Function at 0x404a96
Capabilities:
Create service
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
push ebx
push edi
push str.Registering_Service...
call fcn.0040324d
mov edi, dword [ebp + 8]
mov dword [esp], str.:service.id
push edi
call fcn.0040265b
xor ebx, ebx
cmp eax, ebx
mov dword [0x40ced0], eax
jne 0x404ad9
push str.Service_ID_not_specified
call fcn.00403537
xor eax, eax
pop ecx
inc eax
jmp 0x404dcb
push str.:service.name
push edi
call fcn.0040265b
cmp eax, ebx
mov dword [ebp - 0x1c], eax
jne 0x404af2
push str.Service_name_not_specified
jmp 0x404acb
push str.:service.description
push edi
call fcn.0040265b
cmp eax, ebx
mov dword [ebp - 0x10], eax
jne 0x404b0b
push str.Service_description_not_specified
jmp 0x404acb
push esi
push str.:service.startup
push edi
mov dword [ebp - 8], 3
call fcn.0040265b
mov esi, eax
cmp esi, ebx
je 0x404bd7
push str.auto
push esi
call fcn.00406bf5
test eax, eax
pop ecx
pop ecx
jne 0x404b4f
mov dword [ebp - 8], 2
push str.Service_startup_mode:_SERVICE_AUTO_START
call fcn.0040324d
jmp 0x404bd6
push str.boot
push esi
call fcn.00406bf5
test eax, eax
pop ecx
pop ecx
jne 0x404b6a
mov dword [ebp - 8], ebx
push str.Service_startup_mode:_SERVICE_BOOT_START
jmp 0x404b45
push str.demand
push esi
call fcn.00406bf5
test eax, eax
pop ecx
pop ecx
jne 0x404b89
mov dword [ebp - 8], 3
push str.Service_startup_mode:_SERVICE_DEMAND_START
jmp 0x404b45
push str.disabled
push esi
call fcn.00406bf5
test eax, eax
pop ecx
pop ecx
jne 0x404ba8
mov dword [ebp - 8], 4
push str.Service_startup_mode:_SERVICE_DISABLED
jmp 0x404b45
push str.system
push esi
call fcn.00406bf5
test eax, eax
pop ecx
pop ecx
jne 0x404bca
mov dword [ebp - 8], 1
push str.Service_startup_mode:_SERVICE_SYSTEM_START
jmp 0x404b45
push esi
push str.Unrecognized_service_startup_mode:__s
call fcn.00403518
pop ecx
pop ecx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x634]
push eax
push str.:service.dependency
push edi
mov dword [ebp - 0xc], ebx
call fcn.00402771
xor esi, esi
xor edi, edi
cmp dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
jle 0x404c6d
push dword [ebp + edi*4 - 0x634]
call fcn.00406c18
inc edi
cmp edi, dword [ebp - 0xc]
pop ecx
lea esi, [esi + eax + 1]
jl 0x404bfc
cmp esi, ebx
jle 0x404c6d
push esi
call fcn.00404630
cmp eax, ebx
pop ecx
mov dword [ebp - 0x14], eax
jne 0x404c38
push str.Could_not_create_dependency_list
call fcn.00403537
xor eax, eax
pop ecx
inc eax
jmp 0x404dca
cmp dword [ebp - 0xc], ebx
mov esi, eax
mov dword [ebp - 4], ebx
jle 0x404c6d
mov edi, dword [ebp - 4]
lea edi, [ebp + edi*4 - 0x634]
push dword [edi]
push esi
call fcn.00406be0
push dword [edi]
call fcn.00406c18
add esp, 0xc
inc dword [ebp - 4]
lea esi, [esi + eax + 1]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jl 0x404c42
push str.:service.loadordergroup
push dword [ebp + 8]
call fcn.0040265b
push str.:service.user
push dword [ebp + 8]
mov esi, eax
call fcn.0040265b
push str.:service.password
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.0040265b
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x224]
push eax
push ebx
mov byte [ebp - 0x120], 0x22
mov byte [ebp - 0x11f], bl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00406bbd
lea eax, [ebp - 0x120]
push 0x409434
push eax
call fcn.00406bbd
add esp, 0x10
push 2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebx
jne 0x404d03
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.Could_not_access_service_manager:__d
jmp 0x404d57
push dword [ebp + 8]
lea eax, [ebp - 0x120]
push dword [ebp - 4]
push dword [ebp - 0x14]
push ebx
push esi
push eax
push 1
push dword [ebp - 8]
push 0x10
push 0xf01ff
push dword [ebp - 0x1c]
push dword [0x40ced0]
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
cmp eax, ebx
jne 0x404d62
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x431
jne 0x404d51
push str.Service_already_exists
call fcn.00403518
jmp 0x404d5d
push esi
push str.Could_not_create_service:__d
call fcn.00403537
pop ecx
pop ecx
mov eax, esi
jmp 0x404dca
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
push edi
call esi
lea eax, [ebp - 0x224]
push str.SystemCurrentControlSetServices_
push eax
call fcn.00406be0
push dword [0x40ced0]
lea eax, [ebp - 0x224]
push eax
call fcn.00406bbd
add esp, 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x224]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push dword [ebp - 0x10]
call fcn.00406c18
pop ecx
push eax
push dword [ebp - 0x10]
push 1
push ebx
push str.Description
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret 4