Function at 0x512e25
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push ebp
push ebx
mov edx, 0xf
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x512e2c
call fcn.00408600
push esp
push 0xcb
call fcn.00409350
add esp, 8
push 0x117
call fcn.00521f18
push 0x119
call fcn.00521f18
mov ebx, dword [esp + 0x14]
imul ebx, dword [esp + 0x14]
mov dword [esp + 0x14], ebx
push 0x11a
call fcn.00521f18
push 0x30
call fcn.004f540f
push 0x11a
call fcn.00522048
push 0x11b
call fcn.00521f18
mov ebx, dword [0x4d7bf8]
cmp ebx, 2
jle 0x512f76
push 0x11c
call fcn.00521f18
mov ebx, dword [esp]
imul ebx, dword [esp]
mov dword [esp], ebx
push 0x11d
call fcn.00521f18
push 1
push dword [0x4d7bf8]
call fcn.00403680
call fcn.004038c0
mov dword [esp], eax
push 0x11e
call fcn.00521f18
mov ebx, dword [esp]
mov eax, ebx
mov edx, dword [0x4c30bc]
mov edx, dword [edx - 8]
call fcn.00521fbb
mov ebp, dword [0x4c30bc]
imul ebx, ebx, 0xc
add ebp, ebx
call fcn.00521fa1
mov edx, dword [ebp + 4]
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408640
lea eax, [esp + 0xc]
push eax
call fcn.00408560
push 0x11f
call fcn.00521f18
mov ebx, dword [esp]
mov eax, ebx
mov edx, dword [0x4c30bc]
mov edx, dword [edx - 8]
call fcn.00521fbb
mov ebp, dword [0x4c30bc]
imul ebx, ebx, 0xc
add ebp, ebx
call fcn.00521fa1
mov edx, dword [ebp + 8]
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408640
lea eax, [esp + 0x10]
push eax
call fcn.00408560
push 0x120
call fcn.00521f18
jmp 0x512fb0
push 0x120
call fcn.00521f18
push 0x121
call fcn.00521f18
mov edx, str.Health_Key_Authentication_Protocol
lea ecx, [esp + 8]
call fcn.004011b8
push 0x122
call fcn.00521f18
mov edx, 0x4c392c
lea ecx, [esp + 0xc]
call fcn.004011b8
push 0x123
call fcn.00521f18
push 0x128
call fcn.00521f18
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408730
pop edx
push eax
call fcn.00401e80
call fcn.00403036
call fcn.004011f2
add dword [esp], edx
call fcn.00402150
call fcn.004011f2
add dword [esp], edx
call fcn.00401e80
call fcn.00402b20
lea eax, [esp + 0x2c]
push eax
call fcn.00408560
push 0x129
call fcn.00521f18
push dword [esp + 0x28]
mov edx, 0x4c31a6
pop ecx
call fcn.00401230
jne 0x5130d2
push 0x12a
call fcn.00521f18
mov edx, dword [esp + 0x28]
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408640
lea eax, [0x4d7bb8]
push eax
call fcn.00408560
push 0x12b
call fcn.00521f18
mov eax, dword [0x4d7bb8]
push eax
lea ebp, [esp + 0x1c]
call fcn.00521fa1
pop eax
mov dword [ebp], eax
push 0x12c
call fcn.00521f18
lea eax, [0x51c5e6]
push eax
call fcn.00521fa1
pop eax
mov dword [ebp + 4], eax
push 0x12d
call fcn.00521f18
lea eax, [esp + 0x18]
push eax
call sub.ADVAPI32.dll_StartServiceCtrlDispatcherW
push 0x12d
call fcn.00522048
push 0x12e
call fcn.00521f18
jmp 0x513772
push 0x12e
call fcn.00521f18
push 0x12f
call fcn.00521f18
call fcn.00508bf5
push 0x12f
call fcn.00522048
push 0x130
call fcn.00521f18
mov dword [esp + 0x10], 0
push 0x131
call fcn.00521f18
push 0x132
call fcn.00521f18
push edx
call fcn.00408730
pop edx
push eax
call fcn.00513bfa
push 0x132
call fcn.00522048
push edx
call fcn.00408730
pop edx
push eax
call fcn.004f4278
push 0x132
call fcn.00522048
pop eax
lea eax, [esp + 0x28]
push eax
call fcn.00408560
push 0x133
call fcn.00521f18
push edx
call fcn.00408730
pop edx
push eax
push dword [esp + 0x28]
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408730
pop edx
push eax
call fcn.00402e7d
call fcn.004011f2
add dword [esp], edx
call fcn.00401e80
call fcn.00405516
call fcn.00401220
and eax, eax
je 0x5131a6
push 0x134
call fcn.00521f18
jmp 0x513201
push 0x135
call fcn.00521f18
push 0x136
call fcn.00521f18
mov ebx, dword [esp + 0x10]
inc ebx
mov dword [esp + 0x10], ebx
push 0x137
call fcn.00521f18
mov ebx, dword [esp + 0x10]
cmp ebx, 0xc8
jle 0x5131e8
push 0x138
call fcn.00521f18
jmp 0x4f05ad
push 0x139
call fcn.00521f18
push 0x13a
call fcn.00521f18
jmp 0x513107
push 0x13b
call fcn.00521f18
push dword [esp + 0x24]
call fcn.00507993
push 0x13b
call fcn.00522048
push 0x13d
call fcn.00521f18
push edx
call fcn.00408730
pop edx
push eax
push 0
push edx
call fcn.00408730
pop edx
push eax
call fcn.00513bfa
push 0x13d
call fcn.00522048
mov edx, str.ntdll.dll
push edx
call fcn.00408640
call fcn.004011f2
add dword [esp], edx
call fcn.0040567f
call fcn.00405ec5
call fcn.00401220
mov dword [esp + 0x2c], eax
push 0x13e
call fcn.00521f18
mov ebx, dword [esp + 0x2c]
and ebx, ebx
jne 0x5132a3
push 0x13f
call fcn.00521f18
mov eax, str.2018_4_12_07:34:22
push eax
mov eax, str._yyyy__mm__dd__hh:_ii:_ss
push eax
call fcn.004070fa
mov dword [esp + 0x2c], eax
push 0x140
call fcn.00521f18
push 0x141
call fcn.00521f18
mov eax, dword [esp + 0x2c]
cdq
push edx
push eax
push 0
push dword [esp + 0x30]
call fcn.004056f2
call fcn.004060cd
push 0x142
call fcn.00521f18
mov eax, dword [esp + 0x2c]
cdq
push edx
push eax
push 1
push dword [esp + 0x30]
call fcn.004056f2
call fcn.004060cd
push 0x143
call fcn.00521f18
mov eax, dword [esp + 0x2c]
cdq
push edx
push eax
push 2
push dword [esp + 0x30]
call fcn.004056f2
call fcn.004060cd
push 0x145
call fcn.00521f18
push edx
call fcn.00408730
pop edx
push eax
call fcn.0051b3c5
push 0x145
call fcn.00522048
lea eax, [0x4d7bb8]
push eax
call fcn.00408560
push 0x146
call fcn.00521f18
mov edx, dword [esp + 0x24]
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408640
mov edx, 0x4c3270
push edx
call fcn.00408640
mov edx, dword [0x4d7bb8]
push edx
call fcn.00408640
lea eax, [esp + 0x28]
push eax
call fcn.00408560
push 0x147
call fcn.00521f18
push edx
call fcn.00408730
pop edx
push eax
push dword [0x4d7bb8]
call fcn.00409140
add esp, 4
call fcn.00401220
push 0x148
call fcn.00521f18
push edx
call fcn.00408730
pop edx
push eax
push dword [esp + 0xc]
call fcn.00409140
add esp, 4
call fcn.00401220
push 0x149
call fcn.00521f18
push edx
call fcn.00408730
pop edx
push eax
push dword [esp + 0x10]
call fcn.00409140
add esp, 4
call fcn.00401220
push 0x14b
call fcn.00521f18
push 2
push 0
push 0
call sub.ADVAPI32.dll_OpenSCManagerW
push 0x14b
call fcn.00522048
mov dword [esp + 0x30], eax
push 0x14c
call fcn.00521f18
cmp dword [esp + 0x30], 0
je 0x513525
push 0x14d
call fcn.00521f18
push 0
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x38]
push eax
push 1
push 2
push 0x10
push 0xf01ff
mov eax, dword [esp + 0x30]
push eax
mov eax, dword [0x4d7bb8]
push eax
push dword [esp + 0x60]
call sub.ADVAPI32.dll_CreateServiceW
push 0x14d
call fcn.00522048
mov dword [esp + 0x34], eax
push 0x14e
call fcn.00521f18
cmp dword [esp + 0x34], 0
je 0x5134fe
