Function at 0x40c5a0
Capabilities:
Access peb ldr_data
Create service
Delete service
Start service
Stop service
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4319b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [0x441b8c]
push ebx
push esi
push edi
mov dword [esp + 0xc], eax
xor ebx, ebx
push 0xf003f
push ebx
push ebx
mov dword [esp + 0x44], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
mov dword [0x445a18], eax
jne 0x40c637
call esi
push eax
lea ecx, [esp + 0x10]
push 0x4419c4
push ecx
call fcn.0042438b
add esp, 0xc
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push 0x441988
push eax
call fcn.00428ba4
mov eax, dword [eax]
push ebx
push ebx
push eax
mov byte [esp + 0x44], 1
call fcn.0042c364
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], bl
call fcn.004289b9
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x445ac0
push 1
push 3
push 1
push 0xf01ff
push str.EnvoyInC
push str.EnvoyInC
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
cmp eax, ebx
mov dword [0x445a14], eax
jne 0x40c6da
call esi
cmp eax, 0x431
je 0x40c6da
cmp eax, 0x430
jne 0x40c684
push ebx
push ebx
push 0x44195c
call fcn.0042c364
jmp 0x40c6c7
push eax
lea ecx, [esp + 0x10]
push 0x4419c4
push ecx
call fcn.0042438b
add esp, 0xc
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push 0x441944
push eax
call fcn.00428ba4
mov eax, dword [eax]
push ebx
push ebx
push eax
mov byte [esp + 0x44], 2
call fcn.0042c364
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], bl
call fcn.004289b9
mov ecx, dword [0x445a18]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call fcn.00415d0d
mov edx, dword [0x445a18]
push 0xf01ff
push str.EnvoyInC
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp eax, ebx
mov dword [0x445a14], eax
jne 0x40c75c
call esi
push eax
lea eax, [esp + 0x10]
push 0x4419c4
push eax
call fcn.0042438b
add esp, 0xc
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push 0x44192c
push edx
call fcn.00428ba4
mov eax, dword [eax]
push ebx
push ebx
push eax
mov byte [esp + 0x44], 3
call fcn.0042c364
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], bl
call fcn.004289b9
mov eax, dword [0x445a14]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
mov ecx, dword [0x445a18]
push ecx
call esi
push ebx
call fcn.00415d0d
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x40c846
call esi
cmp eax, 0x420
je 0x40c846
cmp eax, 5
jne 0x40c790
push ebx
push ebx
push 0x44190c
call fcn.0042c364
jmp 0x40c81c
cmp eax, 0x5aa
jne 0x40c7a5
push ebx
push ebx
push 0x4418e4
call fcn.0042c364
jmp 0x40c81c
cmp eax, 0x4fb
jne 0x40c7d9
mov dword [0x445c48], 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.004289b9
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret
push eax
lea edx, [esp + 0x10]
push 0x4419c4
push edx
call fcn.0042438b
add esp, 0xc
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push 0x4418cc
push ecx
call fcn.00428ba4
mov eax, dword [eax]
push ebx
push ebx
push eax
mov byte [esp + 0x44], 4
call fcn.0042c364
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], bl
call fcn.004289b9
mov edx, dword [0x445a14]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov eax, dword [0x445a14]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
mov ecx, dword [0x445a18]
push ecx
call esi
push ebx
call fcn.00415d0d
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push str..EnvoyInCKB
call edi
cmp eax, 0xffffffff
mov dword [0x445a10], eax
jne 0x40c8ee
call esi
push eax
lea edx, [esp + 0x10]
push 0x4419c4
push edx
call fcn.0042438b
add esp, 0xc
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push 0x4418a0
push ecx
call fcn.00428ba4
mov eax, dword [eax]
push ebx
push ebx
push eax
mov byte [esp + 0x44], 5
call fcn.0042c364
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], bl
call fcn.004289b9
mov eax, dword [0x445a14]
lea edx, [esp + 0x14]
push edx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ecx, dword [0x445a14]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edx, dword [0x445a14]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edx
call esi
mov eax, dword [0x445a18]
push eax
call esi
push ebx
call fcn.00415d0d
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push str..EnvoyInCMU
call edi
cmp eax, 0xffffffff
mov dword [0x445a0c], eax
jne 0x40c7b6
call esi
push eax
lea ecx, [esp + 0x10]
push 0x4419c4
push ecx
call fcn.0042438b
add esp, 0xc
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push 0x441878
push eax
call fcn.00428ba4
mov eax, dword [eax]
push ebx
push ebx
push eax
mov byte [esp + 0x44], 6
call fcn.0042c364
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], bl
call fcn.004289b9
mov ecx, dword [0x445a10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x445a14]
lea edx, [esp + 0x14]
push edx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ecx, dword [0x445a14]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edx, dword [0x445a14]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edx
call esi
mov eax, dword [0x445a18]
push eax
call esi
push ebx
call fcn.00415d0d
nop
nop
nop