edi
add esp, 0xc
add esi, 0xfffffff0
mov byte [ebp - 4], 0xa
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4c4c1d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
mov ecx, dword [0x5c53e0]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x5c53e0]
lea ecx, [ecx + 0xd0]
call fcn.004d0150
mov eax, dword [ebp - 0x18]
push 0xf003f
push 0
mov ecx, dword [eax + 8]
call fcn.004c17f0
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x1c], edi
xor ebx, ebx
mov byte [ebp - 4], 0xb
test edi, edi
setne bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4c4c78
movzx eax, ax
or eax, 0x80070000
test ebx, ebx
je 0x4c51e5
call fcn.004d03a0
mov esi, eax
mov ecx, esi
call fcn.004d0140
cmp byte [0x5c2274], 0
jne 0x4c4ce1
mov ecx, 0xf0
call fcn.004d0a00
mov dword [ebp + 8], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x4c4cd6
movsd xmm0, qword [ebp - 0x38]
sub esp, 8
mov ecx, eax
movsd qword [esp], xmm0
push 0x5c2274
sub esp, 0xc
push 0x11f
push 0x587964
push 0x48
call fcn.004d0210
jmp 0x4c4cd8
xor eax, eax
mov byte [ebp - 4], 0xb
mov dword [0x5c53e4], eax
mov ecx, esi
call fcn.004d0150
mov ecx, dword [0x5c53e4]
lea ecx, [ecx + 0xd0]
call fcn.004d0140
mov eax, dword [0x5c53e4]
mov eax, dword [eax]
mov ebx, dword [eax + 0x48]
mov eax, dword [ebp - 0x18]
mov esi, dword [eax + 4]
call fcn.0044d220
mov ecx, eax
test ecx, ecx
je 0x4c51fb
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
push esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xd
call fcn.00452e50
test al, al
jne 0x4c4d3d
push esi
lea ecx, [ebp + 8]
call fcn.00452330
mov byte [ebp - 4], 0xe
mov esi, dword [ebp + 8]
push esi
push 0x5879b8
push dword [0x5c53e4]
call ebx
add esp, 0xc
add esi, 0xfffffff0
mov byte [ebp - 4], 0xf
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4c4d71
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xb
mov ecx, dword [0x5c53e4]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x5c53e4]
lea ecx, [ecx + 0xd0]
call fcn.004d0150
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
neg eax
mov edx, dword [ebp - 0x18]
sbb eax, eax
and eax, 2
test ecx, ecx
je 0x4c4daa
mov edx, dword [edx + 4]
jmp 0x4c4daf
mov ecx, dword [edx + 4]
mov edx, ecx
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x14]
push 1
push dword [ebp + 0x14]
push 0x20
push eax
push ecx
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
mov dword [ebp + 0x14], edi
xor ebx, ebx
mov byte [ebp - 4], 0x10
test edi, edi
setne bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4c4def
movzx eax, ax
or eax, 0x80070000
test ebx, ebx
je 0x4c5205
call fcn.004d03a0
mov esi, eax
mov ecx, esi
call fcn.004d0140
cmp byte [0x5c2278], 0
jne 0x4c4e58
mov ecx, 0xf0
call fcn.004d0a00
mov dword [ebp + 8], eax
mov byte [ebp - 4], 0x11
test eax, eax
je 0x4c4e4d
movsd xmm0, qword [ebp - 0x38]
sub esp, 8
mov ecx, eax
movsd qword [esp], xmm0
push 0x5c2278
sub esp, 0xc
push 0x128
push 0x587964
push 0x50
call fcn.004d0210
jmp 0x4c4e4f
xor eax, eax
mov byte [ebp - 4], 0x10
mov dword [0x5c53d8], eax
mov ecx, esi
call fcn.004d0150
mov ecx, dword [0x5c53d8]
lea ecx, [ecx + 0xd0]
call fcn.004d0140
mov eax, dword [0x5c53d8]
mov esi, dword [ebp + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax + 0x48]
test esi, esi
jne 0x4c4e87
mov eax, dword [ebp - 0x18]
mov esi, dword [eax + 4]
call fcn.0044d220
