Function at 0x401b00
Capabilities:
Create service
Modify service
Persist via windows service
Query environment variable
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
mov esi, ecx
push 0
push eax
call fcn.0040bf00
push 0x400
lea eax, [ebp - 0x704]
push 0
push eax
call fcn.0040bf00
push pe_nt_image_headers32
lea eax, [ebp - 0x304]
push 0
push eax
call fcn.0040bf00
push pe_nt_image_headers32
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.0040bf00
push 0x400
lea eax, [ebp - 0xb04]
push 0
push eax
call fcn.0040bf00
add esp, 0x3c
test esi, esi
je 0x401f3d
cmp dword [esi + 4], 4
jne 0x401f3d
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x401f3d
push 7
mov edx, str.service
call fcn.00408b60
add esp, 4
test eax, eax
je 0x401f3d
cmp dword [eax + 4], 5
jne 0x401f3d
mov ecx, dword [eax + 8]
mov dword [ebp - 0xb10], ecx
test ecx, ecx
je 0x401f3d
mov eax, dword [ecx + 8]
mov dword [ebp - 0xb0c], eax
mov dword [ebp - 0xb14], 0
test eax, eax
je 0x401f3d
push ebx
xor esi, esi
push edi
cmp esi, dword [ecx + 8]
jae 0x401f2c
mov eax, dword [ecx + 4]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x401f26
cmp dword [eax + 4], 4
jne 0x401f26
mov ebx, dword [eax + 8]
test ebx, ebx
je 0x401f26
push 4
mov edx, 0x42dd68
mov ecx, ebx
call fcn.00408b60
add esp, 4
test eax, eax
je 0x401f20
xor edx, edx
lea ecx, [eax + 8]
cmp dword [eax + 4], 2
cmovne ecx, edx
test ecx, ecx
je 0x401f20
mov eax, dword [ecx]
test eax, eax
je 0x401f20
push eax
mov edx, 0x80
lea ecx, [ebp - 0x104]
call fcn.004085d0
xor eax, eax
add esp, 4
mov word [ebp - 6], ax
cmp ax, word [ebp - 0x104]
je 0x401f20
push 7
mov edx, str.binpath
mov ecx, ebx
call fcn.00408b60
add esp, 4
test eax, eax
je 0x401f17
xor edx, edx
lea ecx, [eax + 8]
cmp dword [eax + 4], 2
cmovne ecx, edx
test ecx, ecx
je 0x401f17
mov eax, dword [ecx]
test eax, eax
je 0x401f17
push eax
mov edx, 0x200
lea ecx, [ebp - 0x704]
call fcn.004085d0
xor eax, eax
add esp, 4
mov word [ebp - 0x306], ax
cmp ax, word [ebp - 0x704]
je 0x401f20
push 0x200
lea eax, [ebp - 0xb04]
push eax
lea eax, [ebp - 0x704]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
lea ecx, [ebp - 0x704]
mov word [ebp - 0x706], ax
mov edx, 0x200
lea eax, [ebp - 0xb04]
push eax
call fcn.004075c0
push 5
mov edx, str.start
mov ecx, ebx
call fcn.00408b60
push 8
mov edx, str.descript
mov ecx, ebx
call fcn.00408b60
add esp, 0xc
test eax, eax
je 0x401d62
xor edx, edx
lea ecx, [eax + 8]
cmp dword [eax + 4], 2
cmovne ecx, edx
test ecx, ecx
je 0x401d62
mov eax, dword [ecx]
test eax, eax
je 0x401d62
push eax
mov edx, 0x80
lea ecx, [ebp - 0x304]
call fcn.004085d0
add esp, 4
xor eax, eax
mov word [ebp - 0x206], ax
jmp 0x401d6b
xor eax, eax
mov word [ebp - 0x304], ax
push 7
mov edx, str.display
mov ecx, ebx
call fcn.00408b60
add esp, 4
test eax, eax
je 0x401db5
xor edx, edx
lea ecx, [eax + 8]
cmp dword [eax + 4], 2
cmovne ecx, edx
test ecx, ecx
je 0x401db5
mov eax, dword [ecx]
test eax, eax
je 0x401db5
push eax
mov edx, 0x80
lea ecx, [ebp - 0x204]
call fcn.004085d0
add esp, 4
xor eax, eax
mov word [ebp - 0x106], ax
jmp 0x401dbe
xor eax, eax
mov word [ebp - 0x204], ax
push 8
mov edx, str.isdriver
mov ecx, ebx
call fcn.00408b60
add esp, 4
test eax, eax
je 0x401dde
cmp dword [eax + 4], 6
jne 0x401dde
mov edi, dword [eax + 8]
jmp 0x401de0
xor edi, edi
push 0xf003f
push 0
push 0
mov dword [ebp - 0xb08], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x401e87
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x704]
mov ecx, 0x20
push eax
mov eax, edi
neg eax
push 1
sbb eax, eax
add eax, 2
test edi, edi
push eax
mov eax, 1
cmove eax, ecx
push eax
push 0xf01ff
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x104]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
test edi, edi
jne 0x401e5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x401e87
lea eax, [ebp - 0x304]
mov dword [ebp - 0xb08], eax
lea eax, [ebp - 0xb08]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
push 7
mov edx, str.started
mov ecx, ebx
call fcn.00408b60
add esp, 4
test eax, eax
je 0x401ef1
cmp dword [eax + 4], 6
jne 0x401ef1
cmp dword [eax + 8], 0
je 0x401ef1
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x401ef1
push 0xf01ff
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x401f06
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
test eax, eax
je 0x401ef9
call ebx
push edi
call ebx
mov esi, dword [ebp - 0xb14]
jmp 0x401f20
call ebx
push edi
call ebx
mov esi, dword [ebp - 0xb14]
jmp 0x401f20
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call ebx
mov esi, dword [ebp - 0xb14]
jmp 0x401f20
xor eax, eax
mov word [ebp - 0x704], ax
mov ecx, dword [ebp - 0xb10]
mov eax, dword [ebp - 0xb0c]
inc esi
mov dword [ebp - 0xb14], esi
cmp esi, eax
jb 0x401be6
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040a851
mov esp, ebp
pop ebp
ret