Function at 0x40d870
Capabilities:
Create service
Persist via windows service
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [0x46706c]
xor eax, esp
mov dword [esp + 0x224], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ecx, 0x467aa4
push 7
push str.MIG_SVC
call fcn.00403ae0
mov esi, dword [ebp + 8]
push esi
push str._INF____tmain___Service_Start___argc__d
push 0
call fcn.004024e0
add esp, 0xc
cmp esi, 1
jle 0x40db63
push dword [edi + 4]
push str._INF____tmain___argv_1___s
push 0
call fcn.004024e0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
add esp, 0xc
push str.install
push dword [edi + 4]
call esi
test eax, eax
jne 0x40d9f7
push 0x208
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0042d440
add esp, 0xc
lea eax, [esp + 0x22]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40d933
push str._ERR___SvcInstall___GetModuleFileName_Error
push eax
call fcn.004024e0
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00414dec
mov esp, ebp
pop ebp
ret
push 0xf003f
mov ecx, 0x22
push 0
mov word [esp + 0x28], cx
push 0
mov word [esp + eax*2 + 0x2e], cx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x40d97b
push str._ERR___SvcInstall___OpenSCManager_Error
push eax
call fcn.004024e0
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00414dec
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x34]
push eax
push 1
push 2
push 0x10
push 0xf01ff
push str.CMigrationService
push str.CMigrationService
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
jne 0x40d9d5
push str._ERR___SvcInstall___schService__NULL
push eax
call fcn.004024e0
add esp, 8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00414dec
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
push edi
call esi
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00414dec
mov esp, ebp
pop ebp
ret
push str.uninstall
push dword [edi + 4]
call esi
test eax, eax
jne 0x40da28
push str.sc_delete_CMigrationService
call fcn.00435191
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00414dec
mov esp, ebp
pop ebp
ret
push str.start
push dword [edi + 4]
call esi
test eax, eax
jne 0x40da51
call fcn.0040e260
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00414dec
mov esp, ebp
pop ebp
ret
push str.stop
push dword [edi + 4]
call esi
test eax, eax
jne 0x40dad8
push 0xb
push str.stopservice
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0xf
mov byte [esp + 0x10], al
call fcn.00403e30
mov edx, dword [esp + 0x1c]
cmp edx, 0x10
jb 0x40dab5
mov ecx, dword [esp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40daab
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40dbfc
push edx
push ecx
call fcn.004153c5
add esp, 8
push str.taskkill__f__fi__services_eq_CMigrationService_
call fcn.00435191
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00414dec
mov esp, ebp
pop ebp
ret
push str.triggerscheduler
push dword [edi + 4]
call esi
mov ecx, dword [edi + 4]
test eax, eax
jne 0x40db44
mov edx, ecx
lea ecx, [esp + 8]
call fcn.004033a0
mov edx, dword [esp + 0x1c]
cmp edx, 0x10
jb 0x40dbe6
mov ecx, dword [esp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40db24
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40dc01
push edx
push ecx
call fcn.004153c5
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00414dec
mov esp, ebp
pop ebp
ret
push str.admin
push ecx
call esi
movzx ecx, byte [0x46d6d0]
test eax, eax
mov edx, 1
cmove ecx, edx
mov byte [0x46d6d0], cl
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.My_Sample_Service:_Main:_Started_
call esi
cmp byte [0x46d6d0], 0
jne 0x40dbd6
lea eax, [esp + 8]
mov dword [esp + 8], str.CMigrationService
push eax
mov dword [esp + 0x10], fcn.0040dc10
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x40dbdf
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str._ERR____tmain__StartServiceCtrlDispatcher_Error___d
push 0
call fcn.004024e0
add esp, 0xc
call esi
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.00414dec
mov esp, ebp
pop ebp
ret
push 0
push 0
call fcn.0040dc10
push str.My_Sample_Service:_Main:_Exit
call esi
mov ecx, dword [esp + 0x22c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00414dec
mov esp, ebp
pop ebp
ret
call fcn.004375f1
call fcn.004375f1
int3