Function at 0x410290
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x551a73
mov eax, dword fs:[0]
push eax
sub esp, 0x5a4
mov eax, dword [0x5bb270]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x5ac]
mov esi, dword [ebp + 0xc]
push 0xa
mov dword [ebp - 0x5b0], ebx
call fcn.0040ff00
xor eax, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x524], 7
mov dword [ebp - 0x528], 0
mov word [ebp - 0x538], ax
cmp word [esi], ax
jne 0x410304
xor ecx, ecx
jmp 0x41031f
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410310
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x538]
call fcn.00409480
push 0x20
lea eax, [ebp - 0x538]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x544]
push eax
call fcn.004109a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x5ac]
mov byte [ebp - 4], 2
call fcn.0040ffa0
mov eax, dword [ebp - 0x544]
test eax, eax
je 0x4103a7
push dword [ebp - 0x5a0]
lea ecx, [ebp - 0x599]
push ecx
push dword [ebp - 0x540]
push eax
call fcn.0040fd90
push dword [ebp - 0x544]
call fcn.0041143a
add esp, 0x14
mov dword [ebp - 0x544], 0
mov dword [ebp - 0x540], 0
mov dword [ebp - 0x53c], 0
cmp dword [ebp - 0x524], 8
jb 0x4103be
push dword [ebp - 0x538]
call fcn.0041143a
add esp, 4
xor eax, eax
mov dword [ebp - 0x554], 7
mov dword [ebp - 0x558], 0
mov word [ebp - 0x568], ax
mov dword [ebp - 0x56c], 7
mov dword [ebp - 0x570], eax
mov word [ebp - 0x580], ax
mov dword [ebp - 0x584], 7
mov dword [ebp - 0x588], eax
mov word [ebp - 0x598], ax
mov eax, dword [ebp - 0x5ac]
mov esi, eax
mov byte [ebp - 4], 5
cmp eax, dword [ebp - 0x5a8]
je 0x41075e
xor eax, eax
mov dword [ebp - 0x524], 7
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0x538]
mov dword [ebp - 0x528], 0
mov word [ebp - 0x538], ax
call fcn.00409360
push 3
push 0
push 0x5631e8
lea ecx, [ebp - 0x538]
call fcn.0040d660
cmp eax, 0xffffffff
setne bl
cmp dword [ebp - 0x524], 8
jb 0x41047e
push dword [ebp - 0x538]
call fcn.0041143a
add esp, 4
xor eax, eax
mov dword [ebp - 0x524], 7
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x538]
mov dword [ebp - 0x528], 0
push esi
mov word [ebp - 0x538], ax
call fcn.00409360
test bl, bl
je 0x410569
push 0xffffffffffffffff
push 3
lea eax, [ebp - 0x550]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x538]
call fcn.0040eb70
mov edi, eax
lea eax, [ebp - 0x568]
cmp eax, edi
je 0x4106fe
cmp dword [ebp - 0x554], 8
jb 0x4104f3
push dword [ebp - 0x568]
call fcn.0041143a
add esp, 4
xor eax, eax
mov dword [ebp - 0x554], 7
mov dword [ebp - 0x558], 0
mov word [ebp - 0x568], ax
cmp dword [edi + 0x14], 8
jae 0x410531
mov eax, dword [edi + 0x10]
inc eax
je 0x41053f
add eax, eax
push eax
lea eax, [ebp - 0x568]
push edi
push eax
call fcn.00537fb0
add esp, 0xc
jmp 0x41053f
mov eax, dword [edi]
mov dword [ebp - 0x568], eax
mov dword [edi], 0
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x558], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x554], eax
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
jmp 0x4106fe
push 4
push 0
push str._n1
lea ecx, [ebp - 0x538]
call fcn.0040d660
cmp eax, 0xffffffff
setne bl
cmp dword [ebp - 0x524], 8
jb 0x41059a
push dword [ebp - 0x538]
call fcn.0041143a
add esp, 4
xor eax, eax
mov dword [ebp - 0x524], 7
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x538]
mov dword [ebp - 0x528], 0
push esi
mov word [ebp - 0x538], ax
call fcn.00409360
test bl, bl
je 0x410633
push 0xffffffffffffffff
push 4
lea eax, [ebp - 0x550]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x538]
call fcn.0040eb70
mov edi, eax
lea eax, [ebp - 0x580]
cmp eax, edi
je 0x4106fe
cmp dword [ebp - 0x56c], 8
jb 0x41060b
push dword [ebp - 0x580]
call fcn.0041143a
add esp, 4
xor eax, eax
mov dword [ebp - 0x56c], 7
mov dword [ebp - 0x570], 0
lea ecx, [ebp - 0x580]
mov word [ebp - 0x580], ax
jmp 0x4106f8
push 4
push 0
push str._n2
lea ecx, [ebp - 0x538]
call fcn.0040d660
cmp eax, 0xffffffff
setne bl
cmp dword [ebp - 0x524], 8
jb 0x410664
push dword [ebp - 0x538]
call fcn.0041143a
add esp, 4
test bl, bl
je 0x410749
xor eax, eax
mov dword [ebp - 0x524], 7
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0x538]
mov dword [ebp - 0x528], 0
mov word [ebp - 0x538], ax
call fcn.00409360
push 0xffffffffffffffff
push 4
lea eax, [ebp - 0x550]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x538]
call fcn.0040eb70
mov edi, eax
lea eax, [ebp - 0x598]
cmp eax, edi
je 0x4106fe
cmp dword [ebp - 0x584], 8
jb 0x4106d5
push dword [ebp - 0x598]
call fcn.0041143a
add esp, 4
xor eax, eax
mov dword [ebp - 0x584], 7
mov dword [ebp - 0x588], 0
lea ecx, [ebp - 0x598]
mov word [ebp - 0x598], ax
push edi
call fcn.0040d130
cmp dword [ebp - 0x53c], 8
jb 0x410715
push dword [ebp - 0x550]
call fcn.0041143a
add esp, 4
xor eax, eax
mov dword [ebp - 0x53c], 7
cmp dword [ebp - 0x524], 8
mov dword [ebp - 0x540], eax
mov word [ebp - 0x550], ax
mov byte [ebp - 4], 5
jb 0x410749
push dword [ebp - 0x538]
call fcn.0041143a
add esp, 4
add esi, 0x18
cmp esi, dword [ebp - 0x5a8]
jne 0x410421
mov ebx, dword [ebp - 0x5b0]
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x410777
xor ebx, ebx
jmp 0x41088c
push 0x288
lea eax, [ebp - 0x520]
push 0
push eax
call fcn.00537c80
mov eax, dword [ebp - 0x580]
add esp, 0xc
cmp dword [ebp - 0x56c], 8
jae 0x4107a2
lea eax, [ebp - 0x580]
push eax
push ebx
push str.__s___s
lea eax, [ebp - 0x520]
push 0x144
push eax
call fcn.0053777e
mov eax, dword [ebp - 0x568]
add esp, 0x14
cmp dword [ebp - 0x554], 8
jae 0x4107d2
lea eax, [ebp - 0x568]
push 0
push 0
push 0
push 0
push 0
push ebx
push 0
push 2
push 0x10
push 0x16
lea ecx, [ebp - 0x520]
push ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
je 0x410876
push 0x288
lea eax, [ebp - 0x298]
push 0
push eax
call fcn.00537c80
mov eax, dword [ebp - 0x598]
add esp, 0xc
cmp dword [ebp - 0x584], 8
jae 0x410825
lea eax, [ebp - 0x598]
push eax
push ebx
push str.__s___s
lea eax, [ebp - 0x298]
push 0x144
push eax
call fcn.0053777e
add esp, 0x14
lea eax, [ebp - 0x298]
mov dword [ebp - 0x5a0], eax
lea eax, [ebp - 0x5a0]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x410876
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x410876
mov ebx, 1
jmp 0x410878
xor ebx, ebx
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x410889
push esi
call eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call eax
cmp dword [ebp - 0x584], 8
jb 0x4108a3
push dword [ebp - 0x598]
call fcn.0041143a
add esp, 4
xor eax, eax
mov dword [ebp - 0x584], 7
cmp dword [ebp - 0x56c], 8
mov dword [ebp - 0x588], 0
mov word [ebp - 0x598], ax
jb 0x4108d7
push dword [ebp - 0x580]
call fcn.0041143a
add esp, 4
xor eax, eax
mov dword [ebp - 0x56c], 7
cmp dword [ebp - 0x554], 8
mov dword [ebp - 0x570], 0
mov word [ebp - 0x580], ax
jb 0x41090b
push dword [ebp - 0x568]
call fcn.0041143a
add esp, 4
xor eax, eax
mov dword [ebp - 0x554], 7
mov word [ebp - 0x568], ax
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x558], 0
test eax, eax
je 0x410979
mov edi, dword [ebp - 0x5a8]
mov esi, eax
cmp eax, edi
je 0x410970
mov edi, edi
cmp dword [esi + 0x14], 8
jb 0x410950
push dword [esi]
call fcn.0041143a
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
add esi, 0x18
cmp esi, edi
jne 0x410940
mov eax, dword [ebp - 0x5ac]
push eax
call fcn.0041143a
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053787e
mov esp, ebp
pop ebp
ret