Function at 0x413981
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x46d290]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.00413ce8
test eax, eax
je 0x4139a8
xor eax, eax
inc eax
jmp 0x413c50
push ebx
push edi
mov ebx, 0x104
lea eax, [ebp - 0x20e]
push ebx
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x413be2
cmp eax, ebx
je 0x413be2
push 0x22
pop ecx
mov word [ebp - 0x210], cx
mov word [ebp + eax*2 - 0x20e], cx
lea eax, [eax*2 + 4]
cmp eax, 0x20c
jae 0x413c5f
push 0xf003f
push edi
xor ecx, ecx
push edi
mov word [ebp + eax - 0x210], cx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x413a3f
push 0x3c
lea eax, [ebp - 0x264]
push edi
push eax
call fcn.00420c80
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
inc edi
lea ecx, [ebp - 0x264]
push edi
push 2
call fcn.0040d5ca
push 6
jmp 0x413c0d
push edi
push edi
push edi
lea eax, [ebp - 0x284]
add esi, 0x2c
push str.GxYNHBZP
push eax
call fcn.0040fe8d
pop ecx
pop ecx
mov ecx, eax
call fcn.00404f20
push eax
push edi
push edi
lea eax, [ebp - 0x210]
xor edi, edi
push eax
inc edi
push edi
push 2
push 0x10
push 0xf01ff
push esi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea ecx, [ebp - 0x284]
mov esi, eax
call fcn.00404a45
test esi, esi
jne 0x413af8
push 0x3c
lea eax, [ebp - 0x264]
push esi
push eax
call fcn.00420c80
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push 2
lea ecx, [ebp - 0x264]
call fcn.0040d5ca
push 5
pop eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x264]
push eax
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x264], 0x458228
mov dword [ebp - 0x234], 3
call fcn.00416e9d
pop ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x413c41
mov eax, 0xea60
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x214], eax
xor eax, eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x278]
push eax
push 2
push esi
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x278], 0x3c
mov dword [ebp - 0x26c], 3
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x413bd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x3c
lea eax, [ebp - 0x264]
push 0
push eax
call fcn.00420c80
add esp, 0xc
lea ecx, [ebp - 0x264]
push edi
push 2
call fcn.0040d5ca
push 3
pop eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x264]
push eax
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x264], 0x458228
call fcn.00416e9d
pop ecx
lea ecx, [ebp - 0x264]
call fcn.0040dc3a
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov eax, edi
jmp 0x413c4e
push 0x3c
lea eax, [ebp - 0x264]
push edi
push eax
call fcn.00420c80
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
lea ecx, [ebp - 0x264]
inc edi
push edi
push 2
call fcn.0040d5ca
push 7
pop eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x264]
push eax
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x264], 0x458228
mov dword [ebp - 0x234], 3
call fcn.00416e9d
pop ecx
lea ecx, [ebp - 0x264]
call fcn.0040dc3a
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00421ac3
mov esp, ebp
pop ebp
ret
call fcn.0041ebd7
int3