Function at 0x4230c8
Capabilities:
Create service
Modify service
Persist via run registry key
Persist via windows service
Query service configuration

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xf
push 0
push 0
dec ecx
jne 0x4230d0
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x423566
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41ff80]
call fcn.00420080
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.00420120
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
je 0x423301
mov cl, 1
mov edx, 0x42357c
mov eax, ebx
call fcn.00420188
mov edx, 0x4235bc
mov eax, ebx
call fcn.0042071c
test al, al
jne 0x42315a
call fcn.00421ee4
lea edx, [ebp - 0x24]
call fcn.00422194
cmp dword [ebp - 0x24], 0
je 0x42315a
call fcn.00421ee4
lea edx, [ebp - 0x28]
call fcn.00422194
mov eax, dword [ebp - 0x28]
call fcn.00407d6c
test al, al
jne 0x4231cf
call fcn.00421ee4
lea edx, [ebp - 0x2c]
call fcn.00422194
cmp dword [ebp - 0x2c], 0
je 0x423205
call fcn.00421ee4
lea edx, [ebp - 0x30]
call fcn.00422194
mov eax, dword [ebp - 0x30]
call fcn.00407d6c
test al, al
je 0x423205
lea ecx, [ebp - 0x34]
mov edx, 0x4235bc
mov eax, ebx
call fcn.00420550
mov eax, dword [ebp - 0x34]
push eax
push 0x4235cc
call fcn.00421ee4
lea edx, [ebp - 0x3c]
call fcn.00422194
push dword [ebp - 0x3c]
push 0x4235e4
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.004045c0
mov edx, dword [ebp - 0x38]
pop eax
call fcn.00404644
je 0x423205
push 0x4235cc
call fcn.00421ee4
lea edx, [ebp - 0x44]
call fcn.00422194
push dword [ebp - 0x44]
push 0x4235e4
lea eax, [ebp - 0x40]
mov edx, 3
call fcn.004045c0
mov ecx, dword [ebp - 0x40]
mov edx, 0x4235bc
mov eax, ebx
call fcn.00420524
mov eax, ebx
call fcn.004200f0
mov cl, 1
mov edx, 0x4235f4
mov eax, ebx
call fcn.00420188
mov edx, 0x4235bc
mov eax, ebx
call fcn.0042071c
test al, al
je 0x423236
mov edx, 0x4235bc
mov eax, ebx
call fcn.00420424
mov eax, ebx
call fcn.004200f0
mov cl, 1
mov edx, 0x42357c
mov eax, ebx
call fcn.00420188
mov edx, 0x42362c
mov eax, ebx
call fcn.0042071c
test al, al
jne 0x423287
call fcn.00421ee4
lea edx, [ebp - 0x48]
call fcn.00422168
cmp dword [ebp - 0x48], 0
je 0x423287
call fcn.00421ee4
lea edx, [ebp - 0x4c]
call fcn.00422168
mov eax, dword [ebp - 0x4c]
call fcn.00407d6c
test al, al
jne 0x4232de
call fcn.00421ee4
lea edx, [ebp - 0x50]
call fcn.00422168
cmp dword [ebp - 0x50], 0
je 0x4232fa
call fcn.00421ee4
lea edx, [ebp - 0x54]
call fcn.00422168
mov eax, dword [ebp - 0x54]
call fcn.00407d6c
test al, al
je 0x4232fa
lea ecx, [ebp - 0x58]
mov edx, 0x42362c
mov eax, ebx
call fcn.00420550
mov eax, dword [ebp - 0x58]
push eax
call fcn.00421ee4
lea edx, [ebp - 0x5c]
call fcn.00422168
mov edx, dword [ebp - 0x5c]
pop eax
call fcn.00404644
je 0x4232fa
call fcn.00421ee4
lea edx, [ebp - 0x60]
call fcn.00422168
mov ecx, dword [ebp - 0x60]
mov edx, 0x42362c
mov eax, ebx
call fcn.00420524
mov eax, ebx
call fcn.004200f0
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x4233a3
mov cl, 1
mov edx, 0x423640
mov eax, ebx
call fcn.00420188
mov edx, 0x42365c
mov eax, ebx
call fcn.0042071c
test al, al
je 0x423375
call fcn.00421ee4
lea edx, [ebp - 0x64]
call fcn.00422194
cmp dword [ebp - 0x64], 0
je 0x42339c
lea ecx, [ebp - 0x68]
mov edx, 0x42365c
mov eax, ebx
call fcn.00420550
mov eax, dword [ebp - 0x68]
push eax
call fcn.00421ee4
lea edx, [ebp - 0x70]
call fcn.00422194
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x6c]
call fcn.00407e18
mov edx, dword [ebp - 0x6c]
pop eax
call fcn.00404644
je 0x42339c
call fcn.00421ee4
lea edx, [ebp - 0x78]
call fcn.00422194
mov eax, dword [ebp - 0x78]
lea edx, [ebp - 0x74]
call fcn.00407e18
mov ecx, dword [ebp - 0x74]
mov edx, 0x42365c
mov eax, ebx
call fcn.00420524
mov eax, ebx
call fcn.004200f0
lea eax, [ebp - 0x7c]
call fcn.00421e24
mov edx, dword [ebp - 0x7c]
lea eax, [ebp - 0xc]
mov ecx, 0x42366c
call fcn.0040454c
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x423534
mov eax, dword [ebp - 0xc]
call fcn.00407d6c
test al, al
je 0x423534
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov esi, eax
test esi, esi
je 0x423518
push 0xf01ff
push 0x423678
push esi
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
je 0x4234a2
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push edi
call sub.advapi32.dll_QueryServiceConfigA
mov eax, dword [ebp - 0x10]
call fcn.004026d8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
call sub.advapi32.dll_QueryServiceConfigA
test eax, eax
je 0x423492
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0xc]
call fcn.00404438
mov eax, dword [ebp - 8]
test byte [eax + 1], 1
jne 0x42346b
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 2
jne 0x42346b
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404644
je 0x423492
push 0x423688
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004046f8
push eax
push 0xffffffffffffffff
push 2
push 0x110
push edi
call sub.advapi32.dll_ChangeServiceConfigA
mov eax, dword [ebp - 8]
call fcn.004026f8
push edi
call sub.advapi32.dll_CloseServiceHandle
jmp 0x423512
lea eax, [ebp - 0x20]
call fcn.00404248
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x4234ba
lea edi, [ebp - 0x14]
jmp 0x4234bc
xor edi, edi
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
call fcn.00404248
mov eax, dword [ebp - 0x1c]
call fcn.004046f8
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0x4236b0
push edi
mov eax, dword [ebp - 0x20]
call fcn.004046f8
push eax
mov eax, dword [ebp - 0xc]
call fcn.004046f8
push eax
push 1
push 2
push 0x110
push 0xf01ff
push 0x423688
push 0x423678
push esi
call sub.advapi32.dll_CreateServiceA
push eax
call sub.advapi32.dll_CloseServiceHandle
push esi
call sub.advapi32.dll_CloseServiceHandle
mov edx, 0x4236bc
mov eax, ebx
call fcn.004207c4
test al, al
je 0x423534
mov edx, 0x4236bc
mov eax, ebx
call fcn.004202ac
mov eax, ebx
call fcn.0040348c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42356d
lea eax, [ebp - 0x7c]
mov edx, 0x19
call fcn.0040426c
lea eax, [ebp - 0xc]
call fcn.00404248
lea eax, [ebp - 4]
call fcn.00404248
ret