Function at 0x414570
Capabilities:
Access the windows event log
Create service
Persist via windows service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
push ebx
push esi
push edi
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x4145d5
push str.KaseyaAgent
push eax
mov dword [esp + 0x20], str.OpenSCManager_failed_while_attempting_to_install_Kaseya_Agent
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x4147c6
push ebx
lea eax, [esp + 0x1c]
push eax
push ebx
push 1
push ebx
push ebx
push ebx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf01ff
push str.KaseyaAgent
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x414640
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
lea edx, [esp + 0x1c]
mov dword [esp + 0x2c], ecx
push edx
mov dword [esp + 0x34], ecx
push edi
mov dword [esp + 0x3c], ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x414787
cmp dword [esp + 0x20], 4
jne 0x414787
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
call edi
push ebx
call edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.AgentMon.exe]
push eax
lea ecx, [esp + 0x144]
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_s
push ecx
mov dword [esp + 0x20], 0x104
mov byte [esp + 0x44], 0x22
call fcn.00458ee7
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x49]
push eax
lea ecx, [esp + 0x24]
push ecx
push str.Path
lea edx, [esp + 0x15c]
push edx
push 0x80000002
call fcn.00404c80
add esp, 0x24
test eax, eax
jne 0x4147b0
cmp dword [esp + 0x10], 1
jne 0x4147b0
lea eax, [esp + 0x38]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4146b8
sub eax, edx
cmp byte [esp + eax + 0x38], 0x5c
je 0x4146e1
lea edi, [esp + 0x38]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4146d0
mov ax, word [0x469b10]
mov word [edi], ax
mov eax, dword [str.AgentMon.exe]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4146e8
lea edi, [esp + 0x38]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4146f6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x38]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x414713
mov ecx, dword [0x471e18]
push 0
mov dl, byte [0x471e1c]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x4c]
push eax
push 1
push 2
push pe_nt_image_headers32
push 0xf01ff
push str.Kaseya_Agent
push str.KaseyaAgent
mov dword [edi], ecx
push ebx
mov byte [edi + 4], dl
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov edi, eax
test edi, edi
jne 0x414787
push str.CreateService_failed_while_attempting_to_install_Kaseya_Agent
push 1
call fcn.00414280
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 8
push ebx
call edi
push ebx
or esi, 0xffffffff
call edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov esi, eax
neg esi
sbb esi, esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
neg esi
dec esi
call edi
push ebx
call edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Path_to_Kaseya_Agent_was_not_found_in_the_registry._Unable_to_create_service.
push 1
call fcn.00414280
add esp, 8
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret