Function at 0x418c8b
Capabilities:
Create service
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00418c8b
xor esi, esi
xor edi, edi
mov ecx, 0x4a
push esi
dec ecx
jne 0x418ca7
push 0
push 0
push 0xf003f
mov edx, 0x18609c8
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
mov edx, 0x18609c8
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
call dword [sym.imp.ADVAPI32.DLL_OpenSCManagerA]
push eax
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 8
fldcw word [ebp - 0x10]
mov esi, eax
fild dword [0x186d6a4]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
jne 0x418d1b
jmp 0x4190ce
push 0
push 0
push 0
push 0
mov edx, 0x1860c10
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
push 0
mov edx, 0x1860bf0
call fcn.0045d0ba
lea ebx, [esp + 0x10]
call fcn.0045c36b
mov ebx, dword [ebp + 0xc]
push ebx
push 0
push 3
push 2
push 0xf01ff
mov ebx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 8]
push ebx
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_CreateServiceA]
push eax
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 8
fldcw word [ebp - 0x10]
mov edi, eax
cmp edi, 0
jne 0x418da1
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
fldcw word [ebp - 0x10]
jmp 0x4190ce
mov eax, edi
push eax
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_CloseServiceHandle]
fldcw word [ebp - 0x10]
mov edx, 0x1860c1c
call fcn.0045d0ba
mov ebx, dword [ebp + 8]
call fcn.0045ce8d
call fcn.0045c56d
mov edx, 0x1860c48
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [ebp - 0x1ac]
mov ecx, 0x104
call fcn.0045ced6
push 0
push 0
lea ebx, [ebp - 0xa8]
push ebx
lea ebx, [ebp - 0xa4]
push ebx
push 0
push 0xf003f
push 1
mov edx, 0x18609c8
call fcn.0045d0ba
lea ebx, [esp + 0x14]
call fcn.0045c36b
push 0
lea ebx, [ebp - 0x1ac]
push ebx
fild qword [0x186d0cc]
call fcn.0045c2a2
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x418e5b
jmp 0x4190ce
mov ebx, dword [ebp + 8]
call fcn.0045ce8d
mov edx, 0x1860c58
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [ebp - 0x1ac]
mov ecx, 0x104
call fcn.0045ced6
push 0
push 0
lea ebx, [ebp - 0x1ac]
call fcn.0045ce8d
call fcn.0045d088
push eax
lea ebx, [ebp - 0x1ac]
push ebx
push 1
push 0
mov edx, 0x1860c68
call fcn.0045d0ba
lea ebx, [esp + 0x10]
call fcn.0045c36b
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x418ef3
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
jmp 0x4190ce
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegFlushKey]
fldcw word [ebp - 0x10]
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
mov edx, 0x1860c1c
call fcn.0045d0ba
mov ebx, dword [ebp + 8]
call fcn.0045ce8d
call fcn.0045c56d
mov edx, 0x1860c7c
call fcn.0045d0ba
call fcn.0045c56d
mov ebx, dword [ebp + 8]
call fcn.0045ce8d
call fcn.0045c56d
mov edx, 0x1860c58
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [ebp - 0x1ac]
mov ecx, 0x104
call fcn.0045ced6
push 0
push 0
lea ebx, [ebp - 0xa8]
push ebx
lea ebx, [ebp - 0xa4]
push ebx
push 0
push 0xf003f
push 1
mov edx, 0x18609c8
call fcn.0045d0ba
lea ebx, [esp + 0x14]
call fcn.0045c36b
push 0
lea ebx, [ebp - 0x1ac]
push ebx
fild qword [0x186d0cc]
call fcn.0045c2a2
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x418fcf
jmp 0x4190ce
push 0
push 0
mov ebx, dword [ebp + 0x10]
call fcn.0045ce8d
call fcn.0045d088
push eax
mov ebx, dword [ebp + 0x10]
push ebx
push 1
push 0
mov edx, 0x1860c90
call fcn.0045d0ba
lea ebx, [esp + 0x10]
call fcn.0045c36b
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x41903a
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
jmp 0x4190ce
mov dword [ebp - 0xa8], 0
push 0
push 0
push 4
lea ebx, [ebp - 0xa8]
push ebx
push 4
push 0
mov edx, 0x1860ca0
call fcn.0045d0ba
lea ebx, [esp + 0x10]
call fcn.0045c36b
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x4190a6
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
jmp 0x4190ce
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegFlushKey]
fldcw word [ebp - 0x10]
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x98], 1
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc