Function at 0x66e0ff40
Capabilities:
Create service
Persist via windows service

Disassembly:
push 0xffffffffffffffff
push 0x66f77c40
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x66fe31a0]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x90], 0
jne 0x66e0ff95
push 0
push 0x389ffff
mov ecx, 0x66feb0e0
call fcn.66e09730
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x48
ret
lea ecx, [esp + 0x38]
call fcn.66e13490
lea eax, [esp + 0x38]
mov dword [esp + 0x54], 0
push eax
mov ecx, ebx
call fcn.66e11140
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x44]
call eax
test al, al
jne 0x66e1022a
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push eax
lea ecx, [esp + 0x20]
call fcn.66e12890
cmp dword [esp + 0x20], 0
mov byte [esp + 0x54], 1
jne 0x66e10035
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x66feb0e0
push 0
cmp eax, 5
je 0x66e10016
push 0x39fffff
call fcn.66e09730
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 0
mov bl, al
call fcn.66e128b0
jmp 0x66e10196
push 0x39d03ef
call fcn.66e09730
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 0
mov bl, al
call fcn.66e128b0
jmp 0x66e10196
push 0
lea ecx, [esp + 0x18]
call fcn.66e12890
lea ecx, [ebx + 0x94]
mov byte [esp + 0x54], 2
call fcn.66e13a90
test eax, eax
jne 0x66e1005b
mov eax, 0x66f8af39
jmp 0x66e10066
lea ecx, [ebx + 0x94]
call fcn.66e13a40
mov esi, dword [ebx + 0x8c]
mov edi, dword [esp + 0x20]
push 0
push 0
push dword [ebx + 0xa8]
mov cl, byte [esi + 0x2d]
push 0
push eax
lea ecx, [esp + 0x4c]
call fcn.66e13a40
push eax
push 1
push 2
push dword [ebx + 0x90]
lea ecx, [esi + 4]
push 0xf01ff
call fcn.66e13a40
push eax
lea ecx, [esi + 4]
call fcn.66e13a40
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
push eax
lea ecx, [esp + 0x18]
call fcn.66e128d0
cmp dword [esp + 0x18], 0
jne 0x66e100ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
ja 0x66e101eb
je 0x66e101c5
cmp eax, 5
je 0x66e101bc
cmp eax, 0x34
jne 0x66e101f6
mov ecx, dword [ebx + 0x8c]
add ecx, 0x18
call fcn.66e13a90
test eax, eax
je 0x66e10171
push str.AdvAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x66e10171
push str.ChangeServiceConfig2A
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x66e1016a
mov ecx, dword [ebx + 0x8c]
add ecx, 0x18
push ecx
lea ecx, [esp + 0x28]
call fcn.66e13340
lea ecx, [esp + 0x24]
mov byte [esp + 0x54], 3
call fcn.66e138a0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 1
push dword [esp + 0x20]
call edi
lea ecx, [esp + 0x24]
call fcn.66e138e0
lea ecx, [esp + 0x24]
mov byte [esp + 0x54], 2
call fcn.66e134c0
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x14]
mov byte [esp + 0x54], 1
call fcn.66e128b0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 0
call fcn.66e128b0
mov ecx, ebx
call fcn.66e11480
mov bl, 1
lea ecx, [esp + 0x38]
mov dword [esp + 0x54], 0xffffffff
call fcn.66e134c0
mov al, bl
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x48
ret
push 0
push 0x3b503ef
jmp 0x66e101fd
mov ecx, dword [ebx + 0x8c]
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test al, al
je 0x66e101e7
push 0
push 0x3b803ea
mov ecx, 0x66feb0e0
call fcn.66e09730
xor bl, bl
jmp 0x66e10209
cmp eax, 0x431
je 0x66e100ec
push 0
push 0x3c3ffff
mov ecx, 0x66feb0e0
call fcn.66e09730
mov bl, al
lea ecx, [esp + 0x14]
mov byte [esp + 0x54], 1
call fcn.66e128b0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 0
call fcn.66e128b0
jmp 0x66e10196
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x48]
call eax
test al, al
jne 0x66e1018d
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x4c]
call eax
test al, al
jne 0x66e1018d
xor bl, bl
jmp 0x66e10196