Function at 0x413ea0
Capabilities:
Accept command line arguments
Acquire debug privileges
Check mutex and terminate process on windows
Check mutex on windows
Create service
Modify service
Persist via windows service
Start service
Stop service
Terminate process

Disassembly:
sub esp, 0x5e4
push ebx
push ebp
push esi
push edi
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x104
mov dword [0x4462cc], eax
mov eax, dword [0x4462cc]
push 0x446dc0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x446dc0
push 0x4330a0
call edi
mov ax, word [0x446dc0]
or edx, 0xffffffff
xor ecx, ecx
test ax, ax
je 0x413f1f
movzx esi, ax
lea ecx, [ecx]
movzx eax, si
cmp eax, 0x2f
je 0x413f0d
cmp eax, 0x5c
jne 0x413f0f
mov edx, ecx
movzx eax, word [ecx*2 + 0x446dc2]
inc ecx
mov esi, eax
test ax, ax
jne 0x413f00
inc edx
test edx, edx
jle 0x413f2e
xor eax, eax
mov word [edx*2 + 0x446dc0], ax
mov cl, byte [0x4330a0]
or edx, 0xffffffff
or esi, 0xffffffff
xor eax, eax
test cl, cl
je 0x413f5c
test edx, edx
je 0x413f58
cmp cl, 0x2e
jne 0x413f4b
mov esi, eax
mov cl, byte [eax*2 + 0x4330a2]
inc eax
dec edx
test cl, cl
jne 0x413f40
test esi, esi
jns 0x413f5f
lea esi, [eax - 1]
push 0x416a28
lea eax, [esi*2 + 0x4330a2]
push eax
call edi
push 1
push 0x40fb50
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x4467d4
call esi
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
call fcn.00412a30
call esi
push eax
push str.SeDebugPrivilege
push 1
call fcn.004014c0
call esi
push eax
push str.SeCreateGlobalPrivilege
push 1
call fcn.004014c0
push str.Global_Injector_v1.0
push 0
call fcn.004010c0
push 0x416a0e
push 0
call fcn.004010c0
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0
push 0x2222
push 0
push eax
call fcn.0040e120
mov edx, eax
movzx ecx, word [edx]
test cx, cx
je 0x414147
movzx eax, cx
lea edi, [esp + 0x64]
mov esi, eax
test ax, ax
je 0x414019
mov ecx, eax
movzx esi, cx
cmp cx, 0x20
ja 0x414019
movzx eax, word [edx + 2]
add edx, 2
mov ecx, eax
mov esi, eax
test ax, ax
jne 0x414000
movzx ebp, si
cmp si, 0x22
jne 0x414025
add edx, 2
movzx eax, word [edx]
or ecx, 0xffffffff
test ax, ax
je 0x414063
xor ebx, ebx
mov esi, eax
cmp ebp, 0x22
sete bl
lea ebx, [ebx*2 + 0x20]
movzx eax, si
cmp eax, ebx
je 0x414063
mov eax, ecx
dec ecx
test eax, eax
je 0x414063
movzx eax, word [edx + 2]
add edx, 2
mov word [edi], si
add edi, 2
mov esi, eax
test ax, ax
jne 0x414041
xor eax, eax
mov word [edi], ax
movzx eax, word [edx]
test ax, ax
je 0x414073
add edx, 2
or ebx, 0xffffffff
xor ecx, ecx
jmp 0x414080
movzx esi, word [esp + ecx*2 + 0x64]
movsx edi, byte [ecx + 0x416a74]
mov eax, esi
or eax, edi
je 0x4140ca
test edi, edi
je 0x41411d
movzx edi, di
lea eax, [edi - 0x41]
cmp ax, 0x19
ja 0x4140ac
lea eax, [edi + 0x20]
movzx edi, ax
lea eax, [esi - 0x41]
cmp ax, 0x19
ja 0x4140bd
lea eax, [esi + 0x20]
movzx eax, ax
jmp 0x4140bf
mov eax, esi
inc ecx
cmp di, ax
jne 0x4140cc
sub ebx, 1
jne 0x414080
xor ecx, ecx
test ecx, ecx
je 0x4142f0
or ebx, 0xffffffff
xor ecx, ecx
lea esp, [esp]
movzx esi, word [esp + ecx*2 + 0x64]
movsx edi, byte [ecx + 0x416af8]
mov eax, esi
or eax, edi
je 0x41412f
test edi, edi
je 0x4141bc
movzx edi, di
lea eax, [edi - 0x41]
cmp ax, 0x19
ja 0x41410c
lea eax, [edi + 0x20]
movzx edi, ax
lea eax, [esi - 0x41]
cmp ax, 0x19
ja 0x414122
lea eax, [esi + 0x20]
movzx eax, ax
jmp 0x414124
or ecx, 0xffffffff
jmp 0x4140cc
mov eax, esi
inc ecx
cmp di, ax
jne 0x414131
sub ebx, 1
jne 0x4140e0
xor ecx, ecx
test ecx, ecx
je 0x4141c4
movzx eax, word [edx]
mov ecx, eax
test ax, ax
jne 0x413ff0
push 0x416a0e
push 0
call fcn.004010c0
push str._I:_Install_as_a_service
push 0
call fcn.004010c0
push str._U:_Uninstall_the_service
push 0
call fcn.004010c0
push 0x416a0e
push 0
call fcn.004010c0
push 0x4464d0
lea eax, [esp + 0x108]
push str.Global_ls
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x2c
