Function at 0x41d2ac
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push 0x1b0
mov eax, 0x5929a0
call fcn.0054669f
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ebx
push 1
mov dword [ebp - 0x1a4], esi
mov dword [ebp - 0x1b4], esi
call fcn.0041d224
mov dword [ebp - 0x1b8], eax
pop ecx
test eax, eax
je 0x41d724
push dword [edi + 0x78]
lea eax, [edi + 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041cb1a
add esp, 0xc
mov dword [ebp - 4], ebx
cmp dword [edi + 0x58], ebx
jne 0x41d307
mov dword [ebp - 0x1b0], ebx
jmp 0x41d340
lea eax, [edi + 0x48]
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0041efad
pop ecx
pop ecx
mov dword [ebp - 0x1b0], eax
xor esi, esi
mov byte [ebp - 4], 1
inc esi
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x1a4], esi
mov dword [ebp - 0x1b4], esi
jb 0x41d340
mov eax, dword [eax]
mov dword [ebp - 0x1b0], eax
cmp dword [edi + 0x28], ebx
jne 0x41d349
mov esi, ebx
jmp 0x41d386
lea eax, [edi + 0x18]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0041efad
pop ecx
pop ecx
mov dword [ebp - 0x1ac], eax
push 2
pop ecx
or esi, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x1a4], esi
mov dword [ebp - 0x1b4], esi
jb 0x41d380
mov eax, dword [eax]
mov dword [ebp - 0x1ac], eax
mov esi, dword [ebp - 0x1ac]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0041efad
mov dword [ebp - 0x1ac], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 3
push edi
push eax
call fcn.0041efad
mov ecx, dword [ebp - 0x1ac]
add esp, 0x10
cmp dword [ecx + 0x14], 8
jb 0x41d3bb
mov ecx, dword [ecx]
cmp dword [eax + 0x14], 8
jb 0x41d3c3
mov eax, dword [eax]
push ebx
push dword [ebp - 0x1b0]
push ebx
push ebx
push ebx
push ecx
push 1
push dword [edi + 0x7c]
push dword [edi + 0x78]
push 0xf01ff
push esi
push eax
push dword [ebp - 0x1b8]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.00406687
lea ecx, [ebp - 0x58]
call fcn.00406687
mov eax, dword [ebp - 0x1a4]
test al, 2
je 0x41d422
and eax, 0xfffffffd
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1b4], eax
call fcn.00406687
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 4], ebx
test al, 1
je 0x41d443
and eax, 0xfffffffe
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1b4], eax
call fcn.00406687
test esi, esi
jne 0x41d6b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1bc], eax
cmp eax, 0x431
jne 0x41d654
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0041efad
pop ecx
pop ecx
cmp dword [eax + 0x14], 8
jb 0x41d479
mov eax, dword [eax]
push 0xf0003
push eax
push dword [ebp - 0x1b8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x1bc], esi
call fcn.00406687
test esi, esi
je 0x41d589
cmp dword [edi + 0x28], ebx
jne 0x41d4b9
mov esi, dword [ebp - 0x1a4]
mov dword [ebp - 0x1b0], ebx
jmp 0x41d4f2
lea eax, [edi + 0x18]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0041efad
pop ecx
pop ecx
mov dword [ebp - 0x1b0], eax
mov esi, dword [ebp - 0x1a4]
or esi, 4
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x1b4], esi
jb 0x41d4f2
mov eax, dword [eax]
mov dword [ebp - 0x1b0], eax
cmp dword [edi + 0x58], ebx
jne 0x41d4ff
mov dword [ebp - 0x1ac], ebx
jmp 0x41d535
lea eax, [edi + 0x48]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.0041efad
pop ecx
pop ecx
mov dword [ebp - 0x1ac], eax
or esi, 8
mov dword [ebp - 4], 5
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x1b4], esi
jb 0x41d535
mov eax, dword [eax]
mov dword [ebp - 0x1ac], eax
lea eax, [edi + 0x30]
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.0041efad
or esi, 0x10
pop ecx
pop ecx
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x1a4], esi
jb 0x41d558
mov eax, dword [eax]
push dword [ebp - 0x1b0]
mov esi, dword [ebp - 0x1bc]
push ebx
push dword [ebp - 0x1ac]
push ebx
push ebx
push ebx
push eax
push 1
push dword [edi + 0x7c]
push dword [edi + 0x78]
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov byte [ebp - 0x1a5], 1
test eax, eax
je 0x41d58f
mov byte [ebp - 0x1a5], bl
mov eax, dword [ebp - 0x1a4]
test al, 0x10
je 0x41d5b3
and eax, 0xffffffef
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x1a4], eax
call fcn.00406687
mov eax, dword [ebp - 0x1a4]
test al, 8
je 0x41d5d1
and eax, 0xfffffff7
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0x1a4], eax
call fcn.00406687
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 4], ebx
test al, 4
je 0x41d5e3
lea ecx, [ebp - 0xe8]
call fcn.00406687
cmp byte [ebp - 0x1a5], 0
je 0x41d6ae
push 1
push str.AgentErrors.log
lea ecx, [ebp - 0x1a0]
call fcn.0040bd69
lea eax, [ebp - 0x1a0]
mov byte [ebp - 4], 6
push str.Failed_to_change_service_config_for
push eax
call fcn.00401609
pop ecx
pop ecx
push 0x431
push str.winError
push edi
push eax
call fcn.004015e9
pop ecx
pop ecx
push eax
call fcn.00401609
pop ecx
pop ecx
mov ecx, eax
call fcn.004044df
lea ecx, [ebp - 0x1a0]
mov byte [ebp - 4], bl
call fcn.0040bf50
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, ebx
jmp 0x41d6ae
push 1
push str.AgentErrors.log
lea ecx, [ebp - 0x1a0]
call fcn.0040bd69
lea eax, [ebp - 0x1a0]
mov byte [ebp - 4], 7
push str.Failed_to_register_service_
push eax
call fcn.00401609
pop ecx
pop ecx
push dword [ebp - 0x1bc]
push str._due_to_error
push edi
push eax
call fcn.004015e9
pop ecx
pop ecx
push eax
call fcn.00401609
pop ecx
pop ecx
mov ecx, eax
call fcn.004044df
lea ecx, [ebp - 0x1a0]
mov byte [ebp - 4], bl
call fcn.0040bf50
test esi, esi
je 0x41d710
push esi
call fcn.004202bb
mov bl, al
pop ecx
test bl, bl
jne 0x41d709
push 1
push str.AgentErrors.log
lea ecx, [ebp - 0x1a0]
call fcn.0040bd69
lea eax, [ebp - 0x1a0]
mov byte [ebp - 4], 8
push str.Invalid_dacl_for_service_
push eax
call fcn.00401609
pop ecx
pop ecx
push 0x59ed3c
push edi
push eax
call fcn.004015e9
pop ecx
pop ecx
push eax
call fcn.00401609
pop ecx
pop ecx
lea ecx, [ebp - 0x1a0]
call fcn.0040bf50
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x1b8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [ebp - 0x28]
call fcn.00406661
mov al, bl
call fcn.00546649
ret