Function at 0x429950
Capabilities:
Check os version
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7eb7
mov eax, dword fs:[0]
push eax
sub esp, 0x310
mov eax, dword [0x4faee4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2f8], edx
mov dword [ebp - 0x304], ecx
mov eax, dword [ebp + 8]
xor esi, esi
push 2
push esi
push esi
mov dword [ebp - 0x300], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
mov dword [ebp - 0x308], edi
test edi, edi
jne 0x429a0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x230]
mov edx, esi
call fcn.0042aa30
push eax
push str.failed_to_open_service_control_manager._error:
push 0x500960
mov dword [ebp - 4], edi
call fcn.00428450
add esp, 8
push eax
call fcn.004286f0
push eax
call fcn.00428960
mov eax, dword [ebp - 0x21c]
add esp, 0xc
cmp eax, 0x10
jb 0x429d0b
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.004046a0
jmp 0x429d0b
push 0x208
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp - 0x2f8]
lea eax, [ebp - 0x218]
push 0
push 0
push 0
push 0
push 0
push eax
push 0
push 2
push 0x110
push 0xf01ff
call fcn.00403e00
mov ecx, dword [ebp - 0x304]
push eax
call fcn.00403e00
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x2fc], eax
test eax, eax
jne 0x429acc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x230]
mov edx, esi
call fcn.0042aa30
push eax
push str.failed_to_create_service._error:
push 0x500960
mov dword [ebp - 4], 1
call fcn.00428450
add esp, 8
push eax
call fcn.004286f0
push eax
call fcn.00428960
mov eax, dword [ebp - 0x21c]
add esp, 0xc
cmp eax, 0x10
jb 0x429d04
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.004046a0
jmp 0x429d04
push 0x90
lea eax, [ebp - 0x2f0]
mov dword [ebp - 0x2f4], 0x94
push 0
push eax
call fcn.00484970
add esp, 0xc
lea eax, [ebp - 0x2f4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x2e4], 2
jne 0x429cf2
cmp dword [ebp - 0x2f0], 5
jb 0x429cf2
push str.ADVAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x429c96
push str.ChangeServiceConfig2A
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2f8], eax
test eax, eax
je 0x429c31
mov ecx, dword [ebp - 0x300]
call fcn.00403e00
mov dword [ebp - 0x300], eax
lea eax, [ebp - 0x300]
push eax
push 1
push dword [ebp - 0x2fc]
call dword [ebp - 0x2f8]
xorps xmm0, xmm0
mov dword [ebp - 0x230], 1
movups xmmword [ebp - 0x318], xmm0
lea eax, [ebp - 0x230]
mov dword [ebp - 0x22c], 0x3e8
mov dword [ebp - 0x30c], eax
lea eax, [ebp - 0x31c]
push eax
push 2
push dword [ebp - 0x2fc]
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x224], 0x3e8
mov dword [ebp - 0x220], 1
mov dword [ebp - 0x21c], 0x3e8
mov dword [ebp - 0x310], 3
mov dword [ebp - 0x31c], 0xe10
call dword [ebp - 0x2f8]
test eax, eax
jne 0x429c8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x248]
mov edx, esi
call fcn.0042aa30
push eax
push str._service._error:
push dword [ebp - 0x304]
mov dword [ebp - 4], 2
push str.failed_to_change_parameters_of
push 0x500960
call fcn.00428450
add esp, 8
push eax
call fcn.004286f0
add esp, 8
push eax
jmp 0x429c58
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x248]
mov edx, esi
call fcn.0042aa30
push eax
push str.failed_to_get_address_of_ChangeServiceConfig2A_function._error:
mov dword [ebp - 4], 3
push 0x500960
call fcn.00428450
add esp, 8
push eax
call fcn.004286f0
push eax
call fcn.00428960
mov eax, dword [ebp - 0x234]
add esp, 0xc
cmp eax, 0x10
jb 0x429c8d
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.004046a0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x429cf2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x260]
mov edx, esi
call fcn.0042aa30
push eax
push str.failed_to_load_ADVAPI32.DLL_library._error:
push 0x500960
mov dword [ebp - 4], 4
call fcn.00428450
add esp, 8
push eax
call fcn.004286f0
push eax
call fcn.00428960
mov eax, dword [ebp - 0x24c]
add esp, 0xc
cmp eax, 0x10
jb 0x429cf2
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.004046a0
push dword [ebp - 0x2fc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [ebp - 0x308]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00464228
mov esp, ebp
pop ebp
ret