Function at 0x4115d0
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468173
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x4a3a10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xac], edx
test ecx, ecx
jne 0x4116c5
xorps xmm0, xmm0
mov dword [ebp - 0x18], ecx
push 0x30
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
movups xmmword [ebp - 0x28], xmm0
call fcn.00410e00
movups xmm0, xmmword [str.ServiceControlManager_is_not_opened]
mov edx, eax
mov dword [ebp - 0x18], 0x23
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x14], 0x2f
movups xmmword [edx], xmm0
movups xmm0, xmmword [0x46f22c]
movups xmmword [edx + 0x10], xmm0
mov cx, word [0x46f23c]
mov word [edx + 0x20], cx
mov al, byte [0x46f23e]
mov byte [edx + 0x22], al
mov byte [edx + 0x23], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.00411f60
mov ecx, dword [ebp - 0x14]
add esp, 4
cmp ecx, 0x10
jb 0x4116be
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4116b4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4119a5
push ecx
push edx
call fcn.0044781c
add esp, 8
xor eax, eax
jmp 0x41198a
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.0041fb60
add esp, 8
push esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 1
call fcn.0040f6f0
cmp dword [ebp - 0x2c], 0x10
lea esi, [ebp - 0x40]
mov edi, dword [ebp - 0x30]
cmovae esi, dword [ebp - 0x40]
mov byte [ebp - 4], 2
test edi, edi
je 0x411810
push edi
push 0x20
push esi
call fcn.004490c0
add esp, 0xc
test eax, eax
je 0x411810
sub eax, esi
cmp eax, 0xffffffff
je 0x411810
cmp edi, 0x7fffffff
je 0x4119aa
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
lea ecx, [edi + 1]
mov esi, 0xf
cmovae eax, dword [ebp - 0x40]
xorps xmm0, xmm0
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0xa4], eax
movups xmmword [ebp - 0x28], xmm0
cmp ecx, esi
jbe 0x41178d
mov esi, ecx
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x41176b
mov esi, SysReAllocString
jmp 0x411775
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x28]
call fcn.00410e00
mov dword [ebp - 0xa4], eax
lea ecx, [edi + 1]
mov dword [ebp - 0x28], eax
push edi
push dword [ebp - 0xa8]
mov dword [ebp - 0x18], ecx
lea ecx, [eax + 1]
mov dword [ebp - 0x14], esi
push ecx
mov byte [eax], 0x22
call fcn.00449170
mov eax, dword [ebp - 0xa4]
add esp, 0xc
mov byte [eax + edi + 1], 0
push 0x22
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.00413820
mov ecx, dword [ebp - 0x2c]
movups xmm0, xmmword [ebp - 0x28]
cmp ecx, 0x10
jb 0x4117fe
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4117f0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4119b4
push ecx
push edx
call fcn.0044781c
movups xmm0, xmmword [ebp - 0x28]
add esp, 8
movups xmmword [ebp - 0x40], xmm0
mov byte [ebp - 4], 2
movq xmm0, qword [ebp - 0x18]
movq qword [ebp - 0x30], xmm0
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0041fb60
push dword [ebp - 0xac]
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 4
push eax
call fcn.0041fb60
add esp, 0x10
cmp dword [ebp - 0x74], 8
lea edx, [ebp - 0x88]
push 0
cmovae edx, dword [ebp - 0x88]
lea ecx, [ebp - 0x70]
cmp dword [ebp - 0x5c], 8
lea eax, [ebp - 0xa0]
push 0
cmovae ecx, dword [ebp - 0x70]
cmp dword [ebp - 0x8c], 8
push 0
cmovae eax, dword [ebp - 0xa0]
push 0
push 0
push edx
push 1
push 2
push 0x10
push 0xf01ff
push ecx
push eax
push dword [ebp - 0xb0]
mov byte [ebp - 4], 5
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
jne 0x411928
xorps xmm0, xmm0
mov dword [ebp - 0x48], eax
push 0x20
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x44], 0xf
movups xmmword [ebp - 0x58], xmm0
call fcn.00410e00
movups xmm0, xmmword [str.cannot_create_service]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x48], 0x15
mov dword [ebp - 0x44], 0x1f
movups xmmword [eax], xmm0
mov ecx, dword [0x46f250]
mov dword [eax + 0x10], ecx
mov cl, byte [0x46f254]
mov byte [eax + 0x14], cl
mov byte [eax + 0x15], 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 6
push eax
call fcn.00411f60
mov ecx, dword [ebp - 0x44]
add esp, 4
cmp ecx, 0x10
jb 0x411928
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41191e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4119af
push ecx
push edx
call fcn.0044781c
add esp, 8
lea ecx, [ebp - 0x70]
call fcn.0040fe00
lea ecx, [ebp - 0x88]
call fcn.0040fe00
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0x10
jb 0x41196b
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411961
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4119b4
push ecx
push edx
call fcn.0044781c
add esp, 8
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.0040fe00
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00447a97
mov esp, ebp
pop ebp
ret
call fcn.0044c8cf
call fcn.00410c50
call fcn.0044c8cf
call fcn.0044c8cf
int3