lea eax, [esp + 0xe4]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x414462
cmp eax, 5
jmp 0x414467
or ecx, 0xffffffff
jmp 0x414131
push 0x104
lea eax, [esp + 0x3f0]
mov dword [esp + 0x1c], 0xffffffff
push eax
mov eax, dword [0x4462cc]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov byte [esp + 0x20], 0
mov dword [esp + 0x2c], 0
call eax
push 0xf003f
push 0
push 0
mov dword [esp + 0x50], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x414220
call edi
mov esi, dword [esp + 0x20]
jmp 0x41426e
push 0xf01ff
push 0x4463d0
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [esp + 0x20], esi
test esi, esi
je 0x41426c
push 0x4463d0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x404]
push eax
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x41428b
lea ecx, [esp + 0x14]
call fcn.0040f820
call edi
test eax, eax
je 0x41428b
push eax
push str.Uninstall:_OpenService_failed_with__u_
push str.SysMain
call fcn.004010c0
lea ecx, [esp + 0x20]
jmp 0x414452
lea eax, [esp + 0x48]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4142b9
call edi
test eax, eax
je 0x4142b9
push eax
push str.StopService_failed_with__u_
push 0
call fcn.004010c0
lea ecx, [esp + 0x20]
jmp 0x414452
lea ecx, [esp + 0x14]
call fcn.004134a0
test eax, eax
je 0x4142d6
push eax
push str.RemoveService_failed_with__u_
push 0
call fcn.004010c0
add esp, 0xc
push 0x4463d0
push str.The_Service__ls_has_been_stopped_and_removed.
push 0
call fcn.004010c0
lea ecx, [esp + 0x20]
jmp 0x414452
push 0x104
lea eax, [esp + 0x1e8]
mov dword [esp + 0x2c], 0xffffffff
push eax
mov eax, dword [0x4462cc]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov byte [esp + 0x30], 0
mov dword [esp + 0x3c], 0
call eax
push 0xf003f
push 0
push 0
mov dword [esp + 0x1c], 0x4465d0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [esp + 0x2c], ebx
test ebx, ebx
jne 0x414351
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov esi, dword [esp + 0x30]
jmp 0x414406
push 0xf01ff
push 0x4463d0
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 0x30], esi
test esi, esi
jne 0x4143d3
call edi
cmp eax, 0x424
jne 0x414406
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1f8]
push eax
push 1
push 2
push 0x10
push 0xf01ff
push 0x4463d0
push 0x4463d0
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
mov dword [esp + 0x30], esi
test esi, esi
je 0x414404
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4143d3
cmp word [eax], 0
je 0x4143d3
lea eax, [esp + 0x10]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push 0x4463d0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1fc]
push eax
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x414417
lea ecx, [esp + 0x24]
call fcn.0040f820
call edi
test eax, eax
je 0x414417
push eax
push str.Install:_CreateService_failed_with__u_
push str.SysMain
jmp 0x414449
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x41443d
call edi
cmp eax, 0x420
je 0x41443d
call edi
test eax, eax
je 0x41443d
push eax
push str.StartService_failed_with__u_
jmp 0x414447
push 0x4463d0
push str.The_Service__ls_has_been_created_and_started.
push 0
call fcn.004010c0
lea ecx, [esp + 0x30]
add esp, 0xc
call fcn.0040f3d0
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 0xb7
sete al
test al, al
je 0x414485
push str.Another_instance_is_already_running_
push 0
call fcn.004010c0
add esp, 8
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x416a0e
push eax
mov dword [esp + 0x3c], 0x413710
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x4144ef
call fcn.00411080
test al, al
je 0x4144da
push str.Waiting...
push 0
call fcn.004010c0
add esp, 8
push 0xffffffffffffffff
push dword [0x4467ec]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.00410f40
mov eax, dword [0x4467f0]
test eax, eax
je 0x4144ef
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]