Function at 0x48aa9b
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings

Disassembly:
push 0x1f4
mov eax, 0x5990ad
call fcn.00576e6c
push 0x4e2cfe
call fcn.005758ec
pop ecx
mov dword [ebp - 0x1c4], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - method.._AV883_________________________________________________________.virtual_0], vtable.._AV883_________________________________________________________.0
call fcn.0048a042
mov byte [ebp - 4], 1
mov dword [ebp - 0x1cc], ebx
mov byte [ebp - 0x1b0], bl
mov byte [ebp - 0x1af], bl
mov byte [ebp - 0x1ae], bl
mov byte [ebp - 0x1ad], bl
push 0x5f8bb0
lea ecx, [ebp - 0x17c]
call fcn.00479014
mov byte [ebp - 4], 2
push str._serviceDescription
lea ecx, [ebp - 0x194]
call fcn.00479014
mov byte [ebp - 4], 3
push str._serviceName
lea ecx, [ebp - 0x1ac]
call fcn.00479014
mov byte [ebp - 4], 4
push 0x5f8c24
lea ecx, [ebp - 0x164]
call fcn.00479014
mov byte [ebp - 4], 5
push 0x5f8c28
lea ecx, [ebp - 0x14c]
call fcn.00479014
mov byte [ebp - 4], 6
push 0x5f8c2c
lea ecx, [ebp - 0x11c]
call fcn.00479014
mov byte [ebp - 4], 7
lea eax, [ebp - 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
je 0x48ad57
xor esi, esi
inc esi
cmp dword [ebp - 0x1cc], esi
jle 0x48ad50
cmp byte [ebp - 0x1b0], 0
jne 0x48abdc
mov ecx, str._install
mov eax, dword [edi + esi*4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x48abcd
test dx, dx
je 0x48abc9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x48abcd
add eax, 4
add ecx, 4
test dx, dx
jne 0x48aba7
mov eax, ebx
jmp 0x48abd2
sbb eax, eax
or eax, 1
test eax, eax
mov byte [ebp - 0x1b0], bl
jne 0x48abe3
mov byte [ebp - 0x1b0], 1
cmp byte [ebp - 0x1ae], 0
jne 0x48ac29
mov ecx, str._start
mov eax, dword [edi + esi*4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x48ac1a
test dx, dx
je 0x48ac16
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x48ac1a
add eax, 4
add ecx, 4
test dx, dx
jne 0x48abf4
mov eax, ebx
jmp 0x48ac1f
sbb eax, eax
or eax, 1
test eax, eax
mov byte [ebp - 0x1ae], bl
jne 0x48ac30
mov byte [ebp - 0x1ae], 1
cmp byte [ebp - 0x1af], 0
jne 0x48ac76
mov ecx, str._delete
mov eax, dword [edi + esi*4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x48ac67
test dx, dx
je 0x48ac63
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x48ac67
add eax, 4
add ecx, 4
test dx, dx
jne 0x48ac41
mov eax, ebx
jmp 0x48ac6c
sbb eax, eax
or eax, 1
test eax, eax
mov byte [ebp - 0x1af], bl
jne 0x48ac7d
mov byte [ebp - 0x1af], 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1b4], esp
lea eax, [ebp - 0x17c]
push eax
call fcn.00480cdf
mov byte [ebp - 4], 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1d0], esp
push dword [edi + esi*4]
call fcn.00479014
mov byte [ebp - 4], 9
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x164]
call fcn.0048a9f0
add esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1d0], esp
lea eax, [ebp - 0x194]
push eax
call fcn.00480cdf
mov byte [ebp - 4], 0xa
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1b4], esp
push dword [edi + esi*4]
call fcn.00479014
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x14c]
call fcn.0048a9f0
add esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1d0], esp
lea eax, [ebp - 0x1ac]
push eax
call fcn.00480cdf
mov byte [ebp - 4], 0xc
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1b4], esp
push dword [edi + esi*4]
call fcn.00479014
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x11c]
call fcn.0048a9f0
add esp, 0x30
inc esi
cmp esi, dword [ebp - 0x1cc]
jl 0x48ab96
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x11c]
cmp dword [ebp - 0x108], 8
cmovae eax, dword [ebp - 0x11c]
mov dword [ebp - 0x1b4], eax
xor edi, edi
inc edi
mov dword [ebp - 0x1bc], edi
push 0x4e2bae
call fcn.005758ec
pop ecx
mov esi, eax
mov dword [ebp - 0x1c0], esi
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 0xf
mov byte [ebp - 0x1b5], bl
cmp byte [ebp - 0x1b0], 0
je 0x48ae97
mov byte [ebp - 0x1ad], 1
lea eax, [ebp - 0x14c]
push eax
lea edx, [ebp - 0x164]
mov ecx, dword [ebp - 0x1b4]
call fcn.004b36ba
pop ecx
mov edi, eax
mov dword [ebp - 0x1bc], edi
test edi, edi
je 0x48ae97
cmp edi, 0x431
je 0x48ae88
call fcn.004e183f
mov byte [ebp - 4], 7
push esi
call fcn.005758ec
pop ecx
mov dword [ebp - 0x1c0], ebx
mov byte [ebp - 4], 6
push ebx
push 1
lea ecx, [ebp - 0x11c]
call fcn.0047997f
mov byte [ebp - 4], 5
push ebx
push 1
lea ecx, [ebp - 0x14c]
call fcn.0047997f
mov byte [ebp - 4], 4
push ebx
push 1
lea ecx, [ebp - 0x164]
call fcn.0047997f
mov byte [ebp - 4], 3
push ebx
push 1
lea ecx, [ebp - 0x1ac]
call fcn.0047997f
mov byte [ebp - 4], 2
push ebx
push 1
lea ecx, [ebp - 0x194]
call fcn.0047997f
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0x17c]
call fcn.0047997f
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c8]
call fcn.0048a02b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c4]
call fcn.004e2cee
jmp 0x48baab
mov byte [ebp - 0x1b5], 1
mov edi, ebx
mov dword [ebp - 0x1bc], edi
cmp byte [ebp - 0x1ae], 0
je 0x48aeef
mov byte [ebp - 0x1ad], 1
mov esi, dword [ebp - 0x1b4]
mov ecx, esi
call fcn.004b52e8
mov edi, eax
mov dword [ebp - 0x1bc], edi
test edi, edi
je 0x48aee5
cmp byte [ebp - 0x1b5], 0
je 0x48aee5
cmp edi, 0x420
je 0x48aee5
call fcn.004e183f
mov byte [ebp - 4], 7
push dword [ebp - 0x1c0]
jmp 0x48adee
mov edi, ebx
mov dword [ebp - 0x1bc], edi
jmp 0x48aef5
mov esi, dword [ebp - 0x1b4]
cmp byte [ebp - 0x1af], 0
je 0x48af18
mov byte [ebp - 0x1ad], 1
mov ecx, esi
call fcn.004b6066
mov edi, eax
mov dword [ebp - 0x1bc], edi
test edi, edi
jne 0x48aed1
mov dword [ebp - 4], 0xe
jmp 0x48b0dc
cmp byte [ebp - 0x1ad], 0
jne 0x48ba00
mov dword [ebp - 0x1e0], 0x5f8df4
mov dword [ebp - 0x1dc], 0x48a474
mov dword [ebp - 0x1d8], ebx
mov dword [ebp - 0x1d4], ebx
lea eax, [ebp - 0x8c]
push eax
call fcn.0048c523
mov esi, eax
mov byte [ebp - 4], 0x3c
push 0x5f8e18
lea ecx, [ebp - 0x5c]
call fcn.00479014
mov byte [ebp - 4], 0x3d
push eax
mov edx, 0x5f8e1c
lea ecx, [ebp - 0x44]
call fcn.0048177b
mov byte [ebp - 4], 0x3e
mov dword [esp], str.7SVUAERNOABYY0KJ9PLC2DTH2AZ4Z3
mov edx, eax
lea ecx, [ebp - 0x74]
call fcn.004817bf
mov byte [ebp - 4], 0x3f
push ecx
push esi
mov edx, eax
call fcn.004ae7d0
add esp, 0xc
mov byte [ebp - 4], 0x3e
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.0047997f
mov byte [ebp - 4], 0x3d
push ebx
push 1
