Function at 0x404090
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x401266
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401248
mov edx, dword [ebp + 8]
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
xor edi, edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], edi
call esi
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x38]
call esi
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x28]
call esi
mov edx, dword [ebp + 0x14]
lea ecx, [ebp - 0x34]
call esi
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 2
push eax
call fcn.00403fe0
mov ebx, eax
cmp ebx, edi
jne 0x40411c
mov dword [ebp - 0x30], edi
push 0x40427c
jmp 0x40425c
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
push edi
mov esi, eax
call dword [sym.imp.MSVBVM60.DLL_rtcBstrFromAnsi]
mov dword [ebp - 0x40], eax
mov eax, esi
lea edx, [ebp - 0x48]
add eax, 1
push edx
mov dword [ebp - 0x48], 8
jo 0x404293
push eax
call dword [sym.imp.MSVBVM60.DLL_rtcStringBstr]
mov edx, eax
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
imul esi, esi, 2
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x1c]
jo 0x404293
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
mov eax, dword [ebp - 0x1c]
push edi
mov ecx, dword [ebp - 0x38]
push edi
mov edx, dword [ebp - 0x18]
push edi
push edi
push edi
push eax
push 1
push 2
push 0x10
push 0xf01ff
push ecx
push edx
push ebx
call dword [sym.imp.ADVAPI32.DLL_CreateServiceW]
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x431
je 0x40423e
test edi, edi
jne 0x4041c2
mov dword [ebp - 0x30], edi
push 0x40427c
jmp 0x40425c
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
push 0
mov esi, eax
call dword [sym.imp.MSVBVM60.DLL_rtcBstrFromAnsi]
mov edx, esi
lea ecx, [ebp - 0x48]
add edx, 1
push ecx
jo 0x404293
push edx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x48], 8
call dword [sym.imp.MSVBVM60.DLL_rtcStringBstr]
mov edx, eax
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
lea ecx, [ebp - 0x48]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeVar]
imul esi, esi, 2
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
jo 0x404293
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.MSVBVM60.DLL_VarPtr]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.DLL_ChangeServiceConfig2W]
push edi
call fcn.00403fc0
push ebx
call fcn.00403fc0
mov dword [ebp - 0x30], 0xffffffff
push 0x40427c
jmp 0x40425c
mov esi, dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea ecx, [ebp - 0x18]
call esi
lea ecx, [ebp - 0x1c]
call esi
lea ecx, [ebp - 0x28]
call esi
lea ecx, [ebp - 0x34]
call esi
lea ecx, [ebp - 0x38]
call esi
ret
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
sahf
sahf
sahf
sahf
or byte [ebx], al
add bh, bh