Function at 0x444220
Capabilities:
Create process on windows
Create service
Persist via run registry key
Persist via windows service
Set registry value

Disassembly:
push edi
push esi
mov eax, 0x185c
call fcn.004639e0
mov edi, 0x476730
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x444243
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x44423b
lea edx, [esp]
neg eax
add eax, 0x7fe
push eax
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x444286
mov eax, dword [esp + 0x1868]
test eax, eax
jne 0x44427b
push 0x30
push dword [0x47e4cc]
push 0x4949c0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add esp, 0x185c
pop esi
pop edi
ret
lea edi, [esp]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x44429b
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x444293
mov esi, eax
mov edi, 0x476730
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4442b4
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x4442ac
lea edx, [esi + eax + 4]
cmp edx, 0x800
jae 0x44427b
lea edx, [esp + 0x800]
lea eax, [esp]
push 0x476730
push eax
push 0x4a2f34
push edx
call fcn.00463577
add esp, 0x10
mov eax, dword [0x493618]
cmp eax, 1
jne 0x44445a
lea eax, [esp + 0x1804]
push eax
push 0x4a2f3c
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x444331
mov eax, dword [esp + 0x1868]
test eax, eax
jne 0x44427b
push 0x30
push dword [0x47e4cc]
push 0x494940
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x44427b
lea edi, [esp + 0x800]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x44434a
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x444342
lea edx, [esp + 0x800]
inc eax
push eax
push edx
push 1
push 0
push dword [0x47e4cc]
push dword [esp + 0x1818]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4443a5
push dword [esp + 0x1804]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x1868]
test eax, eax
jne 0x44427b
push 0x30
push dword [0x47e4cc]
push 0x494900
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x44427b
push dword [esp + 0x1804]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x1868]
test eax, eax
jne 0x4443d2
push 0x40
push dword [0x47e4cc]
push 0x4939e0
call fcn.00445fbc
add esp, 0xc
mov dword [esp + 0x1808], 0x44
xor esi, esi
lea ecx, [esp + 0x800]
mov word [esp + 0x183a], si
lea edx, [esp + 0x1808]
lea eax, [esp + 0x184c]
mov dword [esp + 0x180c], esi
mov dword [esp + 0x183c], esi
mov dword [esp + 0x1834], esi
mov dword [esp + 0x1814], esi
push eax
push edx
push esi
push esi
push 0x20
push esi
push esi
push esi
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x44427b
mov eax, dword [esp + 0x1868]
test eax, eax
jne 0x44427b
push 0x10
push dword [0x47e4cc]
push 0x4948c0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x44427b
cmp eax, 2
jne 0x44427b
xor eax, eax
push 0xf003f
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x4444a1
mov eax, dword [esp + 0x1868]
test eax, eax
jne 0x44427b
push 0x30
push dword [0x47e4cc]
push 0x494840
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x44427b
lea ecx, [esp + 0x800]
xor edx, edx
push edx
push edx
push 0x4971f4
push edx
push edx
push ecx
push 1
push 2
push 0x110
push 0xf01ff
push 0x4a2f74
push 0x4a2d80
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov edi, eax
test edi, edi
je 0x444620
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [esp + 0x1000]
push eax
push 0x4a2f80
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x444530
mov eax, dword [esp + 0x1868]
test eax, eax
jne 0x44427b
push 0x30
push dword [0x47e4cc]
push 0x494780
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x444606
lea edi, [esp]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x444545
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x44453d
mov esi, eax
mov edi, 0x476720
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x44455e
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x444556
lea edx, [esi + eax + 4]
cmp edx, 0x800
jae 0x44427b
lea edx, [esp + 0x1004]
lea eax, [esp]
push 0x476720
push eax
push 0x4a2f34
push edx
call fcn.00463577
add esp, 0x10
lea edi, [esp + 0x1004]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4445a5
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x44459d
lea edx, [esp + 0x1004]
inc eax
push eax
push edx
push 1
push 0
push dword [0x47e4cc]
push dword [esp + 0x1014]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4445ea
mov eax, dword [esp + 0x1868]
test eax, eax
jne 0x4445ea
push 0x30
push dword [0x47e4cc]
push 0x494780
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [esp + 0x1000]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x1868]
test eax, eax
jne 0x44427b
push 0x40
push dword [0x47e4cc]
push 0x493900
call fcn.00445fbc
add esp, 0xc
jmp 0x44427b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x1868]
test edx, edx
jne 0x444664
cmp eax, 0x431
jne 0x44464f
push 0x30
push dword [0x47e4cc]
push 0x494800
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x444664
push 0x30
push dword [0x47e4cc]
push 0x494900
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x44427b