lea ecx, [ebp - 0x44]
call fcn.0047997f
mov byte [ebp - 4], 0x3c
push ebx
push 1
lea ecx, [ebp - 0x5c]
call fcn.0047997f
mov byte [ebp - 4], 0xe
push ebx
push 1
lea ecx, [ebp - 0x8c]
call fcn.0047997f
mov byte [ebp - 4], 0x40
push 0x4e2bae
call fcn.005758ec
pop ecx
mov esi, eax
mov dword [ebp - 0x1b4], esi
mov byte [ebp - 4], 0x41
lea eax, [ebp - 0x1e0]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x48b79a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0xa4]
push eax
call fcn.0048c5f5
mov byte [ebp - 4], 0x42
push eax
mov edx, edi
lea ecx, [ebp - 0x8c]
call fcn.004b354a
mov edi, eax
mov byte [ebp - 4], 0x43
mov dword [esp], 0x5f8e68
lea ecx, [ebp - 0x5c]
call fcn.00479014
mov byte [ebp - 4], 0x44
push eax
mov edx, 0x5f8e6c
lea ecx, [ebp - 0x44]
call fcn.0048177b
mov byte [ebp - 4], 0x45
mov dword [esp], str.LXIBRHKNSHGRG1CINYTAL65U55HEDB
mov edx, eax
lea ecx, [ebp - 0x74]
call fcn.004817bf
mov byte [ebp - 4], 0x46
push ecx
push edi
mov edx, eax
call fcn.004ae7d0
add esp, 0xc
mov byte [ebp - 4], 0x45
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.0047997f
mov byte [ebp - 4], 0x44
push ebx
push 1
lea ecx, [ebp - 0x44]
call fcn.0047997f
mov byte [ebp - 4], 0x43
push ebx
push 1
lea ecx, [ebp - 0x5c]
call fcn.0047997f
mov byte [ebp - 4], 0x42
push ebx
push 1
lea ecx, [ebp - 0x8c]
call fcn.0047997f
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0xa4]
jmp 0x48b827
lea eax, [ebp - 0x8c]
push eax
call fcn.0048c6c7
mov edi, eax
mov byte [ebp - 4], 0x47
push 0x5f8eb8
lea ecx, [ebp - 0x5c]
call fcn.00479014
mov byte [ebp - 4], 0x48
push eax
mov edx, 0x5f8ebc
lea ecx, [ebp - 0x44]
call fcn.0048177b
mov byte [ebp - 4], 0x49
mov dword [esp], str.FSY8KTR1PEMYAHFA6JVIDY8ZDTF5MC
mov edx, eax
lea ecx, [ebp - 0x74]
call fcn.004817bf
mov byte [ebp - 4], 0x4a
push ecx
push edi
mov edx, eax
call fcn.004ae7d0
add esp, 0xc
mov byte [ebp - 4], 0x49
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.0047997f
mov byte [ebp - 4], 0x48
push ebx
push 1
lea ecx, [ebp - 0x44]
call fcn.0047997f
mov byte [ebp - 4], 0x47
push ebx
push 1
lea ecx, [ebp - 0x5c]
call fcn.0047997f
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x8c]
push ebx
push 1
call fcn.0047997f
mov byte [ebp - 4], 0x40
push esi
call fcn.005758ec
pop ecx
mov dword [ebp - 0x1b4], ebx
mov dword [ebp - 4], 0xe
jmp 0x48b9fe
mov edi, ebx
call fcn.004e183f
mov byte [ebp - 4], 7
push dword [ebp - 0x1c0]
call fcn.005758ec
pop ecx
mov dword [ebp - 0x1c0], ebx
mov byte [ebp - 4], 6
push ebx
push 1
lea ecx, [ebp - 0x11c]
call fcn.0047997f
mov byte [ebp - 4], 5
push ebx
push 1
lea ecx, [ebp - 0x14c]
call fcn.0047997f
mov byte [ebp - 4], 4
push ebx
push 1
lea ecx, [ebp - 0x164]
call fcn.0047997f
mov byte [ebp - 4], 3
push ebx
push 1
lea ecx, [ebp - 0x1ac]
call fcn.0047997f
mov byte [ebp - 4], 2
push ebx
push 1
lea ecx, [ebp - 0x194]
call fcn.0047997f
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0x17c]
call fcn.0047997f
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c8]
call fcn.0048a02b
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1c4]
call fcn.005758ec
pop ecx
mov dword [ebp - 0x1c4], ebx
mov eax, edi
call fcn.00576dbe
ret 0x10