Function at 0x4cf390
Capabilities:
Persist via windows service
Query service status
Read .ini file
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x364
mov eax, dword [0x5552b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push esi
push str._lanch_driver_
push str.Driver
xor edx, edx
xor ecx, ecx
call fcn.004a3520
add esp, 0xc
xor eax, eax
push 2
push esi
push esi
mov dword [ebp - 0x34c], esi
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x334], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x35c], edi
cmp edi, esi
je 0x4cf687
mov dword [ebp - 0x350], esi
push ebx
jmp 0x4cf410
push 0xf01ff
push str.smrf
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
je 0x4cf661
test esi, esi
jne 0x4cf62c
push 0x103
lea eax, [ebp - 0x32f]
push esi
push eax
mov byte [ebp - 0x330], 0
call fcn.004e8ba0
push str.Smrf
lea ecx, [ebp - 0x330]
push str.systemcurrentcontrolset_services_s
push ecx
call fcn.004e5b0c
add esp, 0x18
xor eax, eax
lea edx, [ebp - 0x360]
push edx
lea ecx, [ebp - 0x354]
push ecx
push eax
push 0xf003f
push eax
push eax
push eax
lea edx, [ebp - 0x330]
push edx
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x354], eax
mov dword [ebp - 0x360], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4cf615
push 0x206
push eax
lea ecx, [ebp - 0x22a]
push ecx
mov word [ebp - 0x22c], ax
call fcn.004e8ba0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x22c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x22c]
push 0x5c
push eax
call fcn.004e56ec
add esp, 8
test eax, eax
je 0x4cf4fe
lea ecx, [ebp - 0x22c]
push 0x5c
push ecx
call fcn.004e56ec
add esp, 8
xor edx, edx
mov word [eax], dx
lea edi, [ebp - 0x22c]
add edi, 0xfffffffe
jmp 0x4cf510
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4cf510
mov ecx, 7
mov esi, 0x521318
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x22c]
push ecx
push 0x10
xor eax, eax
lea edx, [ebp - 0x24]
push edx
push 0x51c514
push str.TALEE
push str.MultiIni
mov word [ebp - 0x24], ax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
mov dword [ebp - 0x358], 2
call edi
test eax, eax
je 0x4cf58a
cmp word [ebp - 0x24], 0x30
jne 0x4cf58a
mov dword [ebp - 0x358], 0
mov ecx, dword [ebp - 0x354]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x358]
push eax
push 4
push 0
push str.Start
push ecx
call esi
push 0
push 0
push ebx
mov dword [ebp - 0x364], 1
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
lea edx, [ebp - 0x22c]
push edx
push 0x10
lea eax, [ebp - 0x24]
push eax
push 0x51c514
push str.NONET
push str.MultiIni
call edi
mov eax, dword [ebp - 0x354]
push 4
xor ecx, ecx
cmp word [ebp - 0x24], 0x31
lea edx, [ebp - 0x358]
push edx
push 4
setne cl
push 0
push str.NetDevice
push eax
mov dword [ebp - 0x358], ecx
call esi
mov edi, dword [ebp - 0x35c]
mov esi, dword [ebp - 0x364]
mov ecx, dword [ebp - 0x354]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x354], 0
lea edx, [ebp - 0x34c]
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4cf647
cmp dword [ebp - 0x348], 4
je 0x4cf67f
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x350]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4cf672
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x350]
cmp dword [ebp - 0x350], 0x3c
jl 0x4cf410
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004e4746
mov esp, ebp
pop ebp
ret