Function at 0x411ef0
Capabilities:
Create service
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436f50
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x25c
mov eax, dword [0x45906c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x214], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x218], 0x453698
cmp dword [ebp + 8], 0
je 0x411f87
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx]
test eax, eax
je 0x411f87
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x230], str.SOFTWARE__Microsoft__Windows_NT__CurrentVersion__Svchost
lea edx, [ebp - 0x214]
push edx
push 1
push 0
mov eax, dword [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x411ff5
mov edx, dword [ebp - 0x20c]
push edx
mov eax, dword [ebp - 0x230]
push eax
push str.RegOpenKeyEx__s__KEY_QUERY_VALUE_error__d.
call fcn.004126c0
add esp, 0xc
mov dword [ebp - 0x238], 0x44881d
push 0x457734
lea ecx, [ebp - 0x238]
push ecx
call fcn.0041734b
mov dword [ebp - 0x23c], 0x1f4
lea edx, [ebp - 0x23c]
push edx
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x26c]
push ecx
push 0
push str.netsvcs
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x20c], 0
je 0x41206c
mov dword [ebp - 0x240], str.RegQueryValueEx_Svchost__netsvcs_
push 0x457734
lea edx, [ebp - 0x240]
push edx
call fcn.0041734b
lea eax, [ebp - 0x208]
mov dword [ebp - 0x210], eax
jmp 0x412094
push 0
mov ecx, dword [ebp - 0x210]
push ecx
call fcn.00417220
add esp, 8
add eax, 1
mov dword [ebp - 0x210], eax
mov edx, dword [ebp - 0x210]
movsx eax, byte [edx]
test eax, eax
je 0x4120bf
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x210]
push edx
call fcn.0041fc68
add esp, 8
test eax, eax
jne 0x4120bd
jmp 0x4120bf
jmp 0x41207a
mov eax, dword [ebp - 0x210]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x41213f
push str.you_specify_service_name_not_in_Svchost__netsvcs__must_be_one_of_following:
call fcn.004126c0
add esp, 4
lea edx, [ebp - 0x208]
mov dword [ebp - 0x210], edx
jmp 0x412101
push 0
mov eax, dword [ebp - 0x210]
push eax
call fcn.00417220
add esp, 8
add eax, 1
mov dword [ebp - 0x210], eax
mov ecx, dword [ebp - 0x210]
movsx edx, byte [ecx]
test edx, edx
je 0x412124
mov eax, dword [ebp - 0x210]
push eax
push str.____s
call fcn.004126c0
add esp, 8
jmp 0x4120e7
mov dword [ebp - 0x244], 0x44881e
push 0x457734
lea ecx, [ebp - 0x244]
push ecx
call fcn.0041734b
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jne 0x412178
mov dword [ebp - 0x248], str.OpenSCManager__
push 0x457734
lea edx, [ebp - 0x248]
push edx
call fcn.0041734b
mov dword [ebp - 0x24c], str._SystemRoot___System32__svchost.exe__k_netsvcs
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x24c]
push eax
push 1
push 2
push 0x20
push 0xf01ff
push 0
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
jne 0x412205
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x218]
push ecx
push str.CreateService__s__error__d
call fcn.004126c0
add esp, 0xc
mov dword [ebp - 0x250], 0x44881f
push 0x457734
lea edx, [ebp - 0x250]
push edx
call fcn.0041734b
mov eax, dword [ebp - 0x218]
push eax
push str.CreateService__s__SUCCESS._Config_it
call fcn.004126c0
add esp, 8
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x214], reloc.OLEAUT32.dll_SysReAllocString
push 0x1f4
push str.SYSTEM__CurrentControlSet__Services__
lea eax, [ebp - 0x208]
push eax
call fcn.0041f400
add esp, 0xc
push 0x64
mov ecx, dword [ebp - 0x218]
push ecx
lea edx, [ebp - 0x208]
push edx
call fcn.00421ee0
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x4122d5
mov eax, dword [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x218]
push ecx
push str.RegOpenKeyEx__s__KEY_SET_VALUE_error__d.
call fcn.004126c0
add esp, 0xc
mov dword [ebp - 0x254], 0x44884b
push 0x457734
lea edx, [ebp - 0x254]
push edx
call fcn.0041734b
lea eax, [ebp - 0x22c]
push eax
push str.Parameters
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x20c], eax
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x20c], 0
je 0x412325
mov dword [ebp - 0x258], str.RegCreateKey_Parameters_
push 0x457734
lea eax, [ebp - 0x258]
push eax
call fcn.0041734b
push 0x1f4
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [0x439468]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41235d
mov dword [ebp - 0x25c], str.GetModuleFileName___get_dll_path
push 0x457734
lea eax, [ebp - 0x25c]
push eax
call fcn.0041734b
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x220], ecx
mov edx, dword [ebp - 0x220]
add edx, 1
mov dword [ebp - 0x260], edx
mov eax, dword [ebp - 0x220]
mov cl, byte [eax]
mov byte [ebp - 0x219], cl
add dword [ebp - 0x220], 1
cmp byte [ebp - 0x219], 0
jne 0x412378
mov edx, dword [ebp - 0x220]
sub edx, dword [ebp - 0x260]
mov dword [ebp - 0x264], edx
mov eax, dword [ebp - 0x264]
add eax, 1
push eax
lea ecx, [ebp - 0x208]
push ecx
push 2
push 0
push str.ServiceDll
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x20c], 0
je 0x412406
mov dword [ebp - 0x268], str.RegSetValueEx_ServiceDll_
push 0x457734
lea ecx, [ebp - 0x268]
push ecx
call fcn.0041734b
mov edx, dword [ebp - 0x218]
push edx
push str.Config_service__s_ok.
call fcn.004126c0
add esp, 8
jmp 0x412468
mov dword [ebp - 4], 0xffffffff
jmp 0x412478
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004151bc
mov esp, ebp
pop ebp
ret