Function at 0x401a00
Capabilities:
Accept command line arguments
Create service
Persist via windows service
Query service status
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x68
mov eax, dword [0x414004]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
push edi
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x411e80
push eax
mov dword [esp + 0x2c], 0x401770
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x401bf0
lea eax, [esp + 0x10]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x14], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [esp + 0x10]
xor edx, edx
push eax
mov ecx, str.GetNewServiceName
call fcn.004010f0
mov esi, eax
add esp, 4
test esi, esi
js 0x401bc5
push 0x10000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0x10000000
push dword [esp + 0x1c]
mov esi, eax
push esi
mov dword [esp + 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x401ace
push 0x411e80
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 1
push 2
push 0x10
push 0xf01ff
push edi
push dword [esp + 0x44]
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [esp + 0xc]
push eax
push str.SystemCurrentControlSetControlSafeBootNetwork
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea eax, [esp + 8]
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call esi
mov eax, dword [esp + 8]
test eax, eax
jne 0x401b13
lea eax, [esp + 8]
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov eax, dword [esp + 8]
movups xmm0, xmmword [str.Service]
push 0x10
lea ecx, [esp + 0x54]
push ecx
push 1
push 0
push 0
push eax
movups xmmword [esp + 0x68], xmm0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [esp + 0x34]
push eax
push edi
call esi
test eax, eax
jne 0x401b6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00401cb3
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esp + 0x38], 4
je 0x401b7f
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
lea eax, [esp + 0x34]
push eax
push edi
call esi
test eax, eax
je 0x401bab
nop dword [eax + eax]
cmp dword [esp + 0x38], 2
jne 0x401bab
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x34]
push eax
push edi
call esi
test eax, eax
jne 0x401b90
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push dword [esp + 0x20]
call esi
cmp dword [esp + 0x38], 4
je 0x401be5
mov esi, dword [esp + 0x40]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00401cb3
mov esp, ebp
pop ebp
ret 0x10
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [esp + 0x6c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00401cb3
mov esp, ebp
pop ebp
ret 0x10