Function at 0x4755b1
Capabilities:
Create service
Manipulate safe mode programs
Modify service
Persist via windows service
Set registry value

Disassembly:
sub esp, 0xd3c
push ebx
push ebp
push esi
push edi
push ecx
mov ebx, ecx
push ecx
lea ecx, [esp + 0x58]
call fcn.004443c5
mov edx, str.Installing_service
lea ecx, [esp + 0x60]
call fcn.0044348f
push eax
call fcn.00443642
mov dword [esp], 0x557fa4
push str.C:AeroAdminLog.txt
call fcn.0051874e
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x47562a
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x6c]
call fcn.00444f26
cmp dword [esp + 0x2c], 0x10
lea ecx, [esp + 0x18]
cmovae ecx, dword [esp + 0x18]
push ecx
push esi
call fcn.0047442c
pop ecx
pop ecx
lea ecx, [esp + 0x18]
call fcn.0043c446
push esi
call fcn.00518a6b
pop ecx
lea ecx, [esp + 0x50]
call fcn.00443fd6
push 0x109
lea eax, [esp + 0x314]
xor ebp, ebp
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x310]
mov dword [esp + 0x528], 0x22
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, bp
jne 0x47565d
lea edi, [esp + 0x528]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bp
jne 0x475674
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x528]
push 2
sub edi, 2
pop edx
mov ax, word [edi + 2]
add edi, edx
cmp ax, bp
jne 0x47569b
mov eax, dword [0x54dfa8]
mov dword [edi], eax
lea edi, [esp + 0x528]
sub edi, 2
mov ax, word [edi + 2]
add edi, edx
cmp ax, bp
jne 0x4756b7
cmp dword [ebx + 0x14], 8
mov eax, dword [0x54e058]
mov dword [edi], eax
jb 0x4756d1
mov ebx, dword [ebx]
mov esi, ebx
mov ax, word [ebx]
add ebx, edx
cmp ax, bp
jne 0x4756d3
lea edi, [esp + 0x528]
sub ebx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, edx
cmp ax, bp
jne 0x4756e9
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push edx
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
test ebp, ebp
jne 0x4757a0
push ecx
push ecx
lea ecx, [esp + 0x108]
call fcn.004443c5
mov edx, str.OpenSCManager_error
lea ecx, [esp + 0x110]
call fcn.0044348f
push eax
call fcn.00443642
mov dword [esp], 0x557fa4
push str.C:AeroAdminLog.txt
call fcn.0051874e
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x47578d
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x11c]
call fcn.00444f26
cmp dword [esp + 0x2c], 0x10
lea ecx, [esp + 0x18]
cmovae ecx, dword [esp + 0x18]
push ecx
push esi
call fcn.0047442c
pop ecx
pop ecx
lea ecx, [esp + 0x18]
call fcn.0043c446
push esi
call fcn.00518a6b
pop ecx
lea ecx, [esp + 0x100]
call fcn.00443fd6
xor al, al
jmp 0x475977
push edi
push edi
push str.Tcpip
push edi
push edi
lea eax, [esp + 0x53c]
push eax
push 1
push 2
push 0x10
push 0xf01ff
mov eax, str.AeroadminService
push eax
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x4758ed
xor eax, eax
mov dword [esp + 0x4c], 0x2710
inc eax
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x48], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
push eax
push 2
push esi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x47589f
push ecx
push ecx
lea ecx, [esp + 0x1b8]
call fcn.004443c5
mov edx, str.ChangeServiceConfig2_error
lea ecx, [esp + 0x1c0]
call fcn.0044348f
push eax
call fcn.00443642
mov dword [esp], 0x557fa4
push str.C:AeroAdminLog.txt
call fcn.0051874e
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x475891
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x1cc]
call fcn.00444f26
cmp dword [esp + 0x44], 0x10
lea ecx, [esp + 0x30]
cmovae ecx, dword [esp + 0x30]
push ecx
push edi
call fcn.0047442c
pop ecx
pop ecx
lea ecx, [esp + 0x30]
call fcn.0043c446
push edi
call fcn.00518a6b
pop ecx
lea ecx, [esp + 0x1b0]
call fcn.00443fd6
xor edi, edi
push esi
call ebx
push edi
lea eax, [esp + 0x18]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push str.SYSTEMControlSet001ControlSafeBootNetworkAeroadminService
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4758de
push 0x10
push str.Service
push 1
push edi
push 0x54de54
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47596f
push ecx
push ecx
lea ecx, [esp + 0x268]
call fcn.004443c5
mov edx, str.CreateService_error
lea ecx, [esp + 0x270]
call fcn.0044348f
push eax
call fcn.00443642
mov dword [esp], 0x557fa4
push str.C:AeroAdminLog.txt
call fcn.0051874e
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x475963
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x27c]
call fcn.00444f26
cmp dword [esp + 0x44], 0x10
lea ecx, [esp + 0x30]
cmovae ecx, dword [esp + 0x30]
push ecx
push edi
call fcn.0047442c
pop ecx
pop ecx
lea ecx, [esp + 0x30]
call fcn.0043c446
push edi
call fcn.00518a6b
pop ecx
lea ecx, [esp + 0x260]
call fcn.00443fd6
push ebp
call ebx
test esi, esi
setne al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd3c
ret