Function at 0x40b3f0
Capabilities:
Create service
Delete service
Modify service
Persist via windows service
Query or enumerate registry value
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x115
call fcn.00412765
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
je 0x40b3f6
push ebx
push esi
push edi
push 0xcd
call fcn.00403fe0
mov eax, dword [0x42a118]
mov edi, dword [eax + 0x334]
push 0xcc
call fcn.00403fe0
mov ecx, dword [0x42a118]
mov eax, dword [ecx + 0x330]
mov esi, dword [ebp - 8]
add esp, 8
lea edx, [ebp - 0xc]
push edx
push 0x20019
push 0
push eax
xor bl, bl
push connect
mov byte [esi], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40b48c
lea ecx, [ebp - 0x10]
push ecx
push esi
push 0
push 0
push edi
push eax
mov dword [ebp - 0x10], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b47e
mov bl, 1
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x40b4b2
push 0xca
call fcn.00403fe0
mov eax, dword [0x42a118]
mov eax, dword [eax + 0x328]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40b4a8
push 0x115
call fcn.00412765
mov edi, eax
add esp, 4
test edi, edi
je 0x40b4b2
push 0xce
call fcn.00403fe0
mov ecx, dword [0x42a118]
mov ebx, dword [ecx + 0x338]
push 0xcc
call fcn.00403fe0
mov edx, dword [0x42a118]
mov eax, dword [edx + 0x330]
add esp, 8
lea ecx, [ebp - 0xc]
push ecx
push 0x20019
push 0
push eax
push connect
mov byte [ebp - 1], 0
mov byte [edi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40b548
lea edx, [ebp - 0x10]
push edx
push edi
push 0
push 0
push ebx
push eax
mov dword [ebp - 0x10], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov bl, 1
test eax, eax
je 0x40b53a
mov bl, byte [ebp - 1]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x40b56f
push 0xcb
call fcn.00403fe0
mov ecx, dword [0x42a118]
mov eax, dword [ecx + 0x32c]
mov edx, edi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40b565
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x40b5dc
mov edx, dword [ebp + 8]
push 0x10020
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x40b5a5
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
push 0
push 0
push 0
push 0
call fcn.00409190
mov ecx, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push 1
push 2
push 0x10
push 0xf01ff
push eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
jne 0x40b5e5
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x14]
push edx
push 1
push esi
mov dword [ebp - 0x14], edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov eax, dword [ebp - 8]
push eax
call fcn.0041272b
push edi
call fcn.0041272b
add esp, 8
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret