Function at 0x423fa0
Capabilities:
Create process on windows
Create service
Persist via run registry key
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x568
lea eax, [esp + 0x58]
push ebp
push 0x104
xor ebp, ebp
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x423fe2
push 0x2710
push 0x30
push 0x44f3c0
push 0x451f7c
push ebp
call fcn.00429240
add esp, 0x14
xor eax, eax
pop ebp
add esp, 0x568
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
lea ecx, [esp + 0x64]
push 0x446040
push ecx
call ebx
lea edx, [esp + 0x64]
push 0x441e94
push edx
call ebx
mov eax, dword [0x45bb80]
dec eax
je 0x424151
dec eax
jne 0x42421b
push 0xf003f
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebp
jne 0x42403e
push 0x2710
push 0x30
push 0x44f3c0
push 0x451f30
jmp 0x424212
push esi
push ebp
push ebp
push 0x4571f0
push ebp
lea eax, [esp + 0x78]
push ebp
push eax
push 1
push 2
push 0x110
push 0xf01ff
push 0x44f3c0
push 0x44f548
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
cmp esi, ebp
jne 0x4240de
lea ecx, [esp + 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x274]
push 0x451f00
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x2710
push 0x30
lea eax, [esp + 0x284]
push 0x44f3c0
push eax
push ebp
call fcn.00429240
push 0x2710
push 0x30
push 0x44f3c0
push 0x451ed0
push ebp
call fcn.00429240
add esp, 0x38
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop esi
pop edi
pop ebx
xor eax, eax
pop ebp
add esp, 0x568
ret
lea ecx, [esp + 0x16c]
push 0x451e98
push ecx
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x16c]
push 0x44f548
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x16c]
push eax
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x424138
call fcn.00424730
push ebp
push ebp
push 0x44f3c0
push 0x64
push 4
call fcn.004246a0
add esp, 0x14
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop esi
pop edi
pop ebx
xor eax, eax
pop ebp
add esp, 0x568
ret
lea edx, [esp + 0xc]
push edx
push 0x451e60
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x42421b
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 0xc]
inc eax
lea ecx, [esp + 0x64]
push eax
push ecx
push 1
push ebp
push 0x44f548
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4241b5
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x2710
push 0x30
push 0x44f3c0
push 0x451e20
jmp 0x424212
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x54]
lea eax, [esp + 0x10]
push edx
push eax
push ebp
push ebp
push 0x20
push ebp
push ebp
lea ecx, [esp + 0x80]
push ebp
push ecx
push ebp
mov dword [esp + 0x38], 0x44
mov word [esp + 0x6a], bp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x64], ebp
mov dword [esp + 0x44], ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x42421b
push 0x2710
push 0x10
push 0x44f3c0
push 0x451df4
push ebp
call fcn.00429240
add esp, 0x14
pop edi
pop ebx
xor eax, eax
pop ebp
add esp, 0x568
ret