Function at 0x460c7c
Capabilities:
Persist via run registry key
Query service configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x460f97
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x460240]
call fcn.00460340
mov dword [ebp - 4], eax
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.004603e0
xor ecx, ecx
mov edx, 0x460fb0
mov eax, dword [ebp - 4]
call fcn.00460444
test al, al
je 0x460e01
xor ebx, ebx
push ebp
mov eax, ebx
call fcn.00460a78
pop ecx
inc ebx
cmp ebx, 5
jne 0x460cd0
xor eax, eax
push ebp
push 0x460d0d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x460fcc
mov eax, dword [ebp - 4]
call fcn.004606b8
mov edx, dword [ebp - 8]
mov dword [edx + 0x530], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x460d17
xor eax, eax
push ebp
push 0x460d45
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x460fe0
mov eax, dword [ebp - 4]
call fcn.004606b8
mov edx, dword [ebp - 8]
mov dword [edx + 0x534], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x460d4f
xor eax, eax
push ebp
push 0x460d7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x460ff4
mov eax, dword [ebp - 4]
call fcn.004606b8
mov edx, dword [ebp - 8]
mov dword [edx + 0x538], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x460d87
xor eax, eax
push ebp
push 0x460db5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x461004
mov eax, dword [ebp - 4]
call fcn.004606b8
mov edx, dword [ebp - 8]
mov dword [edx + 0x53c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x460dbf
mov eax, dword [ebp - 8]
mov byte [eax + 0x540], 0
xor eax, eax
push ebp
push 0x460df7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x461014
mov eax, dword [ebp - 4]
call fcn.004606f4
mov edx, dword [ebp - 8]
mov byte [edx + 0x540], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x460e01
mov eax, dword [ebp - 4]
call fcn.004603b0
xor ecx, ecx
mov edx, 0x461024
mov eax, dword [ebp - 4]
call fcn.00460444
test al, al
je 0x460e66
xor eax, eax
push ebp
push 0x460e44
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
mov edx, 0x46105c
mov eax, dword [ebp - 4]
call fcn.0046062c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x460e56
cmp dword [ebp - 0xc], 0
setne al
mov edx, dword [ebp - 8]
mov byte [edx + 0x541], al
mov eax, dword [ebp - 4]
call fcn.004603b0
call fcn.0045e738
test al, al
je 0x460f14
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jne 0x460e96
mov eax, dword [ebp - 8]
mov byte [eax + 0x542], 0
push 0xf01ff
push 0x461068
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
jne 0x460eb8
mov eax, dword [ebp - 8]
mov byte [eax + 0x542], 0
jmp 0x460f0c
push 0xf01ff
push 0x461068
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
jne 0x460eda
mov eax, dword [ebp - 8]
mov byte [eax + 0x542], 0
jmp 0x460f06
lea eax, [ebp - 0x10]
push eax
push 0x24
lea eax, [ebp - 0x34]
push eax
push esi
call sub.advapi32.dll_QueryServiceConfigA
cmp dword [ebp - 0x30], 2
jne 0x460efc
mov eax, dword [ebp - 8]
mov byte [eax + 0x542], 1
jmp 0x460f06
mov eax, dword [ebp - 8]
mov byte [eax + 0x542], 0
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
jmp 0x460f79
xor ecx, ecx
mov edx, 0x461080
mov eax, dword [ebp - 4]
call fcn.00460444
test al, al
je 0x460f71
xor eax, eax
push ebp
push 0x460f4f
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
mov edx, 0x4610c0
mov eax, dword [ebp - 4]
call fcn.0046062c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x460f61
cmp dword [ebp - 0xc], 0
setne al
mov edx, dword [ebp - 8]
mov byte [edx + 0x542], al
mov eax, dword [ebp - 4]
call fcn.004603b0
mov eax, dword [ebp - 4]
call fcn.004036dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460f9e
lea eax, [ebp - 0xc]
call fcn.004044cc
ret