Function at 0x43b150
Capabilities:
Check if file exists
Create service
Get file attributes
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493cfc
mov eax, dword fs:[0]
push eax
sub esp, 0x284
mov eax, dword [0x4c1280]
xor eax, ebp
mov dword [ebp - 0x30], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x280], ecx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
xor eax, eax
mov word [ebp - 0x23c], ax
push 0x206
push 0
lea ecx, [ebp - 0x23a]
push ecx
call fcn.00472990
add esp, 0xc
cmp dword [0x4c36bc], 0
je 0x43b1f5
mov edx, dword [0x4c36a0]
push edx
push str._sx64SClientSvc.exe
push 0x104
lea eax, [ebp - 0x23c]
push eax
call fcn.00474cf2
add esp, 0x10
jmp 0x43b215
mov ecx, dword [0x4c36a0]
push ecx
push str._sSClientSvc.exe
push 0x104
lea edx, [ebp - 0x23c]
push edx
call fcn.00474cf2
add esp, 0x10
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43b344
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x43b26a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x49e5a0
push 0x49e594
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0xc
jmp 0x43b5c5
push 4
push 0x49e5e8
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x43b333
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x43b30a
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x23c]
push edx
push 1
push 3
push 0x10
push 0xf01ff
push 0x49e600
push 0x49e618
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x43b2f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_create_service_SClientSvc__0x_x
push 0x49e630
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0xc
jmp 0x43b5c5
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x18], 0
jmp 0x43b331
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x49e69c
push str.OpenService__s_error:0x_x
push 0x49e63c
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0x10
jmp 0x43b344
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x18], 0
cmp dword [0x4c36bc], 0
jne 0x43b359
mov dword [ebp - 0x20], 1
jmp 0x43b5c5
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [0x4c36bc]
neg ecx
sbb ecx, ecx
and ecx, 0x100
add ecx, 0xf003f
push ecx
push 0
push 0x49e6e8
push 0x49e700
lea ecx, [ebp - 0x258]
call fcn.00401c70
mov dword [ebp - 0x284], eax
mov edx, dword [ebp - 0x284]
mov dword [ebp - 0x288], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x288]
push eax
lea ecx, [ebp - 0x274]
push ecx
call fcn.00444a70
add esp, 0xc
mov dword [ebp - 0x28c], eax
mov edx, dword [ebp - 0x28c]
mov dword [ebp - 0x290], edx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x290]
call fcn.00401ff0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x274]
call fcn.00401ce0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.00401ce0
cmp dword [ebp - 0x24], 0
je 0x43b43a
mov eax, dword [ebp - 0x24]
push eax
push 0x49e754
push 0x49e76c
push 0x49e748
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0x10
jmp 0x43b5c5
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
push ecx
push 0
lea edx, [ebp - 0x28]
push edx
push 0
push 0x49e78c
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x43b48e
mov ecx, dword [ebp - 0x24]
push ecx
push 0x49e7ac
push 0x49e7c4
push 0x49e7a0
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0x10
jmp 0x43b5c5
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0047159e
add esp, 4
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
lea eax, [ebp - 0x28]
push eax
push 0
push 0x49e7e8
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x43b508
mov edx, dword [ebp - 0x24]
push edx
push 0x49e808
push 0x49e820
push 0x49e7fc
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0x10
jmp 0x43b5c5
push 0x208
push 0
lea eax, [ebp - 0x23c]
push eax
call fcn.00472990
add esp, 0xc
mov ecx, dword [0x4c36a0]
push ecx
push str._sx64SolidifySrv.exe
push 0x104
lea edx, [ebp - 0x23c]
push edx
call fcn.00474cf2
add esp, 0x10
lea eax, [ebp - 0x23c]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00476593
add esp, 8
test eax, eax
jne 0x43b55e
mov dword [ebp - 0x20], 1
jmp 0x43b5c5
lea edx, [ebp - 0x23c]
push edx
call fcn.00472967
add esp, 4
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x23c]
push ecx
push 1
push 0
push 0x49e874
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x43b5b6
mov eax, dword [ebp - 0x24]
push eax
push str.RegSetValueEx__ld
push 0x49e888
call fcn.00401340
add esp, 4
push eax
call fcn.00401590
add esp, 0xc
jmp 0x43b5c5
mov dword [ebp - 0x20], 1
xor ecx, ecx
jne 0x43b1ab
cmp dword [ebp - 0x18], 0
je 0x43b5dc
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x10], 0
je 0x43b5f3
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x1c], 0
je 0x43b618
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x27c]
push edx
call fcn.0047311d
add esp, 4
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x14], 0
je 0x43b62f
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.00472a79
mov esp, ebp
pop ebp
ret