Function at 0x406c90
Capabilities:
Create service
Delete service
Modify service
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x544
mov eax, dword [0x601018]
xor eax, esp
mov dword [esp + 0x540], eax
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
jne 0x406cf8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_80021:_unable_to_open_the_service_control_manager__error___d_
mov ecx, 0x610240
call fcn.00504670
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x540]
xor ecx, esp
call fcn.00596083
mov esp, ebp
pop ebp
ret 4
cmp byte [ebp + 8], 0
je 0x406f6f
push 0x400
lea esi, [ebx + 0xc4]
push esi
push 0
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x406d37
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_80019:_unable_to_determine_module_file_name__error___d_
mov ecx, 0x610240
call fcn.00504670
add esp, 8
cmp byte [esi], 0x22
jne 0x406d6b
test esi, esi
jne 0x406d46
call dword [sym.imp.MSVCR100.dll_abort]
lea eax, [esp + 0x148]
mov ecx, eax
sub esi, ecx
mov cl, byte [esi + eax]
test cl, cl
je 0x406d66
mov byte [eax], cl
inc eax
lea edx, [esp + 0x547]
cmp eax, edx
jb 0x406d51
mov byte [eax], 0
jmp 0x406d89
push esi
push 0x5c8194
mov esi, 0x400
lea edi, [esp + 0x150]
call fcn.00401880
mov edi, dword [esp + 0x1c]
add esp, 8
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x15c]
push eax
push 1
push 2
push 0x10
push 0xf01ff
lea esi, [ebx + 0x1114]
add ebx, 0x251c
push ebx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
xor ecx, ecx
mov dword [esp + 0x18], eax
cmp eax, ecx
jne 0x406dfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_80022:_unable_to_create_service__error___d_
mov ecx, 0x610240
call fcn.00504670
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x540]
xor ecx, esp
call fcn.00596083
mov esp, ebp
pop ebp
ret 4
mov edx, 0x493e0
mov dword [esp + 0x34], edx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x44], edx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push 2
mov edi, 1
lea ecx, [esp + 0x38]
push eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x28], 0xe10
mov dword [esp + 0x34], 3
mov dword [esp + 0x38], ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
test eax, eax
jne 0x406e69
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_80034:_unable_to_set_service_recovery_actions__error___d_
mov ecx, 0x610240
call fcn.00504670
add esp, 8
lea eax, [esp + 0x48]
mov edx, str.SYSTEMCurrentControlSetServicesEventLogApplication_
mov ecx, eax
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x406e8c
mov byte [eax], cl
add eax, edi
lea ecx, [esp + 0x147]
cmp eax, ecx
jb 0x406e76
mov byte [eax], 0
push 0x100
mov ebx, esi
lea eax, [esp + 0x4c]
call fcn.00401570
add esp, 4
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x4c]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x406edb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x4c]
push ecx
push str.ERROR_80023:_unable_to_create_registry_key___s___error___d_
mov ecx, 0x610240
call fcn.00504670
add esp, 0xc
jmp 0x406f30
mov edx, dword [esp + 0xc]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406ee4
sub eax, esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
push eax
push edx
mov edx, dword [esp + 0x18]
push 2
push 0
push str.EventMessageFile
push edx
call esi
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push str.TypesSupported
push ecx
mov dword [esp + 0x24], 7
call esi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.service_created
mov ecx, 0x610240
call fcn.00504670
mov eax, dword [esp + 0x1c]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x540]
xor ecx, esp
call fcn.00596083
mov esp, ebp
pop ebp
ret 4
push 0x10000
add ebx, 0x1114
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
jne 0x406fa9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_80024:_unable_to_open_service_handle__error___d_
mov ecx, 0x610240
call fcn.00504670
add esp, 8
jmp 0x406fe4
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x406fcf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR_80035:_unable_to_delete_service__error___d_
mov ecx, 0x610240
call fcn.00504670
add esp, 8
jmp 0x406fe1
push str.service_deleted
mov ecx, 0x610240
call fcn.00504670
add esp, 4
push esi
call ebx
push edi
call ebx
mov ecx, dword [esp + 0x54c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00596083
mov esp, ebp
pop ebp
ret 4