Function at 0x40c7e0
Capabilities:
Create service
Delete service
Modify service
Persist via windows service
Query or enumerate registry value
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x115
call fcn.00413e95
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
je 0x40c7e6
push ebx
push esi
push edi
push 0xd2
call fcn.00404a40
mov eax, dword [0x42c160]
mov edi, dword [eax + 0x348]
push 0xd1
call fcn.00404a40
mov ecx, dword [0x42c160]
mov eax, dword [ecx + 0x344]
mov esi, dword [ebp - 8]
add esp, 8
lea edx, [ebp - 0xc]
push edx
push 0x20019
push 0
push eax
xor bl, bl
push connect
mov byte [esi], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40c87c
lea ecx, [ebp - 0x10]
push ecx
push esi
push 0
push 0
push edi
push eax
mov dword [ebp - 0x10], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40c86e
mov bl, 1
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x40c8a2
push 0xcf
call fcn.00404a40
mov eax, dword [0x42c160]
mov eax, dword [eax + 0x33c]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40c898
push 0x115
call fcn.00413e95
mov edi, eax
add esp, 4
test edi, edi
je 0x40c8a2
push 0xd3
call fcn.00404a40
mov ecx, dword [0x42c160]
mov ebx, dword [ecx + 0x34c]
push 0xd1
call fcn.00404a40
mov edx, dword [0x42c160]
mov eax, dword [edx + 0x344]
add esp, 8
lea ecx, [ebp - 0xc]
push ecx
push 0x20019
push 0
push eax
push connect
mov byte [ebp - 1], 0
mov byte [edi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40c938
lea edx, [ebp - 0x10]
push edx
push edi
push 0
push 0
push ebx
push eax
mov dword [ebp - 0x10], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov bl, 1
test eax, eax
je 0x40c92a
mov bl, byte [ebp - 1]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x40c95f
push 0xd0
call fcn.00404a40
mov ecx, dword [0x42c160]
mov eax, dword [ecx + 0x340]
mov edx, edi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40c955
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x40c9cc
mov edx, dword [ebp + 8]
push 0x10020
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x40c995
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
push 0
push 0
push 0
push 0
call fcn.00409dc0
mov ecx, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push 1
push 2
push 0x10
push 0xf01ff
push eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
jne 0x40c9d5
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x14]
push edx
push 1
push esi
mov dword [ebp - 0x14], edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov eax, dword [ebp - 8]
push eax
call fcn.00413e5b
push edi
call fcn.00413e5b
add esp, 8
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret