Function at 0x402f10
Capabilities:
Copy file
Create service
Delete service
Get common file path
Persist via windows service
Start service
Stop service

Disassembly:
sub esp, 0x34
mov eax, dword [0x40e084]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push ebx
push eax
push str.Attempting_to_load___s__n
push 4
mov dword [esp + 0x10], eax
call section..text
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x402f6d
push str.Failed_to_open_Service_Manager
push 1
call section..text
add esp, 8
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00404231
add esp, 0x34
ret
push ebp
push esi
push edi
push str.SCManager_Handle_Opened._n
push 4
call section..text
push str.Attempting_to_stop_pnkbstrb._n
push 4
call section..text
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenServiceA]
add esp, 0x10
push 0xf01ff
push str.pnkbstrb
push ebx
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
je 0x40301e
lea eax, [esp + 0x14]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov eax, dword [esp + 0x2c]
cmp eax, 0x1388
jle 0x402fc8
mov eax, 0x1388
add eax, 0x7d0
push eax
call edi
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x2ee
call edi
push 0xf01ff
push str.pnkbstrb
push ebx
call ebp
mov esi, eax
test esi, esi
je 0x40300f
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x2ee
call edi
jmp 0x40301e
push str.pnkbstrb_OpenService_failed__a__n
push 4
call section..text
add esp, 8
push 0xf01ff
push str.pnkbstrb
push ebx
call ebp
mov esi, eax
test esi, esi
je 0x4030bb
push str.Retrying_pnkbstrb_service_deletion._Sleeping_..._n
push 4
call section..text
add esp, 8
push 0x2ee
call edi
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push 0x2ee
call edi
push str.Checking_pnkbstrb_service_again_n
push 4
call section..text
add esp, 8
push 0xf01ff
push str.pnkbstrb
push ebx
call ebp
test eax, eax
je 0x4030ac
push eax
call esi
push ebx
call esi
push str.Failed_to_delete_existing_PnkBstrB_service
push 1
call section..text
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00404231
add esp, 0x34
ret
push str.pnkbstrb_OpenService_failed__b__n
push 4
call section..text
add esp, 8
mov ebp, dword [esp + 0x10]
push ebp
push str.Verifying_signature_for___s_._n
push 4
call section..text
push ebp
lea esi, [esp + 0x24]
call fcn.00402e20
push ebp
call fcn.00401b00
add esp, 0x14
test eax, eax
jne 0x40310f
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
push str._s_does_not_contain_a_valid_certificate__Load_denied.
push 1
call section..text
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00404231
add esp, 0x34
ret
push 0xf6
push 0x410b68
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, byte [0x410b68]
test al, al
je 0x403159
mov eax, 0x410b68
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403130
sub eax, edx
cmp byte [eax + 0x410b67], 0x5c
je 0x403159
push 0x40b2b8
push 0x104
push 0x410b68
call fcn.004012c0
add esp, 0xc
push str.PnkBstrB.exe
push 0x104
push 0x410b68
call fcn.004012c0
push 0x410b68
push ebp
push str.Copying___s__to___s_._n
push 4
call section..text
push 0x180
push 0x410b68
call fcn.0040ac16
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 0x24
push 0
push 0x410b68
push ebp
call esi
test eax, eax
jne 0x4031ff
push 0x2ee
call edi
push 0x410b68
call fcn.00403cf6
add esp, 4
push 0
push 0x410b68
push ebp
call esi
test eax, eax
jne 0x4031ff
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x410b68
push ebp
push str.Copy_from___s__to___s__failed__Load_denied.___lu_
push 1
call section..text
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00404231
add esp, 0x34
ret
push 0x410b68
push str.Verifying_MD5_match_for___s_._n
push 4
call section..text
push 0x410b68
lea esi, [esp + 0x40]
call fcn.00402e20
add esp, 0x10
mov edi, esi
mov ecx, 4
lea esi, [esp + 0x14]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x403263
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
push 0x410b68
push str._s_does_not_match__s__Load_denied.
push 1
call section..text
add esp, 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00404231
add esp, 0x34
ret
push str.Loading_pnkbstrb._n
push 4
call section..text
add esp, 8
push 0
push 0
push 0
push 0
push 0
push 0x410b68
push 1
push 2
push 0x10
push 0xf01ff
push str.PnkBstrB
push str.PnkBstrB
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
jne 0x40330b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x431
jne 0x4032dd
push str.Prior_PnkBstrB_Service_failed_to_unload
push 1
call section..text
add esp, 8
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00404231
add esp, 0x34
ret
call esi
push eax
push str.Failed_to_load_PnkBstrB__error:_lu_
push 1
call section..text
add esp, 0xc
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00404231
add esp, 0x34
ret
push str.Starting_pnkbstrb._n
push 4
call section..text
add esp, 8
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x40333f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.PnkBstrB_Service_failed_to_start__error:_lu_
push 1
call section..text
add esp, 0xc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00404231
add esp, 0x34
ret