Function at 0x412f20
Capabilities:
Create service
Delete service
Persist via windows service
Query service status
Stop service
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b1db
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x44f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 1
mov esi, dword [ebp + 0xc]
jle 0x41326a
mov ecx, dword [esi + 4]
movzx eax, word [ecx]
cmp eax, 0x2d
je 0x412f6e
cmp eax, 0x2f
jne 0x41326a
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
lea eax, [ecx + 2]
push eax
push str.install
call edi
add esp, 8
test eax, eax
jne 0x413052
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x412fbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetModuleFileName_failed_w_err_0x_08lx_n
call fcn.00413350
add esp, 8
jmp 0x41332f
push 3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x412fe6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.00413350
add esp, 8
jmp 0x41332f
push 0
push 0
push 0x444778
push 0
push 0
lea eax, [ebp - 0x218]
push eax
push 1
push 2
push 0x10
push 4
push str.UWP_RPC_Service
push 0x44479c
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
test edi, edi
jne 0x413027
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateService_failed_w_err_0x_08lx_n
jmp 0x413031
push 0x44479c
push str._s_is_installed._n
call fcn.00413350
add esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
test edi, edi
je 0x41332f
push edi
call esi
jmp 0x41332f
mov eax, dword [esi + 4]
add eax, 2
push eax
push str.remove
call edi
add esp, 8
test eax, eax
jne 0x4131af
push 1
xorps xmm0, xmm0
mov dword [ebp - 0x21c], eax
push eax
push eax
movups xmmword [ebp - 0x234], xmm0
movq qword [ebp - 0x224], xmm0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x278], edi
test edi, edi
je 0x412fcd
push 0x10024
push 0x44479c
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x4130c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService_failed_w_err_0x_08lx_n
jmp 0x41318e
lea eax, [ebp - 0x234]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x41316b
push 0x44479c
push str.Stopping__s.
call fcn.00413350
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x3e8
call edi
lea eax, [ebp - 0x234]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x413141
nop
mov eax, dword [ebp - 0x230]
cmp eax, 3
jne 0x413147
push 0x445388
call fcn.00413350
add esp, 4
push 0x3e8
call edi
lea eax, [ebp - 0x234]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x413110
mov eax, dword [ebp - 0x230]
push 0x44479c
cmp eax, 1
jne 0x413158
push 0x44538c
jmp 0x41315d
push str._n_s_failed_to_stop._n
call fcn.00413350
mov edi, dword [ebp - 0x278]
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x413184
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeleteService_failed_w_err_0x_08lx_n
jmp 0x41318e
push 0x44479c
push str._s_is_removed._n
call fcn.00413350
add esp, 8
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
test esi, esi
je 0x41332f
push esi
call edi
jmp 0x41332f
mov eax, dword [esi + 4]
add eax, 2
push eax
push str.console
call edi
add esp, 8
test eax, eax
jne 0x413304
push 0x40
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.0041c3d0
push ecx
lea ecx, [ebp - 0x274]
call fcn.004169d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x274]
mov eax, dword [ebp - 0x274]
push 4
push str.Starting_Rpc_Server..
mov byte [ebp - 0x238], 1
call dword [eax + 0x18]
call fcn.00413770
mov esi, eax
test esi, esi
je 0x41323d
push esi
push str.RpcServerConnect_returned:_0x_x_n
call fcn.00416bd0
mov eax, dword [ebp - 0x274]
lea ecx, [ebp - 0x274]
add esp, 8
push 4
push str.Starting_Rpc_Server..
call dword [eax + 0x18]
push esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [ebp - 0x244]
mov eax, ecx
mov edx, dword [ebp - 0x240]
or eax, edx
mov dword [ebp - method.CServiceBase.virtual_0], vtable.CServiceBase.0
je 0x41332f
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_EventUnregister]
jmp 0x41332f
push 0x40
lea eax, [ebp - 0x274]
push 0
push eax
call fcn.0041c3d0
push ecx
lea ecx, [ebp - 0x274]
call fcn.004169d0
lea eax, [ebp - 0x274]
mov dword [ebp - 0x224], 0x41a2f0
mov dword [0x45204c], eax
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x228]
push eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x4132e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Service_failed_to_run_w_err_0x_08lx_n
call fcn.00413350
add esp, 8
mov ecx, dword [ebp - 0x244]
mov eax, ecx
mov edx, dword [ebp - 0x240]
or eax, edx
mov dword [ebp - method.CServiceBase.virtual_0], vtable.CServiceBase.0
je 0x413304
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_EventUnregister]
push str.Parameters:_n
call fcn.00413350
push str.__install__to_install_the_service._n
call fcn.00413350
push str.__remove___to_remove_the_service._n
call fcn.00413350
push str.__console__to_run_in_console_mode._n
call fcn.00413350
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041aacd
mov esp, ebp
pop ebp
ret