Function at 0x403bb0
Capabilities:
Create service
Modify service
Persist via windows service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4220f8
push 0x4102b0
mov eax, dword fs:[0]
push eax
sub esp, 0x458
mov eax, dword [0x42465c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x458], esi
mov dword [ebp - 0x460], esi
xor edi, edi
mov dword [ebp - 0x45c], edi
mov dword [ebp - 4], esi
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x460], ebx
cmp ebx, esi
jne 0x403c38
push str.ooservice:Fail_to_open_sc_mgr
call fcn.00402b30
mov esi, eax
call fcn.00407660
mov dword [ebp - 0x458], 0xa
jmp 0x403e3b
xor eax, eax
mov word [ebp - 0x438], ax
push 0x208
push esi
lea ecx, [ebp - 0x436]
push ecx
call fcn.0040b2c0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x438]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x438]
push eax
push esi
push 2
push 0x10
push 0xf01ff
push 0x420230
push 0x420230
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
mov dword [ebp - 0x45c], edi
cmp edi, esi
jne 0x403d03
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x403cc9
push str.ooservice:Fail_to_create_service
call fcn.00402b30
mov esi, eax
call fcn.00407660
mov dword [ebp - 0x458], 0xb
jmp 0x403e3b
push 0x10
push 0x420230
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
mov dword [ebp - 0x45c], edi
cmp edi, esi
jne 0x403d03
push str.ooservice:Fail_to_open_service
call fcn.00402b30
mov esi, eax
call fcn.00407660
mov dword [ebp - 0x458], 0xc
jmp 0x403e3b
mov ecx, dword [0x420304]
mov dword [ebp - 0x228], ecx
mov edx, dword [0x420308]
mov dword [ebp - 0x224], edx
mov eax, dword [0x42030c]
mov dword [ebp - 0x220], eax
mov ecx, dword [0x420310]
mov dword [ebp - 0x21c], ecx
mov edx, dword [0x420314]
mov dword [ebp - 0x218], edx
mov eax, dword [0x420318]
mov dword [ebp - 0x214], eax
push 0x1f0
push esi
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040b2c0
add esp, 0xc
lea edx, [ebp - 0x228]
mov dword [ebp - 0x464], edx
lea eax, [ebp - 0x464]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x403d9e
push str.ooservice:Fail_to_add_description_to_ooservice
call fcn.00402b30
mov esi, eax
call fcn.00407660
mov dword [ebp - 0x458], 0xd
jmp 0x403e3b
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x403dd5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x403dd5
push str.ooservice:Service_already_running
call fcn.00402b30
mov esi, eax
call fcn.00407660
mov dword [ebp - 0x458], 0xe
jmp 0x403e3b
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x403de0
lea ecx, [ebp - 0x454]
push ecx
push edi
call esi
test eax, eax
je 0x403e04
cmp dword [ebp - 0x450], 2
jne 0x403e04
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403de0
cmp dword [ebp - 0x450], 4
je 0x403e2a
push str.ooservice:Fail_to_start_service
call fcn.00402b30
mov esi, eax
call fcn.00407660
mov dword [ebp - 0x458], 0xf
jmp 0x403e3b
push str.ooservice:Succeed_to_create_ooservice
call fcn.00402b30
mov esi, eax
call fcn.00407660
add esp, 4
mov dword [ebp - 4], 0xfffffffe
call fcn.00403e78
mov eax, dword [ebp - 0x458]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004088c3
mov esp, ebp
pop ebp
ret