Function at 0x422770
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ff3c
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x4411c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x74]
cmp dword [eax], 0
jne 0x4227be
push str.the_SCM_handl_is_NULL.
call fcn.0042a070
add esp, 4
xor al, al
jmp 0x422a17
mov ecx, dword [ebp - 0x74]
add ecx, 8
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00401320
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x74]
add ecx, 8
call fcn.004014a0
push eax
push str.Binary_is___s_
call fcn.0042a0d0
add esp, 8
lea edx, [ebp - 0x2c]
push edx
push 0x438e20
lea eax, [ebp - 0x50]
push eax
call fcn.00404640
add esp, 0xc
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x78]
mov dword [ebp - 0x7c], ecx
mov byte [ebp - 4], 1
push 0x438e1c
mov edx, dword [ebp - 0x7c]
push edx
lea eax, [ebp - 0x6c]
push eax
call fcn.00403570
add esp, 0xc
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x84], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x84]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00401380
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6c]
call fcn.00401360
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.00401360
push str.___service
lea ecx, [ebp - 0x2c]
call fcn.004013e0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
push str.RPCSS
push 0
push 0
lea ecx, [ebp - 0x2c]
call fcn.004014a0
push eax
push 1
push 2
push 0x110
push 0xf01ff
mov ecx, 0x44342c
call fcn.004014a0
push eax
mov ecx, 0x44342c
call fcn.004014a0
push eax
mov eax, dword [ebp - 0x74]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov edx, dword [ebp - 0x74]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x74]
cmp dword [eax + 4], 0
jne 0x422949
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
push ecx
mov ecx, 0x44342c
call fcn.004014a0
push eax
push str.error_happens_during_creating_a_service_:_s.Error_Code:_d.
call fcn.0042a070
add esp, 0xc
cmp dword [ebp - 0x30], 0x431
jne 0x42292e
mov ecx, dword [ebp - 0x74]
call fcn.00422430
movzx edx, al
test edx, edx
je 0x42292e
push str.startService_successfully.
call fcn.0042a0d0
add esp, 4
mov byte [ebp - 0x6d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00401360
mov al, byte [ebp - 0x6d]
jmp 0x422a17
mov byte [ebp - 0x6e], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00401360
mov al, byte [ebp - 0x6e]
jmp 0x422a17
mov dword [ebp - 0x34], str.Service_for_runing_Mobile_applications_autorun.
lea eax, [ebp - 0x34]
push eax
push 1
mov ecx, dword [ebp - 0x74]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
test eax, eax
jne 0x42297d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ChangeServiceConfig2_failed__errno___d
call fcn.0042a070
add esp, 8
jmp 0x42298e
mov eax, dword [ebp - 0x34]
push eax
push str.service_descpition_is___s_
call fcn.0042a0d0
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
mov ecx, dword [ebp - 0x74]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x4229e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
push eax
mov ecx, 0x44342c
call fcn.004014a0
push eax
push str.error_happens_during_starting_a_service:_s.Error_Code:_d
call fcn.0042a070
add esp, 0xc
mov byte [ebp - 0x6f], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00401360
mov al, byte [ebp - 0x6f]
jmp 0x422a17
mov ecx, dword [ebp - 0x74]
add ecx, 8
call fcn.004014a0
push eax
push str.Install_service_:_s_successfully.
call fcn.0042a0d0
add esp, 8
mov byte [ebp - 0x70], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00401360
mov al, byte [ebp - 0x70]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00407a6c
mov esp, ebp
pop ebp
ret