Function at 0x421598
Capabilities:
Check if file exists
Get file attributes
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x446a0c]
xor eax, dword [ebp + 4]
push ebx
xor ebx, ebx
cmp dword [ecx + 0x274], ebx
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0xc], ecx
je 0x4217c2
push 0x104
lea eax, [ebp - 0x11c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4217a0
lea eax, [ebp - 0x11c]
push 0x5c
push eax
call fcn.00413de1
cmp eax, ebx
pop ecx
pop ecx
jne 0x4215f4
lea eax, [ebp - 0x11c]
push edi
lea edi, [ebp - 0x11c]
mov byte [eax], bl
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x4215fe
mov esi, 0x421808
movsd dword es:[edi], dword [esi]
push 0xa
lea eax, [ebp - 0x18]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
movzx eax, ax
push eax
call fcn.0040ec67
lea edi, [ebp - 0x11c]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x42162c
mov edx, 0x4138f4
mov esi, edx
lea eax, [ebp - 0x18]
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x421642
lea edi, [ebp - 0x11c]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x421652
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x11c]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x42166f
mov esi, edx
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x11c]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x421682
mov esi, 0x4217fc
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x11c]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4216b8
push 0x104
lea eax, [ebp - 0x11c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0xc]
push 0xe
pop ecx
mov esi, 0x41d460
lea edi, [ebp - 0x220]
add eax, 0x150
rep movsd dword es:[edi], dword [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4216d2
lea edi, [ebp - 0x220]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x4216e2
mov ecx, eax
shr ecx, 2
push ebx
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x20006
push ebx
push 0x41d45c
push ebx
lea eax, [ebp - 0x220]
push eax
and ecx, 3
push 0x80000002
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
pop edi
jne 0x421790
lea eax, [ebp - 0x11c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x42172c
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
inc eax
push eax
lea eax, [ebp - 0x11c]
push eax
push 1
push ebx
push 0x4217e8
push dword [ebp - 8]
call esi
cmp eax, ebx
jne 0x421777
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push ebx
push 0x4217d8
push dword [ebp - 8]
mov dword [ebp - 0xc], 7
call esi
cmp eax, ebx
jne 0x421777
xor esi, esi
jmp 0x421785
jle 0x421783
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4217c7
jle 0x42179c
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x4217c7
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x4217b0
call esi
jmp 0x42179c
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x4217c7
mov esi, 0x80004005
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
mov eax, esi
pop esi
pop ebx
call fcn.004037c0
leave
ret