Function at 0x4461d0
Capabilities:
Create process on windows
Create service
Persist via run registry key
Persist via windows service
Set registry value
Start service

Disassembly:
sub esp, 0x77c
mov al, byte [0x481910]
push ebp
push edi
mov byte [esp + 0x6c], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x6d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0042b620
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor edi, edi
test eax, eax
push 0x104
je 0x446324
lea ecx, [esp + 0x70]
push ecx
call fcn.0042b660
add esp, 8
test eax, eax
jne 0x44624e
cmp dword [esp + 0x78c], edi
je 0x446357
push 0x2710
push 0x30
push 0x474e90
push 0x47cc28
push edi
call fcn.0042f2f0
add esp, 0x14
xor eax, eax
pop edi
pop ebp
add esp, 0x77c
ret
lea edx, [esp + 0x6c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [esp + eax + 0x6b], 0x5c
je 0x446277
push 0x104
lea eax, [esp + 0x70]
push 0x4695f4
push eax
call fcn.0042f1f0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x70]
push 0x4754d4
push ecx
call fcn.0042f1f0
add esp, 0xc
push ebx
push esi
push 0x104
lea eax, [esp + 0x78]
push 0x46f070
push eax
call fcn.0042f1f0
push 0x104
lea ecx, [esp + 0x84]
push 0x462e4c
push ecx
call fcn.0042f1f0
mov eax, dword [0x4865d4]
add esp, 0x18
dec eax
je 0x4465a8
dec eax
jne 0x446688
push edi
call fcn.004466a0
add esp, 4
test eax, eax
jne 0x4462ee
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call esi
push 0x7d
call esi
push edi
call esi
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
cmp ebx, edi
jne 0x446362
cmp dword [esp + 0x794], edi
je 0x446688
push 0x2710
push 0x30
push 0x474e90
push 0x47cbdc
jmp 0x44667f
lea edx, [esp + 0x70]
push edx
push edi
call ebp
test eax, eax
jne 0x44628e
cmp dword [esp + 0x78c], edi
je 0x446357
push 0x2710
push 0x30
push 0x474e90
push 0x47cbbc
push edi
call fcn.0042f2f0
add esp, 0x14
pop edi
xor eax, eax
pop ebp
add esp, 0x77c
ret
mov eax, dword [0x4865d4]
mov ecx, 0x110
cmp eax, 2
jne 0x44637f
cmp dword [0x4865d0], 6
jb 0x44637f
mov ecx, 0x10
mov eax, dword [esp + 0x790]
cmp eax, 2
je 0x446395
cmp eax, 3
je 0x446395
mov eax, 2
push edi
push edi
push 0x481910
push edi
lea edx, [esp + 0x84]
push edi
push edx
push 1
push eax
push ecx
push 0xf01ff
push 0x474e90
push 0x47343c
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
cmp eax, edi
mov dword [esp + 0x10], eax
jne 0x44642d
cmp dword [esp + 0x794], edi
je 0x44658b
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x488]
push 0x47cb8c
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x2710
push 0x30
lea edx, [esp + 0x498]
push 0x474e90
push edx
push edi
call fcn.0042f2f0
push 0x2710
push 0x30
push 0x474e90
push 0x47cb5c
push edi
call fcn.0042f2f0
add esp, 0x38
jmp 0x44658b
push 0x100
lea eax, [esp + 0x384]
push 0x47c9a0
push eax
mov dword [esp + 0x24], edi
call fcn.0042f1a0
push 0x100
lea ecx, [esp + 0x390]
push 0x47343c
push ecx
call fcn.0042f1f0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
add esp, 0x18
lea edx, [esp + 0x18]
lea eax, [esp + 0x380]
push edx
push eax
push reloc.WSOCK32.dll_bind
call esi
test eax, eax
jne 0x44655f
cmp dword [0x4865d4], 1
je 0x44654c
lea ecx, [esp + 0x27c]
push 0x104
push ecx
push edi
call ebp
test eax, eax
je 0x44654c
push 0x104
lea edx, [esp + 0x17c]
push 0x47c9a0
push edx
mov dword [esp + 0x20], edi
call fcn.0042f1a0
push 0x104
lea eax, [esp + 0x188]
push 0x47343c
push eax
call fcn.0042f1f0
add esp, 0x18
lea ecx, [esp + 0x14]
lea edx, [esp + 0x178]
push ecx
push edx
push reloc.WSOCK32.dll_bind
call esi
test eax, eax
jne 0x44654c
lea eax, [esp + 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
lea ecx, [esp + 0x27c]
push eax
push ecx
push 2
push edi
push 0x47c98c
push edx
call esi
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push 4
push eax
push 4
push edi
push 0x47c97c
push ecx
mov dword [esp + 0x34], 0x1f
call esi
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push edi
push 0x474e90
push 0x64
push 4
call fcn.00446f40
add esp, 0x14
cmp dword [0x4865d4], 2
jne 0x44657e
cmp dword [0x4865d0], 5
jb 0x44657e
lea eax, [esp + 0x10]
push eax
call fcn.0042dc60
add esp, 4
mov ecx, dword [esp + 0x10]
push edi
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x77c
ret
lea eax, [esp + 0x10]
push eax
push 0x47cb24
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x446688
lea ecx, [esp + 0x74]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
lea edx, [esp + 0x74]
push eax
mov eax, dword [esp + 0x14]
push edx
push 1
push edi
push 0x47343c
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x446619
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x794], edi
je 0x446688
push 0x2710
push 0x30
push 0x474e90
push 0x47cae4
jmp 0x44667f
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x64]
lea ecx, [esp + 0x20]
push eax
push ecx
push edi
push edi
push 0x20
push edi
push edi
lea edx, [esp + 0x90]
push edi
push edx
push edi
mov dword [esp + 0x48], 0x44
mov word [esp + 0x7a], di
mov dword [esp + 0x4c], edi
mov dword [esp + 0x7c], edi
mov dword [esp + 0x74], edi
mov dword [esp + 0x54], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x446688
cmp dword [esp + 0x794], edi
je 0x446688
push 0x2710
push 0x10
push 0x474e90
push 0x47cab8
push edi
call fcn.0042f2f0
add esp, 0x14
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x77c
ret