Function at 0x413f80
Capabilities:
Create service
Get common file path
Modify service
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dd5ac
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x278], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x270], eax
xor eax, eax
mov dword [ebp - 0x26c], esi
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp word [edx], ax
jne 0x413ff5
xor ecx, ecx
jmp 0x414015
mov ecx, edx
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414000
sub ecx, esi
mov esi, dword [ebp - 0x26c]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x230]
call fcn.00402ac0
lea eax, [ebp - 0x264]
mov dword [ebp - 4], 0
push eax
push 3
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x264], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4140fa
mov edx, esi
lea ecx, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x414060
sub edx, ecx
lea ecx, [ebp - 0x230]
sar edx, 1
cmp dword [ebp - 0x21c], 8
cmovae ecx, dword [ebp - 0x230]
lea eax, [edx*2 + 2]
push eax
push esi
push 7
push 0
push ecx
push dword [ebp - 0x264]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4140fa
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004520bc
test al, al
je 0x4140d5
sti
loope 0x414104
in al, dx
add al, 0x4b
xor dh, byte [edx]
and dword [esi + 0x104bd5c6], 0x20
imul edx, dword [ebp - 0x2044926d], 0x1c815673
leave
lodsb al, byte [esi]
and ecx, edx
daa
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x280], ebx
test ebx, ebx
jne 0x41413a
push 0x7a
call fcn.004587ef
add esp, 4
xor esi, esi
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x41411a
or byte [edx + 0x13], dh
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.00402c10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d802
mov esp, ebp
pop ebp
ret 0x14
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00480620
add esp, 0xc
lea ecx, [ebp - 0x248]
push 0x5e6948
call fcn.00404060
lea ecx, [ebp - 0x2a4]
mov byte [ebp - 4], 1
call fcn.0046432a
lea ecx, [ebp - 0x2a4]
mov byte [ebp - 4], 2
call fcn.004643f0
test eax, eax
lea eax, [ebp - 0x218]
push 0x104
push eax
je 0x414196
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x41419c
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.004042f0
push str._svchost.exe__k
lea ecx, [ebp - 0x248]
call fcn.0040aa00
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x248]
call fcn.00405b10
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push 0
cmovae eax, dword [ebp - 0x248]
push 0
push 0
push 0
push 0
push eax
push 1
push 2
push 0x20
push 0xf01ff
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, eax
mov dword [ebp - 0x27c], ebx
test ebx, ebx
jne 0x414224
push 0x7b
call fcn.004587ef
add esp, 4
xor esi, esi
jmp 0x41445a
call fcn.00451f63
test al, al
je 0x41423d
salc
sbb bl, byte [ecx - 0x35]
add byte [0xca89b00], ah
mov al, 0x40
cmp dl, byte [edi]
add byte [edx], dl
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x274]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
call fcn.004523f8
test al, al
je 0x41427f
fld qword [ebp + 0x55]
push es
dec eax
push ebp
xor byte [ebp + ebp*2 - 0x234aee13], 0x75
idiv dword [edx + eax*2]
mov ch, 0xc2
pop esi
jle 0x414275
xor byte [ebp + 0x57cf5914], ch
cmp al, 0xe8
mov dl, ah
add eax, dword [eax]
call fcn.0045250c
test al, al
je 0x4142a6
and ah, ah
dec edx
add eax, 0x8881a04b
xchg ebp, eax
cmp dword [edi + 0x1debad80], eax
leave
sub cl, byte [esp + ebp*4 - 0x2f7d6e00]
xor dword [ebx + 0x28a5be0], 0x59
push str.SYSTEMCurrentControlSetServices_
lea ecx, [ebp - 0x260]
call fcn.00404060
push dword [ebp - 0x26c]
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 3
call fcn.0040aa00
cmp dword [ebp - 0x24c], 8
lea ecx, [ebp - 0x264]
push ecx
push 0xf003f
lea eax, [ebp - 0x260]
cmovae eax, dword [ebp - 0x260]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41444d
std
invalid
inc ebx
test dword [eax + 0x6afffffd], esp
add byte [eax + 0x68], dl
add al, byte [eax]
add byte [eax + 0x600c15ff], al
pop esi
add byte [ebp + 0x4c850fc0], al
add dword [eax], eax
add al, ch
loopne 0x414308
call fcn.004523f8
test al, al
add byte [eax + eax*8 + 0x64861b74], al
push eax
mov dword [eax - 0x95bde34], ecx
or byte gs:[ecx - 0x22], ah
je 0x414325
xchg byte [eax + edx*2 - 0x77], ah
mov ah, cl
and dword [esi + esi*8 - 0x219ef79b], esp
movsb byte es:[edi], byte [esi]
mov byte [0xb7a657ba], al
nop
jno 0x4142d5
adc al, 0xf7
sal dl, 1
sub eax, 0x3df30e8
add byte [eax + eax*8 + 0x50b61574], al
call fcn.0045225a
test al, al
je 0x414343
mov dh, 0x50
add dword [ebp - 0x7991c918], ebx
into
jno 0x4142e5
xchg ebp, eax
std
cmc
pop eax
xor byte [ecx + edx*8 - 0x1702262c], bh
imul esp, eax, 3
add byte [eax + eax*8 - 0x9cbed8c], al
call fcn.004523b3
test al, al
je 0x41435e
xor al, 0xf6
add cl, byte [ebx - 0x7e]
ljmp 0xe136
call fcn.00452215
test al, al
je 0x414382
push cs
xchg esp, eax
test dword [esi], edx
sahf
jns 0x4143ca
xchg edx, eax
movsb byte es:[edi], byte [esi]
cmpsb byte [esi], byte es:[edi]
mov ah, 0xb
fistp qword [edx]
sti
fldcw word [ebx + 0x4f064c8d]
push ecx
hlt
call fcn.004520bc
test al, al
je 0x4143a9
mov esp, 0x5949fb4d
mov al, byte [0x1cd58eb8]
inc edx
retf
lea eax, [ebp - 0x268]
mov dword [ebp - 0x268], 0
push eax
push str.Parameters
push dword [ebp - 0x264]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x41444d
add byte [ebp - 0x74818a40], al
lea ecx, [eax - 0x7c000003]
jns 0x4143ec
mov ecx, dword [ebp - 0x278]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x4143e0
or byte [ebx + 0x2721041], cl
mov ecx, dword [ecx]
lea eax, [eax*2 + 2]
push eax
push ecx
push 2
push 0
push str.ServiceDll
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x41444d
add byte [eax + 0x30], ch
jge 0x41444f
add bh, bh
mov ch, 0x98
std
invalid
mov esi, dword [ebp - 0x27c]
push eax
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x41441f
push 0x7c
call fcn.004587ef
add esp, 4
push dword [ebp - 0x264]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x268]
call edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x280]
call esi
mov esi, 1
jmp 0x41444f
xor esi, esi
lea ecx, [ebp - 0x260]
call fcn.00447330
lea ecx, [ebp - 0x2a4]
call fcn.0046433d
lea ecx, [ebp - 0x248]
call fcn.00447330
jmp 0x4140fc