Function at 0x44a320
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x483fe8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x4ba070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 0
call fcn.00452480
mov esi, eax
mov ecx, esi
call fcn.00452220
cmp byte [0x4be608], 0
jne 0x44a3c5
mov ecx, 0xf0
call fcn.00452af0
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 1
xorps xmm0, xmm0
movsd qword [ebp - 0x48], xmm0
test eax, eax
je 0x44a3b9
sub esp, 8
mov ecx, eax
movsd qword [esp], xmm0
push 0x4be608
sub esp, 0xc
push 0x108
push str.C:BuildAgentwork4d643bb3f4c71f96Common_service.cpp
push 0x48
call fcn.004522f0
mov byte [ebp - 4], 0
mov dword [0x4bfb98], eax
jmp 0x44a3cd
xor eax, eax
mov byte [ebp - 4], al
mov dword [0x4bfb98], eax
jmp 0x44a3cd
xorps xmm0, xmm0
movsd qword [ebp - 0x48], xmm0
mov ecx, esi
call fcn.00452230
mov ecx, dword [0x4bfb98]
lea ecx, [ecx + 0xd0]
call fcn.00452220
mov eax, dword [0x4bfb98]
mov eax, dword [eax]
mov esi, dword [eax + 0x48]
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x44a3f9
mov eax, dword [edi + 4]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041ae90
mov byte [ebp - 4], 2
push dword [eax]
push str.Installing_service___s_...
push dword [0x4bfb98]
call esi
mov edx, dword [ebp - 0x1c]
add esp, 0xc
add edx, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 3
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44a439
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov ecx, dword [0x4bfb98]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x4bfb98]
lea ecx, [ecx + 0xd0]
call fcn.00452230
push 0
lea ecx, [ebp - 0x14]
call fcn.0041b250
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
jne 0x44a500
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, 0x104
or ecx, edx
jge 0x44a499
push 0x104
lea ecx, [ebp - 0x14]
call fcn.0041bb10
mov eax, dword [ebp - 0x14]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
neg eax
sbb esi, esi
neg esi
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x14]
push dword [ecx - 8]
push ecx
call fcn.00460740
mov edx, eax
add esp, 8
test edx, edx
js 0x44ab00
mov ecx, dword [ebp - 0x14]
cmp edx, dword [ecx - 8]
jg 0x44ab00
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 4
mov word [eax + edx*2], cx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x44a4f8
movzx eax, ax
or eax, 0x80070000
test esi, esi
je 0x44aaea
call fcn.00452480
mov esi, eax
mov ecx, esi
call fcn.00452220
cmp byte [0x4be60b], 0
jne 0x44a561
mov ecx, 0xf0
call fcn.00452af0
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 6
test eax, eax
je 0x44a556
movsd xmm0, qword [ebp - 0x48]
sub esp, 8
mov ecx, eax
movsd qword [esp], xmm0
push 0x4be60b
sub esp, 0xc
push 0x111
push str.C:BuildAgentwork4d643bb3f4c71f96Common_service.cpp
push 0x48
call fcn.004522f0
jmp 0x44a558
xor eax, eax
mov byte [ebp - 4], 4
mov dword [0x4bfb8c], eax
mov ecx, esi
call fcn.00452230
mov ecx, dword [0x4bfb8c]
lea ecx, [ecx + 0xd0]
call fcn.00452220
mov eax, dword [0x4bfb8c]
lea ecx, [ebp - 0x1c]
push dword [edi + 8]
mov eax, dword [eax]
mov esi, dword [eax + 0x48]
call fcn.0041ae90
mov byte [ebp - 4], 7
push dword [eax]
push str.Open_SCM_manager___s_...
push dword [0x4bfb8c]
call esi
mov edx, dword [ebp - 0x1c]
add esp, 0xc
add edx, 0xfffffff0
mov byte [ebp - 4], 8
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44a5c2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
mov ecx, dword [0x4bfb8c]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x4bfb8c]
lea ecx, [ecx + 0xd0]
call fcn.00452230
mov ecx, dword [edi + 8]
push 0xf003f
push 0
call fcn.0044c890
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x34], edi
xor eax, eax
mov byte [ebp - 4], 9
test edi, edi
setne al
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x44a61d
movzx eax, ax
or eax, 0x80070000
cmp dword [ebp - 0x1c], 0
je 0x44ab0a
call fcn.00452480
mov esi, eax
mov ecx, esi
call fcn.00452220
cmp byte [0x4be605], 0
jne 0x44a688
mov ecx, 0xf0
call fcn.00452af0
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0xa
test eax, eax
je 0x44a67d
movsd xmm0, qword [ebp - 0x48]
sub esp, 8
mov ecx, eax
movsd qword [esp], xmm0
push 0x4be605
sub esp, 0xc
push 0x11f
push str.C:BuildAgentwork4d643bb3f4c71f96Common_service.cpp
push 0x48
call fcn.004522f0
jmp 0x44a67f
xor eax, eax
mov byte [ebp - 4], 9
mov dword [0x4bfb90], eax
mov ecx, esi
call fcn.00452230
mov ecx, dword [0x4bfb90]
lea ecx, [ecx + 0xd0]
call fcn.00452220
mov eax, dword [0x4bfb90]
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x18]
mov eax, dword [eax]
push dword [esi + 4]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x1c], eax
call fcn.0041ae90
mov byte [ebp - 4], 0xb
push dword [eax]
push str.Create_service___s_...
push dword [0x4bfb90]
call dword [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
add esp, 0xc
add edx, 0xfffffff0
mov byte [ebp - 4], 0xc
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44a6f0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 9
mov ecx, dword [0x4bfb90]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x4bfb90]
lea ecx, [ecx + 0xd0]
call fcn.00452230
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 2
test ecx, ecx
je 0x44a726
mov edx, dword [esi + 4]
jmp 0x44a72b
mov ecx, dword [esi + 4]
mov edx, ecx
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x14]
push 1
push 2
push 0x20
push eax
push ecx
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
mov dword [ebp - 0x38], esi
xor eax, eax
mov byte [ebp - 4], 0xd
test esi, esi
setne al
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x44a76d
movzx eax, ax
or eax, 0x80070000
cmp dword [ebp - 0x28], 0
je 0x44ab20
call fcn.00452480
mov ecx, eax
mov dword [ebp - 0x28], eax
call fcn.00452220
cmp byte [0x4be60a], 0
jne 0x44a7d9
mov ecx, 0xf0
call fcn.00452af0
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0xe
test eax, eax
je 0x44a7ce
movsd xmm0, qword [ebp - 0x48]
sub esp, 8
mov ecx, eax
movsd qword [esp], xmm0
push 0x4be60a
sub esp, 0xc
push 0x128
push str.C:BuildAgentwork4d643bb3f4c71f96Common_service.cpp
push 0x50
call fcn.004522f0
jmp 0x44a7d0
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [0x4bfb7c], eax
mov ecx, dword [ebp - 0x28]
call fcn.00452230
mov ecx, dword [0x4bfb7c]
lea ecx, [ecx + 0xd0]
call fcn.00452220
mov eax, dword [0x4bfb7c]
mov eax, dword [eax]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x44a80c
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041ae90
mov byte [ebp - 4], 0xf
push dword [eax]
push str.Create_service___s__:_OK
push dword [0x4bfb7c]
call dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
add esp, 0xc
add edx, 0xfffffff0
mov byte [ebp - 4], 0x10
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44a84a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xd
mov ecx, dword [0x4bfb7c]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x4bfb7c]
lea ecx, [ecx + 0xd0]
call fcn.00452230
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x44a993
mov dword [ebp - 0x1c], eax
call fcn.00452480
mov ecx, eax
mov dword [ebp + 0x10], eax
call fcn.00452220
cmp byte [0x4be602], 0
jne 0x44a8da
mov ecx, 0xf0
call fcn.00452af0
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0x11
test eax, eax
je 0x44a8cf
movsd xmm0, qword [ebp - 0x48]
sub esp, 8
mov ecx, eax
movsd qword [esp], xmm0
push 0x4be602
sub esp, 0xc
push 0x12d
push str.C:BuildAgentwork4d643bb3f4c71f96Common_service.cpp
push 0x48
call fcn.004522f0
jmp 0x44a8d1
xor eax, eax
mov byte [ebp - 4], 0xd
mov dword [0x4bfb94], eax
mov ecx, dword [ebp + 0x10]
call fcn.00452230
mov ecx, dword [0x4bfb94]
lea ecx, [ecx + 0xd0]
call fcn.00452220
mov eax, dword [0x4bfb94]
lea ecx, [ebp - 0x28]
mov eax, dword [eax]
mov eax, dword [eax + 0x48]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x18]
push dword [eax + 4]
call fcn.0041ae90
mov byte [ebp - 4], 0x12
push dword [eax]
push str.Change_service_config___s_...
push dword [0x4bfb94]
call dword [ebp + 0x10]
mov edx, dword [ebp - 0x28]
add esp, 0xc
add edx, 0xfffffff0
mov byte [ebp - 4], 0x13
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44a943
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xd
mov ecx, dword [0x4bfb94]
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [0x4bfb94]
lea ecx, [ecx + 0xd0]
call fcn.00452230
lea eax, [ebp - 0x1c]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
neg eax
sbb ebx, ebx
neg ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x44a988
movzx eax, ax
or eax, 0x80070000
test ebx, ebx
je 0x44ab36
or ebx, 0xffffffff
test esi, esi
je 0x44a9a2
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
jmp 0x44a9a8
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x44a9af
push edi
call esi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x14
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x44a9cb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
push eax
lea ecx, [ebp - 0x20]
call fcn.00417120
push 0x4b7dbc
mov eax, ecx
push eax
call fcn.0045841a
push 0x80070057
call fcn.00417140
push eax
lea ecx, [ebp - 0x24]
call fcn.00417120
push 0x4b7dbc
mov eax, ecx
push eax
call fcn.0045841a
push eax
lea ecx, [ebp - 0x2c]
call fcn.00417120
push 0x4b7dbc
mov eax, ecx
push eax
call fcn.0045841a
push eax
lea ecx, [ebp - 0x30]
call fcn.00417120
push 0x4b7dbc
mov eax, ecx
push eax
call fcn.0045841a
int3