Function at 0x423e00
Capabilities:
Create process on windows
Create service
Persist via run registry key
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x568
lea eax, [esp + 0x58]
push ebp
push 0x104
xor ebp, ebp
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x423e42
push 0x2710
push 0x30
push 0x44e3b4
push 0x450f70
push ebp
call fcn.00429040
add esp, 0x14
xor eax, eax
pop ebp
add esp, 0x568
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
lea ecx, [esp + 0x64]
push 0x445040
push ecx
call ebx
lea edx, [esp + 0x64]
push 0x440e8c
push edx
call ebx
mov eax, dword [0x45aae8]
dec eax
je 0x423fb1
dec eax
jne 0x42407b
push 0xf003f
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebp
jne 0x423e9e
push 0x2710
push 0x30
push 0x44e3b4
push 0x450f24
jmp 0x424072
push esi
push ebp
push ebp
push 0x456160
push ebp
lea eax, [esp + 0x78]
push ebp
push eax
push 1
push 2
push 0x110
push 0xf01ff
push 0x44e3b4
push 0x44e53c
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
cmp esi, ebp
jne 0x423f3e
lea ecx, [esp + 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x274]
push 0x450ef4
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x2710
push 0x30
lea eax, [esp + 0x284]
push 0x44e3b4
push eax
push ebp
call fcn.00429040
push 0x2710
push 0x30
push 0x44e3b4
push 0x450ec4
push ebp
call fcn.00429040
add esp, 0x38
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop esi
pop edi
pop ebx
xor eax, eax
pop ebp
add esp, 0x568
ret
lea ecx, [esp + 0x16c]
push 0x450e8c
push ecx
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x16c]
push 0x44e53c
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x16c]
push eax
push ecx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x423f98
call fcn.00424590
push ebp
push ebp
push 0x44e3b4
push 0x64
push 4
call fcn.00424500
add esp, 0x14
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop esi
pop edi
pop ebx
xor eax, eax
pop ebp
add esp, 0x568
ret
lea edx, [esp + 0xc]
push edx
push 0x450e54
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x42407b
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 0xc]
inc eax
lea ecx, [esp + 0x64]
push eax
push ecx
push 1
push ebp
push 0x44e53c
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x424015
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x2710
push 0x30
push 0x44e3b4
push 0x450e14
jmp 0x424072
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x54]
lea eax, [esp + 0x10]
push edx
push eax
push ebp
push ebp
push 0x20
push ebp
push ebp
lea ecx, [esp + 0x80]
push ebp
push ecx
push ebp
mov dword [esp + 0x38], 0x44
mov word [esp + 0x6a], bp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x64], ebp
mov dword [esp + 0x44], ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x42407b
push 0x2710
push 0x10
push 0x44e3b4
push 0x450de8
push ebp
call fcn.00429040
add esp, 0x14
pop edi
pop ebx
xor eax, eax
pop ebp
add esp, 0x568
ret