Function at 0x40d520
Capabilities:
Create service
Delete service
Modify service
Persist via windows service
Query or enumerate registry value
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x115
call fcn.00414f9a
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
je 0x40d526
push ebx
push esi
push edi
push 0xda
call fcn.004051a0
mov eax, dword [0x42f218]
mov edi, dword [eax + 0x368]
push 0xd9
call fcn.004051a0
mov ecx, dword [0x42f218]
mov eax, dword [ecx + 0x364]
mov esi, dword [ebp - 8]
add esp, 8
lea edx, [ebp - 0xc]
push edx
push 0x20019
push 0
push eax
xor bl, bl
push connect
mov byte [esi], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40d5bc
lea ecx, [ebp - 0x10]
push ecx
push esi
push 0
push 0
push edi
push eax
mov dword [ebp - 0x10], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40d5ae
mov bl, 1
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x40d5e2
push 0xd7
call fcn.004051a0
mov eax, dword [0x42f218]
mov eax, dword [eax + 0x35c]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40d5d8
push 0x115
call fcn.00414f9a
mov edi, eax
add esp, 4
test edi, edi
je 0x40d5e2
push 0xdb
call fcn.004051a0
mov ecx, dword [0x42f218]
mov ebx, dword [ecx + 0x36c]
push 0xd9
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x364]
add esp, 8
lea ecx, [ebp - 0xc]
push ecx
push 0x20019
push 0
push eax
push connect
mov byte [ebp - 1], 0
mov byte [edi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40d678
lea edx, [ebp - 0x10]
push edx
push edi
push 0
push 0
push ebx
push eax
mov dword [ebp - 0x10], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov bl, 1
test eax, eax
je 0x40d66a
mov bl, byte [ebp - 1]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x40d69f
push 0xd8
call fcn.004051a0
mov ecx, dword [0x42f218]
mov eax, dword [ecx + 0x360]
mov edx, edi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40d695
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x40d70c
mov edx, dword [ebp + 8]
push 0x10020
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x40d6d5
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
push 0
push 0
push 0
push 0
call fcn.0040ac70
mov ecx, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push 1
push 2
push 0x10
push 0xf01ff
push eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
jne 0x40d715
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x14]
push edx
push 1
push esi
mov dword [ebp - 0x14], edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov eax, dword [ebp - 8]
push eax
call fcn.00414f60
push edi
call fcn.00414f60
add esp, 8
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret