Function at 0x401f20
Capabilities:
Create service
Delete registry value
Delete service
Initialize winsock library
Persist via run registry key
Persist via windows service
Set registry value
Start service

Disassembly:
mov eax, 0x21ac
call fcn.00420ca0
mov eax, dword [0x44f874]
xor eax, esp
mov dword [esp + 0x21a8], eax
push ebx
mov ebx, dword [esp + 0x21b8]
lea eax, [esp + 0x1c]
push esi
push edi
push eax
push 0x101
xor edi, edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x453a20
mov dword [0x453a20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, dword [esp + 0x21bc]
mov dword [0x44f370], 0x44f478
cmp esi, 2
je 0x401f88
cmp esi, 3
jne 0x40223a
mov eax, dword [ebx + 4]
mov ecx, str.__install
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401fb0
test dl, dl
je 0x401fac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401fb0
add eax, 2
add ecx, 2
test dl, dl
jne 0x401f90
xor eax, eax
jmp 0x401fb5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40223a
lea eax, [esp + 0x10]
mov byte [esp + 0x1b4], 0x22
push eax
lea eax, [esp + 0x1b9]
push eax
push 0x100
push 0x4402dc
push dword [ebx]
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
mov edx, eax
test edx, edx
jne 0x402013
push str.Failed_to_find_executable_filename
call fcn.004247b8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420c8f
add esp, 0x21ac
ret
lea edi, [esp + 0x1b4]
dec edi
nop dword [eax + eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x402020
mov eax, dword [0x440308]
mov dword [edi], eax
cmp esi, 3
jne 0x40203b
mov ecx, dword [ebx + 8]
jmp 0x402043
mov eax, dword [0x44f370]
mov ecx, dword [eax + 0x64]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1bc]
add eax, edx
push eax
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x402089
push str.Failed_to_find_config_filename
call fcn.004247b8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420c8f
add esp, 0x21ac
ret
lea ecx, [esp + 0x1b4]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x402091
cmp dword [0x453a30], 2
mov eax, dword [str.____service]
mov dword [ecx], eax
mov eax, dword [0x440330]
mov dword [ecx + 4], eax
mov eax, dword [0x440334]
mov dword [ecx + 8], eax
jne 0x40218f
push 0x40000010
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ecx, eax
test ecx, ecx
jne 0x4020fb
push str.Failed_to_open_Service_Manager
call fcn.004247b8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420c8f
add esp, 0x21ac
ret
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c8]
push eax
mov eax, dword [0x44f370]
push 0
push 2
push 0x10
push 0x20000000
push dword [eax + 8]
push dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x402155
push str.Failed_to_create_service
call fcn.004247b8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420c8f
add esp, 0x21ac
ret
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x4024d6
push str.Failed_to_start_service
call fcn.004247b8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420c8f
add esp, 0x21ac
ret
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4021d6
push str.Failed_to_open_registry
call fcn.004247b8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420c8f
add esp, 0x21ac
ret
lea ecx, [esp + 0x1b4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4021e0
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x1b8]
push eax
mov eax, dword [0x44f370]
push 2
push 0
push dword [eax + 4]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4024d6
push str.Failed_to_set_registry_value
call fcn.004247b8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420c8f
add esp, 0x21ac
ret
cmp esi, 2
je 0x402248
cmp esi, 3
jne 0x4023eb
mov eax, dword [ebx + 4]
mov ecx, str.__remove
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402270
test dl, dl
je 0x40226c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402270
add eax, 2
add ecx, 2
test dl, dl
jne 0x402250
xor eax, eax
jmp 0x402275
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40239e
cmp dword [0x453a30], 2
jne 0x402339
push 0x40000000
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ecx, eax
test ecx, ecx
jne 0x4022c4
push str.Failed_to_open_Service_Manager_n
call fcn.004247b8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420c8f
add esp, 0x21ac
ret
mov eax, dword [0x44f370]
push 0x10000
push dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
jne 0x402303
push str.Failed_to_open_service
call fcn.004247b8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420c8f
add esp, 0x21ac
ret
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4024d6
push str.Failed_to_delete_service
call fcn.004247b8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420c8f
add esp, 0x21ac
ret
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4021af
mov eax, dword [0x44f370]
push dword [eax + 4]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4024d6
push str.Failed_to_clear_registry
call fcn.004247b8
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420c8f
add esp, 0x21ac
ret
cmp esi, 3
jne 0x4023eb
mov eax, dword [ebx + 8]
mov ecx, str.__service
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4023d0
test dl, dl
je 0x4023cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4023d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4023b0
xor eax, eax
jmp 0x4023d5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4023f5
mov dword [0x4502e4], 1
lea esi, [eax + 2]
mov eax, dword [ebx + 4]
jmp 0x4023fa
cmp esi, 2
jne 0x4023f5
mov eax, dword [ebx + 4]
jmp 0x4023fa
mov eax, dword [str.3proxy.cfg]
push eax
call fcn.00431b5e
add esp, 4
mov dword [0x44f274], eax
test eax, eax
je 0x402418
cmp byte [eax], 0x2d
je 0x402418
call fcn.0040b570
mov edi, eax
cmp esi, 2
jg 0x4024f0
test edi, edi
je 0x4024f0
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4513e0
call esi
push 0x4513c0
call esi
push 0x4513a0
call esi
push 0x451380
call esi
push 0x451360
call esi
push 0x451340
call esi
push 0x451300
call esi
push 0x4515c0
call esi
push 0x44f240
call fcn.0040ab90
push edi
call fcn.0040b260
inc dword [0x44f2b8]
add esp, 8
test eax, eax
jne 0x4024d6
cmp dword [0x451338], eax
jne 0x402495
push edi
call fcn.00423153
add esp, 4
cmp dword [0x4502e4], 0
je 0x4024d1
mov eax, dword [0x44f370]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], 0x401d30
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x4024d6
call fcn.004014b0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x21a8]
xor ecx, esp
call fcn.00420c8f
add esp, 0x21ac
ret
push dword [ebx]
push str.Usage:__s__conffile__n
push 2
call fcn.00422fa8
add esp, 4
push eax
call fcn.004025a0
mov eax, dword [ebx]
add esp, 0xc
push eax
push eax
push str._n_t_s___install__conffile__n_tto_install_as_service_n_n_t_s___remove_n_tto_remove_service_n
push 2
call fcn.00422fa8
add esp, 4
push eax
call fcn.004025a0
push 0x4404f4
call fcn.00403b00
add esp, 0x14
push eax
push str.available_socket_options:_n_t_s_n
push 2
call fcn.00422fa8
add esp, 4
push eax
call fcn.004025a0
mov eax, dword [0x44f370]
add esp, 0xc
push dword [0x44f1dc]
push dword [eax + 0xc]
push dword [eax + 8]
push str._n_s__s_n_s_n
push 2
call fcn.00422fa8
add esp, 4
push eax
call fcn.004025a0
mov ecx, dword [esp + 0x21c8]
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00420c8f
add esp, 0x21ac
ret