push 0x14f
call fcn.00521f18
mov eax, dword [esp + 0xc]
push eax
lea ebp, [esp + 0x24]
call fcn.00521fa1
pop eax
mov dword [ebp], eax
push 0x150
call fcn.00521f18
lea eax, [esp + 0x20]
push eax
push 1
push dword [esp + 0x3c]
call sub.ADVAPI32.dll_ChangeServiceConfig2W
push 0x150
call fcn.00522048
push 0x151
call fcn.00521f18
push dword [esp + 0x34]
call sub.ADVAPI32.dll_CloseServiceHandle
push 0x151
call fcn.00522048
push 0x152
call fcn.00521f18
push 0x153
call fcn.00521f18
push dword [esp + 0x30]
call sub.ADVAPI32.dll_CloseServiceHandle
push 0x153
call fcn.00522048
push 0x154
call fcn.00521f18
push 0x156
call fcn.00521f18
push 2
push 0
push 0
call sub.ADVAPI32.dll_OpenSCManagerW
push 0x156
call fcn.00522048
mov dword [esp + 0x30], eax
push 0x157
call fcn.00521f18
cmp dword [esp + 0x30], 0
je 0x513618
push 0x158
call fcn.00521f18
push 0xf01ff
mov eax, dword [0x4d7bb8]
push eax
push dword [esp + 0x38]
call sub.ADVAPI32.dll_OpenServiceW
push 0x158
call fcn.00522048
mov dword [esp + 0x34], eax
push 0x159
call fcn.00521f18
cmp dword [esp + 0x34], 0
je 0x5135f1
push 0x15a
call fcn.00521f18
push 0
push 0
push dword [esp + 0x3c]
call sub.ADVAPI32.dll_StartServiceW
push 0x15a
call fcn.00522048
push 0x15b
call fcn.00521f18
push dword [esp + 0x34]
call sub.ADVAPI32.dll_CloseServiceHandle
push 0x15b
call fcn.00522048
push 0x15c
call fcn.00521f18
push 0x15d
call fcn.00521f18
push dword [esp + 0x30]
call sub.ADVAPI32.dll_CloseServiceHandle
push 0x15d
call fcn.00522048
push 0x15e
call fcn.00521f18
push 0x161
call fcn.00521f18
push edx
call fcn.00408730
pop edx
push eax
call fcn.00513bfa
push 0x161
call fcn.00522048
mov edx, str.wostmp_
push edx
call fcn.00408640
lea eax, [esp + 0x3c]
push eax
call fcn.00408560
push 0x162
call fcn.00521f18
push dword [esp + 0x38]
call fcn.00401e80
call fcn.0040570d
push 0x163
call fcn.00521f18
push dword [esp + 0x38]
call fcn.004fe1e1
push 0x163
call fcn.00522048
push 0x164
call fcn.00521f18
push edx
call fcn.00408730
pop edx
push eax
mov edx, dword [esp + 0x3c]
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408640
mov edx, 0x4c3386
push edx
call fcn.00408640
push 1
push closesocket
call fcn.00403680
call fcn.004038c0
mov ebx, eax
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408730
pop edx
push eax
mov eax, ebx
cdq
push edx
push eax
call fcn.00402720
pop eax
mov edx, 0x4c3386
push edx
call fcn.00408640
push 1
push closesocket
call fcn.00403680
call fcn.004038c0
mov ebx, eax
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408730
pop edx
push eax
mov eax, ebx
cdq
push edx
push eax
call fcn.00402720
pop eax
call fcn.00408760
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408730
pop edx
push eax
call fcn.00402e7d
call fcn.004011f2
add dword [esp], edx
call fcn.004011f2
add dword [esp + 4], edx
call fcn.00401e80
call fcn.004060b4
call fcn.00401220
push 0x165
call fcn.00521f18
jmp 0x4f05ad
push 0x166
call fcn.00521f18
push 0x167
call fcn.00521f18
xor eax, eax
push edx
push eax
call fcn.00409480
pop eax
push dword [esp + 0x2c]
call fcn.00408690
push dword [esp + 0x3c]
call fcn.00408690
push dword [esp + 0x28]
call fcn.00408690
push dword [esp + 0xc]
call fcn.00408690
push dword [esp + 0x10]
call fcn.00408690
pop edx
add esp, 0x3c
pop ebx
pop ebp
ret