Function at 0x4019a0
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x458610
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x47b008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0043f88f
cmp dword [eax], 3
jne 0x4022d7
call fcn.0043f895
mov eax, dword [eax]
mov edx, dword [eax + 4]
mov ecx, edx
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401a00
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.00402430
call fcn.0043f895
mov eax, dword [eax]
mov edx, dword [eax + 8]
mov ecx, edx
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401a40
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00402430
lea ecx, [ebp - 0x28]
call fcn.00404030
test al, al
je 0x402226
lea ecx, [ebp - 0xd0]
call fcn.00403520
lea ecx, [ebp - 0xb8]
call fcn.00403520
lea ecx, [ebp - 0xa0]
call fcn.00403520
push 6
xor eax, eax
mov dword [ebp - 0x108], 0
push 0x46b614
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x104], 7
mov word [ebp - 0x118], ax
call fcn.00402430
push 4
xor eax, eax
mov dword [ebp - 0xf0], 0
push 0x46b624
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.00402430
push 7
xor eax, eax
mov dword [ebp - 0xd8], 0
push str.2345Pic
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.00402430
lea ecx, [ebp - 0xe8]
call fcn.00402400
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x401b2c
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0xd0]
call fcn.00402430
lea ecx, [ebp - 0x100]
call fcn.00402400
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x401b50
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0xb8]
call fcn.00402430
lea ecx, [ebp - 0x118]
call fcn.00402400
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x401b74
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.00402430
mov dword [ebp - 4], 8
mov edx, dword [ebp - 0xd4]
cmp edx, 8
jb 0x401bca
mov ecx, dword [ebp - 0xe8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401bc0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4022f7
push edx
push ecx
call fcn.0043b959
add esp, 8
xor eax, eax
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
mov dword [ebp - 4], 0xc
mov edx, dword [ebp - 0xec]
cmp edx, 8
jb 0x401c2e
mov ecx, dword [ebp - 0x100]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401c24
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4022fc
push edx
push ecx
call fcn.0043b959
add esp, 8
xor eax, eax
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
mov dword [ebp - 4], 0x10
mov edx, dword [ebp - 0x104]
cmp edx, 8
jb 0x401c92
mov ecx, dword [ebp - 0x118]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401c88
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402301
push edx
push ecx
call fcn.0043b959
add esp, 8
xor eax, eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 7
mov word [ebp - 0x118], ax
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push str.install
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.0043f701
add esp, 8
test eax, eax
jne 0x401f55
sub esp, 8
call fcn.00402c10
add esp, 4
mov ecx, eax
call fcn.004031b0
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
call fcn.00402c10
push ecx
push esi
mov ecx, eax
call fcn.00402d10
mov bl, al
call fcn.00402c10
mov ecx, eax
call fcn.00403250
test bl, bl
je 0x4020f9
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xd0]
call fcn.00412830
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x4020f9
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
push 0
cmovae edx, dword [ebp - 0x28]
lea ecx, [ebp - 0xb8]
cmp dword [ebp - 0xa4], 8
lea eax, [ebp - 0xd0]
push 0
cmovae ecx, dword [ebp - 0xb8]
cmp dword [ebp - 0xbc], 8
push 0x46e63c
cmovae eax, dword [ebp - 0xd0]
push 0
push 0x46ebac
push edx
push 1
push 2
push 0x110
push 0xf01ff
push ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
jne 0x401dad
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4020f9
cmp dword [ebp - 0x8c], 8
lea eax, [ebp - 0xa0]
cmovae eax, dword [ebp - 0xa0]
mov dword [ebp - 0x194], eax
lea eax, [ebp - 0x194]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
lea ecx, [ebp - 0xd0]
call fcn.00412ca0
push str.2345Pic
lea ecx, [ebp - 0x88]
call fcn.004023b0
push str._012_2345pic_service
lea ecx, [ebp - 0x70]
call fcn.004023b0
push str.t.keansoft.cn
lea ecx, [ebp - 0x58]
call fcn.004023b0
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x190]
call fcn.00412ec0
mov dword [ebp - 4], 0x1c
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x401e73
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401e69
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402306
push edx
push ecx
call fcn.0043b959
add esp, 8
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov dword [ebp - 4], 0x20
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x401ec8
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401ebe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40230b
push edx
push ecx
call fcn.0043b959
add esp, 8
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
mov dword [ebp - 4], 0x24
mov edx, dword [ebp - 0x74]
cmp edx, 8
jb 0x401f20
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401f16
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402310
push edx
push ecx
call fcn.0043b959
add esp, 8
xor eax, eax
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
lea ecx, [ebp - 0x190]
mov dword [ebp - 4], 0xffffffff
call fcn.00413670
mov dword [ebp - 4], 0x28
jmp 0x4020e7
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push str.uninstall
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.0043f701
add esp, 8
test eax, eax
jne 0x4020f9
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xd0]
call fcn.00412830
push str.2345Pic
lea ecx, [ebp - 0x58]
call fcn.004023b0
push str._012_2345pic_service
lea ecx, [ebp - 0x70]
call fcn.004023b0
push str.t.keansoft.cn
lea ecx, [ebp - 0x88]
call fcn.004023b0
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x190]
call fcn.00412ec0
mov dword [ebp - 4], 0x29
mov edx, dword [ebp - 0x74]
cmp edx, 8
jb 0x40200d
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402003
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402315
push edx
push ecx
call fcn.0043b959
add esp, 8
xor eax, eax
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
mov dword [ebp - 4], 0x2d
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x402065
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40205b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40231a
push edx
push ecx
call fcn.0043b959
add esp, 8
xor eax, eax
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
mov dword [ebp - 4], 0x31
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x4020ba
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4020b0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40231f
push edx
push ecx
call fcn.0043b959
add esp, 8
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
lea ecx, [ebp - 0x190]
mov dword [ebp - 4], 0xffffffff
call fcn.00413a70
mov dword [ebp - 4], 0x35
lea ecx, [ebp - 0x190]
call fcn.004131e0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0x37
mov edx, dword [ebp - 0x8c]
cmp edx, 8
jb 0x402140
mov ecx, dword [ebp - 0xa0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402136
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402324
push edx
push ecx
call fcn.0043b959
add esp, 8
xor eax, eax
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 7
mov word [ebp - 0xa0], ax
mov byte [ebp - 4], 0x3b
mov edx, dword [ebp - 0xa4]
cmp edx, 8
jb 0x4021a1
mov ecx, dword [ebp - 0xb8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402197
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402329
push edx
push ecx
call fcn.0043b959
add esp, 8
xor eax, eax
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], ax
mov byte [ebp - 4], 0x3f
mov edx, dword [ebp - 0xbc]
cmp edx, 8
jb 0x402202
mov ecx, dword [ebp - 0xd0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4021f8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40232e
push edx
push ecx
call fcn.0043b959
add esp, 8
xor eax, eax
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 7
mov word [ebp - 0xd0], ax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0x43
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x402267
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40225d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402333
push edx
push ecx
call fcn.0043b959
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 0x47
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x4022bc
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4022b2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402338
push edx
push ecx
call fcn.0043b959
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043b918
mov esp, ebp
pop ebp
ret 0x10
call fcn.0043faa6
call fcn.0043faa6
call fcn.0043faa6
call fcn.0043faa6
call fcn.0043faa6
call fcn.0043faa6
call fcn.0043faa6
call fcn.0043faa6
call fcn.0043faa6
call fcn.0043faa6
call fcn.0043faa6
call fcn.0043faa6
call fcn.0043faa6
call fcn.0043faa6
int3