Function at 0x408fb0
Capabilities:
Access peb ldr_data
Create service
Delete service
Start service
Stop service
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x42d418
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [0x43b5b4]
push ebx
push esi
push edi
mov dword [esp + 0xc], eax
xor ebx, ebx
push 0xf003f
push ebx
push ebx
mov dword [esp + 0x44], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
mov dword [0x43f5e8], eax
jne 0x409047
call esi
push eax
lea ecx, [esp + 0x10]
push 0x43b5ac
push ecx
call fcn.0042044c
add esp, 0xc
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push 0x43b570
push eax
call fcn.00421146
mov eax, dword [eax]
push ebx
push ebx
push eax
mov byte [esp + 0x44], 1
call fcn.0042837f
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], bl
call fcn.00420f17
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x43f670
push 1
push 3
push 1
push 0xf01ff
push str.BackInC
push str.BackInC
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
cmp eax, ebx
mov dword [0x43f5e4], eax
jne 0x4090ea
call esi
cmp eax, 0x431
je 0x4090ea
cmp eax, 0x430
jne 0x409094
push ebx
push ebx
push 0x43b544
call fcn.0042837f
jmp 0x4090d7
push eax
lea ecx, [esp + 0x10]
push 0x43b5ac
push ecx
call fcn.0042044c
add esp, 0xc
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push 0x43b52c
push eax
call fcn.00421146
mov eax, dword [eax]
push ebx
push ebx
push eax
mov byte [esp + 0x44], 2
call fcn.0042837f
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], bl
call fcn.00420f17
mov ecx, dword [0x43f5e8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call fcn.00411f7d
mov edx, dword [0x43f5e8]
push 0xf01ff
push str.BackInC
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp eax, ebx
mov dword [0x43f5e4], eax
jne 0x40916c
call esi
push eax
lea eax, [esp + 0x10]
push 0x43b5ac
push eax
call fcn.0042044c
add esp, 0xc
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push 0x43b514
push edx
call fcn.00421146
mov eax, dword [eax]
push ebx
push ebx
push eax
mov byte [esp + 0x44], 3
call fcn.0042837f
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], bl
call fcn.00420f17
mov eax, dword [0x43f5e4]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
mov ecx, dword [0x43f5e8]
push ecx
call esi
push ebx
call fcn.00411f7d
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x40921f
call esi
cmp eax, 0x420
je 0x40921f
cmp eax, 5
jne 0x40919d
push ebx
push ebx
push 0x43b4f4
call fcn.0042837f
jmp 0x4091f5
cmp eax, 0x5aa
jne 0x4091b2
push ebx
push ebx
push 0x43b4cc
call fcn.0042837f
jmp 0x4091f5
push eax
lea edx, [esp + 0x10]
push 0x43b5ac
push edx
call fcn.0042044c
add esp, 0xc
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push 0x43b4b4
push ecx
call fcn.00421146
mov eax, dword [eax]
push ebx
push ebx
push eax
mov byte [esp + 0x44], 4
call fcn.0042837f
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], bl
call fcn.00420f17
mov edx, dword [0x43f5e4]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov eax, dword [0x43f5e4]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
mov ecx, dword [0x43f5e8]
push ecx
call esi
push ebx
call fcn.00411f7d
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push str..BackInCKB
call edi
cmp eax, 0xffffffff
mov dword [0x43f5e0], eax
jne 0x4092c7
call esi
push eax
lea edx, [esp + 0x10]
push 0x43b5ac
push edx
call fcn.0042044c
add esp, 0xc
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push 0x43b488
push ecx
call fcn.00421146
mov eax, dword [eax]
push ebx
push ebx
push eax
mov byte [esp + 0x44], 5
call fcn.0042837f
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], bl
call fcn.00420f17
mov eax, dword [0x43f5e4]
lea edx, [esp + 0x14]
push edx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ecx, dword [0x43f5e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edx, dword [0x43f5e4]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edx
call esi
mov eax, dword [0x43f5e8]
push eax
call esi
push ebx
call fcn.00411f7d
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push str..BackInCMU
call edi
cmp eax, 0xffffffff
mov dword [0x43f5dc], eax
jne 0x409376
call esi
push eax
lea ecx, [esp + 0x10]
push 0x43b5ac
push ecx
call fcn.0042044c
add esp, 0xc
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push 0x43b460
push eax
call fcn.00421146
mov eax, dword [eax]
push ebx
push ebx
push eax
mov byte [esp + 0x44], 6
call fcn.0042837f
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], bl
call fcn.00420f17
mov ecx, dword [0x43f5e0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x43f5e4]
lea edx, [esp + 0x14]
push edx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ecx, dword [0x43f5e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edx, dword [0x43f5e4]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edx
call esi
mov eax, dword [0x43f5e8]
push eax
call esi
push ebx
call fcn.00411f7d
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.00420f17
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret