Function at 0x408829
Capabilities:
Create service
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffde0
xor eax, eax
xor edx, edx
push ebx
push esi
push edi
mov edi, str.Starting_NT_Service___s_
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edx
call fcn.00402a1b
push eax
call fcn.0040a421
pop ecx
test eax, eax
jne 0x408889
call fcn.004018e1
push eax
call fcn.00402a1b
push eax
lea ecx, [edi + 0x26]
push ecx
push 0x41fa10
call fcn.0040e624
add esp, 0x10
xor eax, eax
jmp 0x408bc9
push 0x201
lea edx, [ebp - 0x21c]
push edx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
lea ecx, [ebp - 0x21c]
push ecx
lea eax, [ebp - 0x1220]
push eax
call fcn.0040c478
add esp, 8
lea edx, [edi + 0x5b]
push edx
lea ecx, [ebp - 0x1220]
push ecx
call fcn.0040c39c
add esp, 8
push esi
lea eax, [ebp - 0x1220]
push eax
call fcn.0040c39c
add esp, 8
lea edx, [edi + 0x70]
push edx
lea ecx, [ebp - 0x1220]
push ecx
call fcn.0040c39c
add esp, 8
mov ebx, 1
cmp ebx, dword [ebp + 0xc]
jge 0x408920
lea eax, [edi + 0x72]
push eax
lea edx, [ebp - 0x1220]
push edx
call fcn.0040c39c
add esp, 8
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x1220]
push dword [ecx + ebx*4]
push eax
call fcn.0040c39c
add esp, 8
inc ebx
cmp ebx, dword [ebp + 0xc]
jl 0x4088f2
lea edx, [ebp - 0x1220]
push edx
call fcn.0040c4a8
pop ecx
cmp eax, 0x1000
jbe 0x40894c
lea ecx, [edi + 0x74]
push ecx
push 0x41fa10
call fcn.0040e624
add esp, 8
xor eax, eax
jmp 0x408bc9
lea edx, [ebp - 0x10]
lea ecx, [edi + 0x90]
push edx
push 0xf003f
push 0
push ecx
push connect
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov ebx, eax
test ebx, ebx
je 0x408991
push ebx
lea eax, [edi + 0xf9]
push eax
lea edx, [edi + 0xc7]
push edx
push 0x41fa10
call fcn.0040e624
add esp, 0x10
xor eax, eax
jmp 0x408bc9
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push edx
push ecx
push 0
push 0x20006
lea eax, [edi + 0x143]
push 0
push eax
push 0
push esi
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegCreateKeyExA
push dword [ebp - 0x10]
mov ebx, eax
call sub.ADVAPI32.DLL_RegCloseKey
test ebx, ebx
je 0x4089e6
push ebx
push esi
lea eax, [edi + 0xf9]
lea edx, [edi + 0x14a]
push eax
push edx
push 0x41fa10
call fcn.0040e624
add esp, 0x14
xor eax, eax
jmp 0x408bc9
lea edx, [ebp - 0x21c]
push edx
call fcn.0040c4a8
pop ecx
inc eax
push eax
lea ecx, [ebp - 0x21c]
push ecx
push 1
push 0
lea eax, [edi + 0x181]
push eax
push dword [ebp - 0x14]
call sub.ADVAPI32.DLL_RegSetValueExA
mov ebx, eax
test ebx, ebx
je 0x408a48
push dword [ebp - 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
push ebx
lea eax, [edi + 0x181]
push eax
push esi
lea edx, [edi + 0xf9]
lea ecx, [edi + 0x192]
push edx
push ecx
push 0x41fa10
call fcn.0040e624
add esp, 0x18
xor eax, eax
jmp 0x408bc9
push 4
lea edx, [ebp - 0xc]
push edx
push 4
push 0
lea ecx, [edi + 0x1d5]
push ecx
push dword [ebp - 0x14]
call sub.ADVAPI32.DLL_RegSetValueExA
mov ebx, eax
test ebx, ebx
je 0x408a9a
push dword [ebp - 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
push ebx
lea eax, [edi + 0x1d5]
push eax
push esi
lea edx, [edi + 0xf9]
lea ecx, [edi + 0x1e4]
push edx
push ecx
push 0x41fa10
call fcn.0040e624
add esp, 0x18
xor eax, eax
jmp 0x408bc9
push dword [ebp - 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
push 0xf003f
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jne 0x408ae2
call sub.KERNEL32.DLL_GetLastError
push eax
lea eax, [edi + 0x22a]
push eax
push 0x41fa10
call fcn.0040e624
add esp, 0xc
push 1
push esi
call fcn.00408be2
add esp, 8
xor eax, eax
jmp 0x408bc9
push ebx
call sub.ADVAPI32.DLL_LockServiceDatabase
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x408b1d
call sub.KERNEL32.DLL_GetLastError
push eax
lea edx, [edi + 0x250]
push edx
push 0x41fa10
call fcn.0040e624
add esp, 0xc
push 1
push esi
call fcn.00408be2
add esp, 8
xor eax, eax
jmp 0x408bc9
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x1220]
push edx
push 1
push 2
push 0x10
push 0xf01ff
push esi
push esi
push ebx
call sub.ADVAPI32.DLL_CreateServiceA
mov dword [ebp - 4], eax
push dword [ebp - 8]
call sub.ADVAPI32.DLL_UnlockServiceDatabase
test eax, eax
jne 0x408b6a
call sub.KERNEL32.DLL_GetLastError
push eax
lea ecx, [edi + 0x276]
push ecx
push 0x41fa10
call fcn.0040e624
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x408b9f
call sub.KERNEL32.DLL_GetLastError
push eax
lea eax, [edi + 0x29e]
push eax
push 0x41fa10
call fcn.0040e624
add esp, 0xc
push 1
push esi
call fcn.00408be2
add esp, 8
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
xor eax, eax
jmp 0x408bc9
push dword [ebp - 4]
call sub.ADVAPI32.DLL_CloseServiceHandle
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
lea edx, [ebp - 0x1220]
lea ecx, [edi + 0x2c7]
push edx
push esi
push ecx
call sym.jbuilder.exe__ut_tproda
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret