Function at 0x423e24
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push ebp
push ebx
mov edx, 0xf
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x423e2b
call fcn.0043fe00
push esp
push 0xcb
call fcn.00440ad0
add esp, 8
push 0x117
call fcn.00432f10
push 0x119
call fcn.00432f10
mov ebx, dword [esp + 0x14]
imul ebx, dword [esp + 0x14]
mov dword [esp + 0x14], ebx
push 0x11a
call fcn.00432f10
push 0x30
call fcn.004063fd
push 0x11a
call fcn.00433063
push 0x11b
call fcn.00432f10
mov ebx, dword [0x4c1e14]
cmp ebx, 2
jle 0x423f75
push 0x11c
call fcn.00432f10
mov ebx, dword [esp]
imul ebx, dword [esp]
mov dword [esp], ebx
push 0x11d
call fcn.00432f10
push 1
push dword [0x4c1e14]
call fcn.004370f0
call fcn.004371f0
mov dword [esp], eax
push 0x11e
call fcn.00432f10
mov ebx, dword [esp]
mov eax, ebx
mov edx, dword [0x4ac0c0]
mov edx, dword [edx - 8]
call fcn.00432fd6
mov ebp, dword [0x4ac0c0]
imul ebx, ebx, 0xc
add ebp, ebx
call fcn.00432fb6
mov edx, dword [ebp + 4]
push edx
call fcn.0043fe60
pop edx
push eax
push edx
call fcn.0043ff60
lea eax, [esp + 0xc]
push eax
call fcn.0043fea0
push 0x11f
call fcn.00432f10
mov ebx, dword [esp]
mov eax, ebx
mov edx, dword [0x4ac0c0]
mov edx, dword [edx - 8]
call fcn.00432fd6
mov ebp, dword [0x4ac0c0]
imul ebx, ebx, 0xc
add ebp, ebx
call fcn.00432fb6
mov edx, dword [ebp + 8]
push edx
call fcn.0043fe60
pop edx
push eax
push edx
call fcn.0043ff60
lea eax, [esp + 0x10]
push eax
call fcn.0043fea0
push 0x120
call fcn.00432f10
jmp 0x423faf
push 0x120
call fcn.00432f10
push 0x121
call fcn.00432f10
mov edx, str.Health_Key_Authentication_Protocol
lea ecx, [esp + 8]
call fcn.00434008
push 0x122
call fcn.00432f10
mov edx, 0x4ac930
lea ecx, [esp + 0xc]
call fcn.00434008
push 0x123
call fcn.00432f10
push 0x128
call fcn.00432f10
push edx
call fcn.0043fe60
pop edx
push eax
push edx
call fcn.0043fe60
pop edx
push eax
push edx
call fcn.0043fe60
pop edx
push eax
push edx
call fcn.0043fe60
pop edx
push eax
push edx
call fcn.0043fe60
pop edx
push eax
push edx
call fcn.0043fe60
pop edx
push eax
call fcn.0043670d
call fcn.00436a3a
call fcn.004343e2
add dword [esp], edx
call fcn.004364b0
call fcn.004343e2
add dword [esp], edx
call fcn.00435780
call fcn.00435860
lea eax, [esp + 0x2c]
push eax
call fcn.0043fea0
push 0x129
call fcn.00432f10
push dword [esp + 0x28]
mov edx, 0x4ac1aa
pop ecx
call fcn.00434410
jne 0x4240d1
push 0x12a
call fcn.00432f10
mov edx, dword [esp + 0x28]
push edx
call fcn.0043fe60
pop edx
push eax
push edx
call fcn.0043ff60
lea eax, [0x4c1dd4]
push eax
call fcn.0043fea0
push 0x12b
call fcn.00432f10
mov eax, dword [0x4c1dd4]
push eax
lea ebp, [esp + 0x1c]
call fcn.00432fb6
pop eax
mov dword [ebp], eax
push 0x12c
call fcn.00432f10
lea eax, [0x42d5de]
push eax
call fcn.00432fb6
pop eax
mov dword [ebp + 4], eax
push 0x12d
call fcn.00432f10
lea eax, [esp + 0x18]
push eax
call sub.ADVAPI32.dll_StartServiceCtrlDispatcherW
push 0x12d
call fcn.00433063
push 0x12e
call fcn.00432f10
jmp 0x424768
push 0x12e
call fcn.00432f10
push 0x12f
call fcn.00432f10
call fcn.00419bf3
push 0x12f
call fcn.00433063
push 0x130
call fcn.00432f10
mov dword [esp + 0x10], 0
push 0x131
call fcn.00432f10
push 0x132
call fcn.00432f10
push edx
call fcn.0043fe60
pop edx
push eax
call fcn.00424bf0
push 0x132
call fcn.00433063
push edx
call fcn.0043fe60
pop edx
push eax
call fcn.00405266
push 0x132
call fcn.00433063
pop eax
lea eax, [esp + 0x28]
push eax
call fcn.0043fea0
push 0x133
call fcn.00432f10
push edx
call fcn.0043fe60
pop edx
push eax
push dword [esp + 0x28]
push edx
call fcn.0043fe60
pop edx
push eax
push edx
call fcn.0043fe60
pop edx
push eax
call fcn.00436874
call fcn.004343e2
add dword [esp], edx
call fcn.004397e1
call fcn.0043a1ed
call fcn.00434400
and eax, eax
je 0x4241a5
push 0x134
call fcn.00432f10
jmp 0x424200
push 0x135
call fcn.00432f10
push 0x136
call fcn.00432f10
mov ebx, dword [esp + 0x10]
inc ebx
mov dword [esp + 0x10], ebx
push 0x137
call fcn.00432f10
mov ebx, dword [esp + 0x10]
cmp ebx, 0xc8
jle 0x4241e7
push 0x138
call fcn.00432f10
jmp 0x40159b
push 0x139
call fcn.00432f10
push 0x13a
call fcn.00432f10
jmp 0x424106
push 0x13b
call fcn.00432f10
push dword [esp + 0x24]
call fcn.00418991
push 0x13b
call fcn.00433063
push 0x13d
call fcn.00432f10
push edx
call fcn.0043fe60
pop edx
push eax
push 0
push edx
call fcn.0043fe60
pop edx
push eax
call fcn.00424bf0
push 0x13d
call fcn.00433063
mov edx, str.ntdll.dll
push edx
call fcn.0043ff60
call fcn.004343e2
add dword [esp], edx
call fcn.00439909
call fcn.0043a212
call fcn.00434400
mov dword [esp + 0x2c], eax
push 0x13e
call fcn.00432f10
mov ebx, dword [esp + 0x2c]
and ebx, ebx
jne 0x4242a2
push 0x13f
call fcn.00432f10
mov eax, str.2018_4_12_07:34:22
push eax
mov eax, str._yyyy__mm__dd__hh:_ii:_ss
push eax
call fcn.0043bee3
mov dword [esp + 0x2c], eax
push 0x140
call fcn.00432f10
push 0x141
call fcn.00432f10
push dword [esp + 0x2c]
push 0
push dword [esp + 0x2c]
call fcn.0043997e
call fcn.0043a2b6
push 0x142
call fcn.00432f10
push dword [esp + 0x2c]
push 1
push dword [esp + 0x2c]
call fcn.0043997e
call fcn.0043a2b6
push 0x143
call fcn.00432f10
push dword [esp + 0x2c]
push 2
push dword [esp + 0x2c]
call fcn.0043997e
call fcn.0043a2b6
push 0x145
call fcn.00432f10
push edx
call fcn.0043fe60
pop edx
push eax
call fcn.0042c3bd
push 0x145
call fcn.00433063
lea eax, [0x4c1dd4]
push eax
call fcn.0043fea0
push 0x146
call fcn.00432f10
mov edx, dword [esp + 0x24]
push edx
call fcn.0043fe60
pop edx
push eax
push edx
call fcn.0043ff60
mov edx, 0x4ac274
push edx
call fcn.0043ff60
mov edx, dword [0x4c1dd4]
push edx
call fcn.0043ff60
lea eax, [esp + 0x28]
push eax
call fcn.0043fea0
push 0x147
call fcn.00432f10
push edx
call fcn.0043fe60
pop edx
push eax
push dword [0x4c1dd4]
call fcn.00440fa0
add esp, 4
call fcn.00434400
push 0x148
call fcn.00432f10
push edx
call fcn.0043fe60
pop edx
push eax
push dword [esp + 0xc]
call fcn.00440fa0
add esp, 4
call fcn.00434400
push 0x149
call fcn.00432f10
push edx
call fcn.0043fe60
pop edx
push eax
push dword [esp + 0x10]
call fcn.00440fa0
add esp, 4
call fcn.00434400
push 0x14b
call fcn.00432f10
push 2
push 0
push 0
call sub.ADVAPI32.dll_OpenSCManagerW
push 0x14b
call fcn.00433063
mov dword [esp + 0x30], eax
push 0x14c
call fcn.00432f10
cmp dword [esp + 0x30], 0
je 0x42451b
push 0x14d
call fcn.00432f10
push 0
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x38]
push eax
push 1
push 2
push 0x10
push 0xf01ff
mov eax, dword [esp + 0x30]
push eax
mov eax, dword [0x4c1dd4]
push eax
push dword [esp + 0x60]
call sub.ADVAPI32.dll_CreateServiceW
push 0x14d
call fcn.00433063
mov dword [esp + 0x34], eax
push 0x14e
call fcn.00432f10
cmp dword [esp + 0x34], 0
je 0x4244f4
push 0x14f
call fcn.00432f10
mov eax, dword [esp + 0xc]
push eax
lea ebp, [esp + 0x24]
call fcn.00432fb6
pop eax
mov dword [ebp], eax
push 0x150
call fcn.00432f10
lea eax, [esp + 0x20]
push eax
push 1
push dword [esp + 0x3c]
call sub.ADVAPI32.dll_ChangeServiceConfig2W
push 0x150
call fcn.00433063
push 0x151
call fcn.00432f10
push dword [esp + 0x34]
call sub.ADVAPI32.dll_CloseServiceHandle
push 0x151
call fcn.00433063
push 0x152
call fcn.00432f10
push 0x153
call fcn.00432f10
push dword [esp + 0x30]
call sub.ADVAPI32.dll_CloseServiceHandle
push 0x153
call fcn.00433063
push 0x154
call fcn.00432f10
push 0x156
call fcn.00432f10
push 2
push 0
push 0
call sub.ADVAPI32.dll_OpenSCManagerW
push 0x156
call fcn.00433063
mov dword [esp + 0x30], eax
push 0x157
call fcn.00432f10
cmp dword [esp + 0x30], 0
je 0x42460e
push 0x158
call fcn.00432f10
push 0xf01ff
mov eax, dword [0x4c1dd4]
push eax
push dword [esp + 0x38]
call sub.ADVAPI32.dll_OpenServiceW
push 0x158
call fcn.00433063
mov dword [esp + 0x34], eax
push 0x159
call fcn.00432f10
cmp dword [esp + 0x34], 0
je 0x4245e7
push 0x15a
call fcn.00432f10
push 0
push 0
push dword [esp + 0x3c]
call sub.ADVAPI32.dll_StartServiceW
push 0x15a
call fcn.00433063
push 0x15b
call fcn.00432f10
push dword [esp + 0x34]
call sub.ADVAPI32.dll_CloseServiceHandle
push 0x15b
call fcn.00433063
push 0x15c
call fcn.00432f10
push 0x15d
call fcn.00432f10
push dword [esp + 0x30]
call sub.ADVAPI32.dll_CloseServiceHandle
push 0x15d
call fcn.00433063
push 0x15e
call fcn.00432f10
push 0x161
call fcn.00432f10
push edx
call fcn.0043fe60
pop edx
push eax
call fcn.00424bf0
push 0x161
call fcn.00433063
mov edx, str.wostmp_
push edx
call fcn.0043ff60
lea eax, [esp + 0x3c]
push eax
call fcn.0043fea0
push 0x162
call fcn.00432f10
push dword [esp + 0x38]
call fcn.004397e2
call fcn.00439dc9
push 0x163
call fcn.00432f10
push dword [esp + 0x38]
call fcn.0040f1cf
push 0x163
call fcn.00433063
push 0x164
call fcn.00432f10
push edx
call fcn.0043fe60
pop edx
push eax
mov edx, dword [esp + 0x3c]
push edx
call fcn.0043fe60
pop edx
push eax
push edx
call fcn.0043ff60
mov edx, 0x4ac38a
push edx
call fcn.0043ff60
push 1
push closesocket
call fcn.004370f0
call fcn.004371f0
mov ebx, eax
push edx
call fcn.0043fe60
pop edx
push eax
push edx
call fcn.0043fe60
pop edx
push eax
mov eax, ebx
cdq
push edx
push eax
call fcn.00436130
pop eax
mov edx, 0x4ac38a
push edx
call fcn.0043ff60
push 1
push closesocket
call fcn.004370f0
call fcn.004371f0
mov ebx, eax
push edx
call fcn.0043fe60
pop edx
push eax
push edx
call fcn.0043fe60
pop edx
push eax
mov eax, ebx
cdq
push edx
push eax
call fcn.00436130
pop eax
call fcn.0043fff0
push edx
call fcn.0043fe60
pop edx
push eax
push edx
call fcn.0043fe60
pop edx
push eax
call fcn.00436874
call fcn.004343e2
add dword [esp], edx
call fcn.004343e2
add dword [esp + 4], edx
call fcn.0043997d
call fcn.0043a394
call fcn.00434400
push 0x165
call fcn.00432f10
jmp 0x40159b
push 0x166
call fcn.00432f10
push 0x167
call fcn.00432f10
xor eax, eax
push edx
push eax
call fcn.00440ca0
pop eax
push dword [esp + 0x2c]
call fcn.0043ff30
push dword [esp + 0x3c]
call fcn.0043ff30
push dword [esp + 0x28]
call fcn.0043ff30
push dword [esp + 0xc]
call fcn.0043ff30
push dword [esp + 0x10]
call fcn.0043ff30
pop edx
add esp, 0x3c
pop ebx
pop ebp
ret