Function at 0x41be70
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x9c
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.ADVAPI32.DLL_OpenSCManagerW
sub esp, 0xc
test eax, eax
mov dword [ebx], eax
je 0x41bee0
mov edx, dword [str.SysMon]
mov dword [esp + 8], 0xf01ff
mov esi, 1
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.ADVAPI32.DLL_OpenServiceW
sub esp, 0xc
test eax, eax
mov dword [ebx + 4], eax
je 0x41bef0
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor esi, esi
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x48]
lea edi, [ebp - 0x28]
call fcn.004014e0
mov eax, dword [str.moonblood.sys]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x48]
mov esi, eax
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x44]
mov ecx, esi
add eax, eax
add ecx, eax
setne cl
test esi, esi
sete dl
and cl, dl
mov esi, ecx
je 0x41bf31
mov dword [esp], 0x4a4064
call fcn.00494ea0
sar eax, 1
cmp eax, 7
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x4c], eax
ja 0x41c060
cmp eax, 1
je 0x41c030
mov ecx, dword [ebp - 0x60]
mov edx, edi
test ecx, ecx
jne 0x41c0da
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov word [edx + eax*2], cx
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
mov edx, 0x3fffffff
sub edx, dword [ebp - 0x2c]
cmp eax, edx
ja 0x41c0fa
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x30]
mov dword [esp], eax
call fcn.0048c250
mov eax, dword [str.SysMon]
mov edx, dword [ebp - 0x30]
sub esp, 8
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0xf01ff
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call sub.ADVAPI32.DLL_CreateServiceW
sub esp, 0x34
test eax, eax
mov dword [ebx + 4], eax
je 0x41c0a3
mov eax, dword [ebp - 0x30]
cmp eax, edi
je 0x41c014
mov dword [esp], eax
call fcn.0049ae20
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x40]
cmp eax, edx
je 0x41c026
mov dword [esp], eax
call fcn.0049ae20
mov esi, 1
jmp 0x41becc
mov ecx, dword [ebp - 0x64]
movzx edx, word [ecx]
mov word [ebp - 0x28], dx
mov edx, edi
jmp 0x41bf58
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x30]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0048c3a0
mov edx, dword [ebp - 0x4c]
sub esp, 8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp - 0x60]
mov dword [esp], eax
mov dword [esp + 8], ecx
mov ecx, dword [ebp - 0x64]
mov dword [esp + 4], ecx
call fcn.00415080
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x30]
jmp 0x41bf58
mov eax, dword [ebx]
mov dword [esp], eax
call sub.ADVAPI32.DLL_CloseServiceHandle
mov eax, dword [ebp - 0x30]
sub esp, 4
cmp eax, edi
je 0x41c0bf
mov dword [esp], eax
call fcn.0049ae20
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x40]
cmp eax, edx
je 0x41becc
mov dword [esp], eax
call fcn.0049ae20
jmp 0x41becc
mov eax, edi
jmp 0x41c082
mov dword [esp], 0x4a440e
call fcn.00495050
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop