Function at 0x481dc0
Capabilities:
Create service
Manipulate safe mode programs
Modify service
Print debug messages
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12a0
call fcn.0055b970
mov eax, dword [0x6385e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x419], 0
mov eax, 0x22
mov word [ebp - 0x418], ax
push 0x104
lea ecx, [ebp - 0x416]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x481e43
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CrusaderService:_GetModuleFileName___failed___d__r_n
push 0x104
lea edx, [ebp - 0x628]
push edx
call fcn.0054e0f2
add esp, 0x10
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x628]
push ecx
call fcn.0054eca8
add esp, 4
jmp 0x4821ec
push str.___crusader
push 0x208
lea edx, [ebp - 0x418]
push edx
call fcn.0054eb7c
add esp, 0xc
movzx eax, byte [ebp + 8]
test eax, eax
je 0x481e7d
push str.:boot
push 0x208
lea ecx, [ebp - 0x418]
push ecx
call fcn.0054eb7c
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 0
jne 0x481edc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CrusaderService:_OpenSCManager___failed___d__r_n
push 0x104
lea edx, [ebp - 0x838]
push edx
call fcn.0054e0f2
add esp, 0x10
lea eax, [ebp - 0x838]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x838]
push ecx
call fcn.0054eca8
add esp, 4
jmp 0x4821ec
mov dword [ebp - 0x83c], 0
jmp 0x481ef7
mov edx, dword [ebp - 0x83c]
add edx, 1
mov dword [ebp - 0x83c], edx
cmp dword [ebp - 0x83c], 2
jge 0x481fe1
cmp dword [ebp - 0x83c], 0
jle 0x481f18
push 0x9c4
call dword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, byte [ebp + 8]
test eax, eax
je 0x481f2c
mov dword [ebp - 0x129c], str.HitmanPro35CrusaderBoot
jmp 0x481f36
mov dword [ebp - 0x129c], str.HitmanPro35Crusader
mov ecx, dword [ebp - 0x129c]
mov dword [ebp - 0x840], ecx
movzx edx, byte [ebp + 8]
test edx, edx
je 0x481f56
mov dword [ebp - 0x12a0], str.Hitman_Pro_3.5_Crusader__Boot_
jmp 0x481f60
mov dword [ebp - 0x12a0], str.Hitman_Pro_3.5_Crusader
mov eax, dword [ebp - 0x12a0]
mov dword [ebp - 0x844], eax
push 0
push 0
push 0
push 0
movzx ecx, byte [ebp + 8]
neg ecx
sbb ecx, ecx
and ecx, str.PNP_TDI
push ecx
lea edx, [ebp - 0x418]
push edx
push 1
movzx eax, byte [ebp + 8]
neg eax
sbb eax, eax
add eax, 3
push eax
push 0x10
push 0xf01ff
mov ecx, dword [ebp - 0x844]
push ecx
mov edx, dword [ebp - 0x840]
push edx
mov eax, dword [ebp - 0x62c]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 0
je 0x481fcd
jmp 0x481fe1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
je 0x481fdc
jmp 0x481fe1
jmp 0x481ee8
cmp dword [ebp - 0x630], 0
jne 0x48207a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x482039
push str.CrusaderService:_Service_already_exists_r_n
push 0x104
lea ecx, [ebp - 0xa50]
push ecx
call fcn.0054e0f2
add esp, 0xc
lea edx, [ebp - 0xa50]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0xa50]
push eax
call fcn.0054eca8
add esp, 4
mov byte [ebp - 0x419], 1
jmp 0x482075
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CrusaderService:_CreateService___failed___d__r_n
push 0x104
lea ecx, [ebp - 0xc58]
push ecx
call fcn.0054e0f2
add esp, 0x10
lea edx, [ebp - 0xc58]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0xc58]
push eax
call fcn.0054eca8
add esp, 4
jmp 0x4821df
push str.SYSTEMCurrentControlSetControlSafeBootNetworkHitmanPro35Crusader
call fcn.00414b30
mov ecx, eax
call fcn.00413d60
movzx ecx, byte [ebp + 8]
test ecx, ecx
je 0x4820d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CrusaderService:_Installed_for_start_during_boot_r_n
push 0x104
lea edx, [ebp - 0xe60]
push edx
call fcn.0054e0f2
add esp, 0x10
lea eax, [ebp - 0xe60]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0xe60]
push ecx
call fcn.0054eca8
add esp, 4
jmp 0x4821d2
mov dword [ebp - 0xe64], str.Provides_malicious_software_removal_services_for_Hitman_Pro.
lea edx, [ebp - 0xe64]
push edx
push 1
mov eax, dword [ebp - 0x630]
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push 0
push 0
mov ecx, dword [ebp - 0x630]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x48214a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CrusaderService:_StartService___failed___d__r_n
push 0x104
lea edx, [ebp - 0x1070]
push edx
call fcn.0054e0f2
add esp, 0x10
lea eax, [ebp - 0x1070]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x1070]
push ecx
call fcn.0054eca8
add esp, 4
jmp 0x4821d2
mov dword [ebp - 0x1090], 0x32
lea edx, [ebp - 0x108c]
push edx
mov eax, dword [ebp - 0x630]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4821d2
cmp dword [ebp - 0x1088], 4
jne 0x4821b5
push str.CrusaderService:_Started_r_n
push 0x104
lea ecx, [ebp - 0x1298]
push ecx
call fcn.0054e0f2
add esp, 0xc
lea edx, [ebp - 0x1298]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0x1298]
push eax
call fcn.0054eca8
add esp, 4
mov byte [ebp - 0x419], 1
jmp 0x4821d2
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x1090]
sub ecx, 1
mov dword [ebp - 0x1090], ecx
jne 0x4821d0
jmp 0x4821d2
jmp 0x482154
mov edx, dword [ebp - 0x630]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x62c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [ebp - 0x419]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054d4f5
mov esp, ebp
pop ebp
ret