Function at 0x40996d
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
call fcn.00401c49
call fcn.004015d5
push rax
call fcn.0040488f
mov qword [0x004014da], rax
mov qword [rsp + 8], rax
call fcn.00404871
mov qword [0x004014ea], rax
mov qword [rsp + 0x10], rax
call fcn.00409581
mov rcx, rax
call fcn.00401e05
mov rsi, rax
xor edx, edx
xor edi, edi
test rcx, rcx
je 0x4098cc
cmp word [rsi], 0
je 0x4098b4
test rdi, rdi
je 0x409832
mov qword [rdi], rsi
xor edi, edi
jmp 0x4098b4
cmp word [rsi + 2], 0
je 0x4098b4
lodsd eax, dword [rsi]
mov dh, dl
or dh, 1
cmp eax, 0x69002d
je 0x4098b4
mov dh, dl
or dh, 2
cmp eax, 0x75002d
je 0x4098b4
mov dh, dl
or dh, 4
cmp eax, 0x73002d
je 0x4098b4
mov dh, dl
or dh, 8
cmp eax, 0x62002d
je 0x4098b4
mov dh, dl
mov rdi, 0x40a949
cmp eax, 0x6e002d
je 0x4098b4
mov rdi, 0x403d51
cmp eax, 0x72002d
je 0x4098b4
mov rdi, 0x40a9c5
cmp eax, 0x64002d
je 0x4098b4
mov rdi, 0x401053
cmp eax, 0x6c002d
je 0x4098b4
mov rdi, 0x4097c7
cmp eax, 0x6f002d
je 0x4098b4
xor edi, edi
mov dl, dh
push rsi
call fcn.0040219b
add rsi, rax
add rsi, 2
dec rcx
jne 0x409819
mov rsi, qword [0x004097c7]
test rsi, rsi
je 0x409913
xor ecx, ecx
cmp dword [rsi], 0x30
je 0x40990d
lodsw ax, word [rsi]
mov ch, cl
or ch, 1
cmp ax, 0x6d
je 0x409904
mov ch, cl
or ch, 2
cmp ax, 0x77
je 0x409904
mov ch, cl
or ch, 4
cmp ax, 0x65
je 0x409904
mov ch, cl
mov cl, ch
xor ch, ch
test ax, ax
jne 0x4098df
mov dword [0x0040104f], ecx
cmp qword [0x00401053], 0
je 0x409959
push 0
push qword [0x00401053]
push 2
push 0
push 0
call fcn.00402f6a
mov qword [0x00401053], rax
push 0x30007
push qword [0x00401053]
call fcn.00401ffc
cmp eax, 0xffffffff
je 0x409953
mov qword [0x0040105b], rax
push rax
call fcn.00402102
cmp qword [0x0040105b], 0
je 0x409979
push rax
push 2
call 0x40996d
or eax, 0xe835ff0a
jbe 0x409971
invalid
invalid
cmp qword [0x0040105b], 0
je 0x409999
push rax
push 2
call 0x40998d
or eax, 0xc835ff0a
jbe 0x409991
invalid
invalid
cmp qword [0x0040105b], 0
je 0x4099e4
push rax
push 0x2d
call 0x4099d8
sub eax, 0x2d2d2d2d
sub eax, 0x2d2d2d2d
sub eax, 0x2d2d2d2d
sub eax, 0x2d2d2d2d
sub eax, 0x2d2d2d2d
sub eax, 0x2d2d2d2d
sub eax, 0x2d2d2d2d
sub eax, 0x2d2d2d2d
sub eax, 0xa0d2d2d
push qword [0x0040105b]
call fcn.004020bf
pop rax
cmp qword [0x0040105b], 0
je 0x409a1b
push rax
push 0x19
call fcn.00409a0f
push rsp
push rsi
invalid
sub rsp, 0x60
push rsp
call fcn.0040a871
mov rcx, rsp
cmp qword [0x0040105b], 0
je 0x409a77
push rax
push 0
call 0x409a3d
or eax, 0x16a000a
push rcx
push 0x11
call 0x409a4e
push rsp
imul ebp, dword [rbp + 0x65], 0x6a00203a
add dword [rdx], ebp
push 0
call fcn.00402f6a
push rax
push rax
push rax
call fcn.00402170
xchg qword [rsp], rax
push rax
push qword [0x0040105b]
call fcn.004020bf
call fcn.00401aae
pop rax
add rsp, 0x60
push rdx
mov eax, 1
cpuid
pop rcx
test edx, 0x100
je 0x409b15
test edx, 0x8000
je 0x409b93
push 0
push fcn.00401e4b
test cl, 1
jne 0x40aafd
test cl, 2
jne 0x40ad8f
test cl, 4
jne 0x40ad97
add rsp, 0x10
test cl, 8
jne 0x409ad4
call fcn.0040afe7
test eax, eax
jne 0x409c12
cmp qword [0x0040105b], 0
je 0x409b0b
push rax
push 0x19
call 0x409aff
push rbx
je 0x409b4a
jb 0x409b5f
imul ebp, dword [rsi + 0x67], 0x27565420
jae 0x409b14
jae 0x409b5b
jb 0x409b6e
jb 0x409b29
or eax, 0x5635ff0a
jne 0x409b03
invalid
invalid
call fcn.00409c1d
jmp 0x409c0d
add byte [rax - 0x7d], cl
cmp eax, 0xffff753e
add byte [rdx + rsi*2 + 0x50], dh
cmp qword [0x0040105b], 0
je 0x409b91
push rax
push rax
mov eax, 4
and eax, dword [0x0040104f]
pop rax
je 0x409b90
jne 0x409b2a
invalid
call [rax + 0x74]
invalid
push 0x4f
call fcn.00409b85
push r10
push rdx
push r10
cmp ah, byte [rax]
push r8
push rbp
and byte [rdi + rbp*2 + 0x65], ah
jae 0x409bb4
invalid
jne 0x409bbc
jo 0x409bbd
jb 0x409bc4
and byte [rbx + 0x6f], ah
insd dword [rdi], dx
jo 0x409bb7
jb 0x409bbd
sub eax, 0x2d646e61
jae 0x409bd6
sub eax, 0x70617773
and byte [rcx + 0x6e], ch
jae 0x409bda
invalid
jb 0x409bdd
invalid
sub byte [rbx + 0x6d], ah
jo 0x409beb
invalid
pop rax
jmp 0x409c0d
cmp qword [0x0040105b], 0
je 0x409c0b
push rax
push rax
mov eax, 4
and eax, dword [0x0040104f]
pop rax
je 0x409c0a
push 0x4b
call 0x409bff
push r10
push rdx
push r10
cmp ah, byte [rax]
push r8
push rax
push rbp
and byte [rdi + rbp*2 + 0x65], ah
jae 0x409c32
invalid
outsd dx, dword [rsi]
outsb dx, byte [rsi]
invalid
and byte [rbp + 0x6f], ch
jbe 0x409bff
imul ebp, dword [rsi + 0x73], 0x63757274
je 0x409c51
outsd dx, dword [rsi]
outsb dx, byte [rsi]
and byte [rax], ch
invalid
sub byte [rbx + 0x6d], ah
outsd dx, dword [rsi]
jbe 0x409c1a
sub al, 0x20
js 0x409c5f
je 0x409c61
outsb dx, byte [rsi]
or eax, 0x5635ff0a
je 0x409c03
push qword [0x0040105b]
call fcn.004020bf
invalid
invalid
pop rax
jmp 0x409c0d
add rsp, 0x18
ret
add rsp, 0x18
push 0
call fcn.00401e4b
invalid
invalid
je 0x409cbb
and byte [rbx + 0x74], dh
outsd dx, dword [rsi]
jb 0x409cbe
and byte fs:[rcx + riz*2 + 0x74], ah
invalid
or eax, 0xf135ff0a
or eax, 0xf135ff0a
jae 0x409c68
invalid
invalid
invalid
call section..text
mov rax, rsp
shr rax, 4
jae 0x40ab0d
push 0
sub rsp, 0x80
call fcn.0040aced
push 0xfffe
call fcn.004019a8
mov rbx, rax
push 0
cmp qword [0x004097c7], 0
je 0x40ab4d
add byte [rbx + rbx + 0x68], dh
or byte [rcx + 0x16a0040], ch
push 0x40a908
push 1
push qword [0x004097c7]
push 2
call 0x40ab4b
and byte [0x6a40cdbb], ch
add dword [rax - 0x7d], ecx
cmp eax, 0xffff64fe
add byte [rbx + rbx + 0x68], dh
or byte [rcx + 0x16a0040], ch
cmp qword [0x00401053], 0
je 0x40ab72
push 0x40a908
push 1
push qword [0x00401053]
push 0x11
call 0x40ab70
and byte [0x6a40cddd], ch
add dword [rax - 0x7f], ecx
cmp eax, 0xfffffdcc
invalid
cmp qword [0x0040a949], 0x40a91f
je 0x40ab9a
push 0x40a908
push 1
push qword [0x0040a949]
push 2
call 0x40ab98
and byte [0x6a40ce07], ch
add eax, ebp
jno 0x40ab2f
call fcn.00403e10
cmp qword [0x00403d51], 0
je 0x40abc4
invalid
push 0x40a908
push 1
push qword [0x00403d51]
push 2
call 0x40abc2
and byte [0x6a40ce35], ch
add eax, ebp
invalid
call section..text
mov rax, rsp
shr rax, 4
jae 0x40abd4
push 0
sub rsp, 0x80
mov r8, 0x7fff
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
call fcn.00401018
push 0x40a908
push 1
push rbx
push 0x20002
push 0x40a908
push 1
call fcn.00402d3b
mov rbx, rax
mov r8, 2
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.DLL_OpenSCManagerA]
test rax, rax
je 0x40ace7
mov rsi, rax
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0x40a951
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], 2
mov qword [rsp + 0x20], 0x10
mov r9, 0xf003f
mov r8, qword [0x0040a949]
mov rdx, qword [0x0040a949]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.DLL_CreateServiceW]
test rax, rax
je 0x40acde
xchg rbx, rax
push rax
call fcn.00401aae
mov r8, 0x40a9c5
mov rdx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_ChangeServiceConfig2W]
mov r8, 0x40aacd
mov rdx, 2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_ChangeServiceConfig2W]
xor eax, eax
inc eax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
call fcn.00401018
ret
push 1
call fcn.0040ad9f
ret
push 0
call fcn.0040ad9f
ret