Function at 0x410035
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1854
call fcn.0044f6d0
mov eax, dword [0x4a3070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.0041c10e
test eax, eax
je 0x4100a0
push str.__s._d_
lea eax, [ebp - 0x1418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x800
push str.x64_system_allowed_x64_service_only
lea eax, [ebp - 0x1418]
push eax
call dword [sym.imp.SHLWAPI.dll_StrNCatW]
push 0x4f
push str..pohost.cpp
lea eax, [ebp - 0x1418]
push eax
push 0
call sym.gxbus32.exe_E7248975
add esp, 0x10
xor eax, eax
jmp 0x41049b
xor eax, eax
mov edi, 0x206
xor esi, esi
push edi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push esi
push eax
mov dword [ebp - 0x182c], esi
call fcn.00444cd0
add esp, 0xc
xor eax, eax
push edi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push esi
push eax
call fcn.00444cd0
add esp, 0xc
mov edi, 0x104
push edi
lea eax, [ebp - 0x418]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push 0x4b75a0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.__s._d_
lea eax, [ebp - 0x1418]
push eax
call ebx
mov edi, dword [sym.imp.SHLWAPI.dll_StrNCatW]
push 0x800
push str.install__s__s
lea eax, [ebp - 0x1418]
push eax
call edi
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x58
push str..pohost.cpp
lea eax, [ebp - 0x1418]
push eax
push esi
call sym.gxbus32.exe_E7248971
add esp, 0x18
push 2
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x1834], eax
cmp eax, esi
jne 0x4101ba
push str.__s._d_
lea eax, [ebp - 0x1418]
push eax
call ebx
push 0x800
push str.OpenSCManager_failed:__d
lea eax, [ebp - 0x1418]
push eax
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5d
push str..pohost.cpp
lea eax, [ebp - 0x1418]
push eax
push esi
call sym.gxbus32.exe_E7248975
add esp, 0x14
jmp 0x410099
mov edi, dword [sym.imp.SHLWAPI.dll_StrNCatW]
xor esi, esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x418]
push eax
push 1
push 2
push 0x110
push 0xf01ff
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x1834]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x1830], eax
cmp eax, esi
jne 0x4102e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1830], eax
cmp eax, 0x430
jne 0x4103c8
mov esi, 0x48ff54
call fcn.0041cf53
mov esi, 0x48ff6c
call fcn.0041cf53
mov esi, 0x48ff84
call fcn.0041cf53
mov esi, 0x48ff9c
call fcn.0041cf53
push str.__s._d_
lea eax, [ebp - 0x1418]
push eax
call ebx
push 0x800
push str.marked_for_delete__terminate_and_retry_later
lea eax, [ebp - 0x1418]
push eax
call dword [sym.imp.SHLWAPI.dll_StrNCatW]
push 0x8b
push str..pohost.cpp
lea eax, [ebp - 0x1418]
push eax
push 0
call sym.gxbus32.exe_E7248975
add esp, 0x10
inc dword [ebp - 0x182c]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x182c], 5
jle 0x4101b2
push str.__s._d_
lea eax, [ebp - 0x1418]
push eax
call ebx
push 0x800
push str.retry_failed__s__s
lea eax, [ebp - 0x1418]
push eax
call dword [sym.imp.SHLWAPI.dll_StrNCatW]
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x63
push str..pohost.cpp
lea eax, [ebp - 0x1418]
push eax
push 0
call sym.gxbus32.exe_E7248971
add esp, 0x18
jmp 0x410099
xor eax, eax
push 0x40e
mov word [ebp - 0x1828], ax
lea eax, [ebp - 0x1826]
push esi
push eax
call fcn.00444cd0
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x1828]
push eax
call ebx
lea eax, [ebp - 0x1828]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push 0x48ff3c
lea eax, [ebp - 0x1828]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x1828]
mov dword [ebp - 0x1848], eax
lea eax, [ebp - 0x183c]
mov dword [ebp - 0x1840], eax
lea eax, [ebp - 0x1850]
push eax
push 2
push dword [ebp - 0x1830]
mov dword [ebp - 0x183c], 3
mov dword [ebp - 0x1838], esi
mov dword [ebp - 0x1850], 0x3c
mov dword [ebp - 0x184c], esi
mov dword [ebp - 0x1844], 1
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov edi, 0x48ff44
call fcn.0041b72e
mov edi, eax
lea eax, [ebp - 0x182c]
push eax
push 1
push dword [ebp - 0x1830]
mov dword [ebp - 0x182c], edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push edi
call fcn.0041b75b
push dword [ebp - 0x1830]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [sym.imp.SHLWAPI.dll_StrNCatW]
jmp 0x410441
cmp eax, 0x431
push str.__s._d_
lea eax, [ebp - 0x1418]
push eax
jne 0x41040c
call ebx
push 0x800
push str.service_already_exists
lea eax, [ebp - 0x1418]
push eax
call edi
push 0x91
push str..pohost.cpp
lea eax, [ebp - 0x1418]
push eax
push esi
call sym.gxbus32.exe_E7248971
add esp, 0x10
jmp 0x410441
call ebx
push 0x800
push str.CreateServiceW_error:__d
lea eax, [ebp - 0x1418]
push eax
call edi
push dword [ebp - 0x1830]
lea eax, [ebp - 0x1418]
push 0x93
push str..pohost.cpp
push eax
push esi
call sym.gxbus32.exe_E7248975
add esp, 0x14
push dword [ebp - 0x1834]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push str.__s._d_
lea eax, [ebp - 0x1418]
push eax
call ebx
push 0x800
push str.Install_succeeded__start_now:__s
lea eax, [ebp - 0x1418]
push eax
call edi
lea eax, [ebp - 0x210]
push eax
push 0x99
push str..pohost.cpp
lea eax, [ebp - 0x1418]
push eax
push esi
call sym.gxbus32.exe_E7248975
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
call fcn.0041e0e3
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044302b
leave
ret