Function at 0x418bb0
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e0
mov eax, dword [0x45a074]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0
jne 0x418c6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x394], eax
mov dword [ebp - 0x38c], 0x4547c8
push 0x5c
mov eax, dword [ebp - 0x38c]
push eax
call fcn.00423700
add esp, 8
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 0
je 0x418c2c
mov ecx, dword [ebp - 0x388]
add ecx, 1
mov dword [ebp - 0x390], ecx
jmp 0x418c38
mov edx, dword [ebp - 0x38c]
mov dword [ebp - 0x390], edx
mov eax, dword [ebp - 0x394]
push eax
push str.Couldnt_open_service_manager_error:_d
push 0x130
mov ecx, dword [ebp - 0x390]
push ecx
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x14
xor edx, edx
jne 0x418bf1
mov eax, dword [ebp - 0x394]
jmp 0x4190f2
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.00423e70
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x208
push 0
lea edx, [ebp - 0x310]
push edx
call fcn.00423e70
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push str.__s_
push 0x208
lea ecx, [ebp - 0x310]
push ecx
call fcn.00417b40
add esp, 0x10
push 0
push 0
push 0x44fbb2
push 0
push 0
lea edx, [ebp - 0x310]
push edx
push 1
push 2
push 0x10
push 0xf01ff
push str.byod_monitor
push str.byod_monitor
mov eax, dword [ebp - 0x384]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0
jne 0x418da5
mov ecx, dword [ebp - 0x384]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0x39c], 0x454858
push 0x5c
mov edx, dword [ebp - 0x39c]
push edx
call fcn.00423700
add esp, 8
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 0
je 0x418d67
mov eax, dword [ebp - 0x398]
add eax, 1
mov dword [ebp - 0x3a0], eax
jmp 0x418d73
mov ecx, dword [ebp - 0x39c]
mov dword [ebp - 0x3a0], ecx
mov edx, dword [ebp - 0x3a4]
push edx
push str.Couldnt_open_service_error:_d
push 0x141
mov eax, dword [ebp - 0x3a0]
push eax
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x14
xor ecx, ecx
jne 0x418d2c
mov eax, dword [ebp - 0x3a4]
jmp 0x4190f2
mov dword [ebp - 0x37c], 0
mov dword [ebp - 0x37c], 0
jmp 0x418dca
mov edx, dword [ebp - 0x37c]
add edx, 1
mov dword [ebp - 0x37c], edx
cmp dword [ebp - 0x37c], 0xa
jge 0x418df7
mov eax, dword [ebp - 0x37c]
mov dword [ebp + eax*8 - 0x360], 1
mov ecx, dword [ebp - 0x37c]
mov dword [ebp + ecx*8 - 0x35c], 0x7d0
jmp 0x418dbb
mov edx, 8
imul eax, edx, 9
mov dword [ebp + eax - 0x360], 0
mov dword [ebp - 0x378], 0
mov dword [ebp - 0x370], 0
mov dword [ebp - 0x374], 0
mov dword [ebp - 0x36c], 0xa
lea ecx, [ebp - 0x360]
mov dword [ebp - 0x368], ecx
lea edx, [ebp - 0x378]
push edx
push 2
mov eax, dword [ebp - 0x380]
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
test eax, eax
jne 0x418ec6
mov dword [ebp - 0x3ac], 0x4548d8
push 0x5c
mov ecx, dword [ebp - 0x3ac]
push ecx
call fcn.00423700
add esp, 8
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0
je 0x418e93
mov edx, dword [ebp - 0x3a8]
add edx, 1
mov dword [ebp - 0x3b0], edx
jmp 0x418e9f
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x3b0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x454734
push 0x158
mov ecx, dword [ebp - 0x3b0]
push ecx
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x14
xor edx, edx
jne 0x418e58
mov dword [ebp - 0x3b8], 0x454938
push 0x5c
mov eax, dword [ebp - 0x3b8]
push eax
call fcn.00423700
add esp, 8
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 0
je 0x418f01
mov ecx, dword [ebp - 0x3b4]
add ecx, 1
mov dword [ebp - 0x3bc], ecx
jmp 0x418f0d
mov edx, dword [ebp - 0x3b8]
mov dword [ebp - 0x3bc], edx
push str.ChangeServiceConfig2_RESTART_success
push 0x15a
mov eax, dword [ebp - 0x3bc]
push eax
push 2
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x10
xor ecx, ecx
jne 0x418ec6
xor edx, edx
mov dword [ebp - 0x364], edx
mov dword [ebp - 0x364], str.Sangfor_BYOD_Monitor_Service
lea eax, [ebp - 0x364]
push eax
push 1
mov ecx, dword [ebp - 0x380]
push ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
test eax, eax
jne 0x418fc7
mov dword [ebp - 0x3c4], 0x4549e0
push 0x5c
mov edx, dword [ebp - 0x3c4]
push edx
call fcn.00423700
add esp, 8
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0
je 0x418f94
mov eax, dword [ebp - 0x3c0]
add eax, 1
mov dword [ebp - 0x3c8], eax
jmp 0x418fa0
mov ecx, dword [ebp - 0x3c4]
mov dword [ebp - 0x3c8], ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ChangeServiceConfig2_fail_error:_d
push 0x161
mov edx, dword [ebp - 0x3c8]
push edx
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x14
xor eax, eax
jne 0x418f59
mov dword [ebp - 0x3d0], 0x454a90
push 0x5c
mov ecx, dword [ebp - 0x3d0]
push ecx
call fcn.00423700
add esp, 8
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0
je 0x419002
mov edx, dword [ebp - 0x3cc]
add edx, 1
mov dword [ebp - 0x3d4], edx
jmp 0x41900e
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x3d4], eax
push str.ChangeServiceConfig2_Description_success
push 0x163
mov ecx, dword [ebp - 0x3d4]
push ecx
push 2
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x10
xor edx, edx
jne 0x418fc7
push 0
push 0
mov eax, dword [ebp - 0x380]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x4190d3
mov ecx, dword [ebp - 0x380]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 0x384]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x3dc], 0x454af0
push 0x5c
mov eax, dword [ebp - 0x3dc]
push eax
call fcn.00423700
add esp, 8
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 0
je 0x41909c
mov ecx, dword [ebp - 0x3d8]
add ecx, 1
mov dword [ebp - 0x3e0], ecx
jmp 0x4190a8
mov edx, dword [ebp - 0x3dc]
mov dword [ebp - 0x3e0], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_start_service_error:_d
push 0x168
mov eax, dword [ebp - 0x3e0]
push eax
push 1
call dword [sym.imp.libnac_base.dll_error_output]
add esp, 0x14
xor ecx, ecx
jne 0x419061
xor eax, eax
jmp 0x4190f2
mov edx, dword [ebp - 0x380]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x384]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421c00
mov esp, ebp
pop ebp
ret