mov ecx, eax
test ecx, ecx
je 0x4c521b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
push esi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x12
call fcn.00452e50
test al, al
jne 0x4c4ebb
push esi
lea ecx, [ebp + 8]
call fcn.00452330
mov byte [ebp - 4], 0x13
mov esi, dword [ebp + 8]
push esi
push 0x587a0c
push dword [0x5c53d8]
call ebx
add esp, 0xc
add esi, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 0x14
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4c4ef1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x10
mov ecx, dword [0x5c53d8]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x5c53d8]
lea ecx, [ecx + 0xd0]
call fcn.004d0150
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4c505f
mov dword [ebp + 8], eax
call fcn.004d03a0
mov esi, eax
mov ecx, esi
call fcn.004d0140
cmp byte [0x5c2273], 0
jne 0x4c4f80
mov ecx, 0xf0
call fcn.004d0a00
mov dword [ebp + 0x10], eax
mov byte [ebp - 4], 0x15
test eax, eax
je 0x4c4f75
movsd xmm0, qword [ebp - 0x38]
sub esp, 8
mov ecx, eax
movsd qword [esp], xmm0
push 0x5c2273
sub esp, 0xc
push 0x12d
push 0x587964
push 0x48
call fcn.004d0210
jmp 0x4c4f77
xor eax, eax
mov byte [ebp - 4], 0x10
mov dword [0x5c53e8], eax
mov ecx, esi
call fcn.004d0150
mov ecx, dword [0x5c53e8]
lea ecx, [ecx + 0xd0]
call fcn.004d0140
mov eax, dword [0x5c53e8]
mov eax, dword [eax]
mov ebx, dword [eax + 0x48]
mov eax, dword [ebp - 0x18]
mov esi, dword [eax + 4]
call fcn.0044d220
mov ecx, eax
test ecx, ecx
je 0x4c5225
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0x10], eax
push esi
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0x16
call fcn.00452e50
test al, al
jne 0x4c4fdc
push esi
lea ecx, [ebp + 0x10]
call fcn.00452330
mov byte [ebp - 4], 0x17
mov esi, dword [ebp + 0x10]
push esi
push 0x5879ec
push dword [0x5c53e8]
call ebx
add esp, 0xc
add esi, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 0x18
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4c5012
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x10
mov ecx, dword [0x5c53e8]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x5c53e8]
lea ecx, [ecx + 0xd0]
call fcn.004d0150
lea eax, [ebp + 8]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
neg eax
sbb esi, esi
neg esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4c5057
movzx eax, ax
or eax, 0x80070000
test esi, esi
je 0x4c522f
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x4c506c
push edi
call esi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4c5076
push eax
call esi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x19
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4c5092
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
push 0x80004005
call fcn.0044a700
push eax
lea ecx, [ebp - 0x20]
call fcn.0044a6e0
push 0x5b6dcc
mov eax, ecx
push eax
call fcn.004edba4
push 0x80070057
call fcn.0044a700
push 0x80004005
call fcn.0044a700
push eax
lea ecx, [ebp - 0x24]
call fcn.0044a6e0
push 0x5b6dcc
mov eax, ecx
push eax
call fcn.004edba4
push 0x80004005
call fcn.0044a700
push eax
lea ecx, [ebp - 0x28]
call fcn.0044a6e0
push 0x5b6dcc
mov eax, ecx
push eax
call fcn.004edba4
push 0x80004005
call fcn.0044a700
push 0x80004005
call fcn.0044a700
push eax
lea ecx, [ebp - 0x2c]
call fcn.0044a6e0
push 0x5b6dcc
mov eax, ecx
push eax
call fcn.004edba4
int3