Function at 0x418c8b
Capabilities:
Create service
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00418c8b
xor esi, esi
xor edi, edi
mov ecx, 0x4a
push esi
dec ecx
jne 0x418ca7
push 0
push 0
push 0xf003f
mov edx, 0x185e9a0
call fcn.0045b687
lea ebx, [esp + 8]
call fcn.0045a938
mov edx, 0x185e9a0
call fcn.0045b687
lea ebx, [esp + 8]
call fcn.0045a938
call dword [sym.imp.ADVAPI32.DLL_OpenSCManagerA]
push eax
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00456355
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 8
fldcw word [ebp - 0x10]
mov esi, eax
fild dword [0x186b388]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
jne 0x418d1b
jmp 0x4190ce
push 0
push 0
push 0
push 0
mov edx, 0x185ebd8
call fcn.0045b687
lea ebx, [esp + 0xc]
call fcn.0045a938
push 0
mov edx, 0x185ebb8
call fcn.0045b687
lea ebx, [esp + 0x10]
call fcn.0045a938
mov ebx, dword [ebp + 0xc]
push ebx
push 0
push 3
push 2
push 0xf01ff
mov ebx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 8]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_CreateServiceA]
push eax
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00456355
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 8
fldcw word [ebp - 0x10]
mov edi, eax
cmp edi, 0
jne 0x418da1
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
fldcw word [ebp - 0x10]
jmp 0x4190ce
mov eax, edi
push eax
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
fldcw word [ebp - 0x10]
mov edx, 0x185ebe4
call fcn.0045b687
mov ebx, dword [ebp + 8]
call fcn.0045b45a
call fcn.0045ab3a
mov edx, 0x185ec10
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [ebp - 0x1ac]
mov ecx, 0x104
call fcn.0045b4a3
push 0
push 0
lea ebx, [ebp - 0xa8]
push ebx
lea ebx, [ebp - 0xa4]
push ebx
push 0
push 0xf003f
push 1
mov edx, 0x185e9a0
call fcn.0045b687
lea ebx, [esp + 0x14]
call fcn.0045a938
push 0
lea ebx, [ebp - 0x1ac]
push ebx
fild qword [0x186adc4]
call fcn.0045a86f
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x418e5b
jmp 0x4190ce
mov ebx, dword [ebp + 8]
call fcn.0045b45a
mov edx, 0x185ec20
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [ebp - 0x1ac]
mov ecx, 0x104
call fcn.0045b4a3
push 0
push 0
lea ebx, [ebp - 0x1ac]
call fcn.0045b45a
call fcn.0045b655
push eax
lea ebx, [ebp - 0x1ac]
push ebx
push 1
push 0
mov edx, 0x185ec30
call fcn.0045b687
lea ebx, [esp + 0x10]
call fcn.0045a938
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x418ef3
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
jmp 0x4190ce
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegFlushKey]
fldcw word [ebp - 0x10]
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
mov edx, 0x185ebe4
call fcn.0045b687
mov ebx, dword [ebp + 8]
call fcn.0045b45a
call fcn.0045ab3a
mov edx, 0x185ec44
call fcn.0045b687
call fcn.0045ab3a
mov ebx, dword [ebp + 8]
call fcn.0045b45a
call fcn.0045ab3a
mov edx, 0x185ec20
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [ebp - 0x1ac]
mov ecx, 0x104
call fcn.0045b4a3
push 0
push 0
lea ebx, [ebp - 0xa8]
push ebx
lea ebx, [ebp - 0xa4]
push ebx
push 0
push 0xf003f
push 1
mov edx, 0x185e9a0
call fcn.0045b687
lea ebx, [esp + 0x14]
call fcn.0045a938
push 0
lea ebx, [ebp - 0x1ac]
push ebx
fild qword [0x186adc4]
call fcn.0045a86f
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x418fcf
jmp 0x4190ce
push 0
push 0
mov ebx, dword [ebp + 0x10]
call fcn.0045b45a
call fcn.0045b655
push eax
mov ebx, dword [ebp + 0x10]
push ebx
push 1
push 0
mov edx, 0x185ec58
call fcn.0045b687
lea ebx, [esp + 0x10]
call fcn.0045a938
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x41903a
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
jmp 0x4190ce
mov dword [ebp - 0xa8], 0
push 0
push 0
push 4
lea ebx, [ebp - 0xa8]
push ebx
push 4
push 0
mov edx, 0x185ec68
call fcn.0045b687
lea ebx, [esp + 0x10]
call fcn.0045a938
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x4190a6
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
jmp 0x4190ce
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegFlushKey]
fldcw word [ebp - 0x10]
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x98], 1
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc