Function at 0x4652a8
Capabilities:
Create process on windows
Create service
Persist via run registry key
Persist via windows service
Set registry value

Disassembly:
push edi
push esi
push ebx
push eax
mov eax, 0x1858
call fcn.00486680
mov eax, dword [esp + 0x1858]
mov esi, eax
lea edx, [esp + 0x1054]
push 0x7f6
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4652fd
test esi, esi
jne 0x4652f1
push 0x30
push dword [0x4a0328]
push 0x4b4c20
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add esp, 0x185c
pop ebx
pop esi
pop edi
ret
lea edi, [esp + 0x1054]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x465316
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x46530e
add eax, 0xc
cmp eax, 0x800
jae 0x4652f1
lea ecx, [esp + 0x800]
lea edx, [esp + 0x1054]
push 0x498600
push edx
push 0x4c6314
push ecx
call fcn.00486227
add esp, 0x10
mov edx, dword [0x4b4ab0]
cmp edx, 1
jne 0x465498
lea edx, [esp + 0x1858]
push edx
push 0x4c631c
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x46538b
test esi, esi
jne 0x4652f1
push 0x30
push dword [0x4a0328]
push 0x4b4c60
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4652f1
lea edi, [esp + 0x800]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4653a4
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x46539c
inc eax
push eax
push edi
push 1
push 0
push dword [0x4a0328]
push dword [esp + 0x186c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4653f1
push dword [esp + 0x1858]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4652f1
push 0x30
push dword [0x4a0328]
push 0x4b4ce0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4652f1
push dword [esp + 0x1858]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x465417
push 0x40
push dword [0x4a0328]
push 0x4b5b60
call fcn.0046768c
add esp, 0xc
mov dword [esp + 0x1000], 0x44
xor edi, edi
lea ebx, [esp + 0x800]
mov word [esp + 0x1032], di
lea ecx, [esp + 0x1000]
lea edx, [esp + 0x1044]
mov dword [esp + 0x1004], edi
mov dword [esp + 0x1034], edi
mov dword [esp + 0x102c], edi
mov dword [esp + 0x100c], edi
push edx
push ecx
push edi
push edi
push 0x20
push edi
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4652f1
test esi, esi
jne 0x4652f1
push 0x10
push dword [0x4a0328]
push 0x4b4d20
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4652f1
cmp edx, 2
jne 0x4652f1
push 0xf003f
xor edx, edx
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x4654d8
test esi, esi
jne 0x4652f1
push 0x30
push dword [0x4a0328]
push 0x4b4d60
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4652f1
lea ecx, [esp + 0x800]
xor edx, edx
push edx
push edx
push 0x4b82ac
push edx
push edx
push ecx
push 1
push 2
push 0x110
push 0xf01ff
push 0x4c6354
push 0x4c6160
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov edi, eax
test edi, edi
je 0x465620
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea edx, [esp + 0x1854]
push edx
push 0x4c6360
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x465560
test esi, esi
jne 0x4652f1
push 0x30
push dword [0x4a0328]
push 0x4b4e20
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x465606
lea edi, [esp + 0x1054]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x465579
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x465571
add eax, 0x12
cmp eax, 0x800
jae 0x4652f1
lea ecx, [esp]
lea edx, [esp + 0x1054]
push 0x49860c
push edx
push 0x4c6314
push ecx
call fcn.00486227
add esp, 0x10
lea edi, [esp]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4655ba
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x4655b2
inc eax
push eax
push edi
push 1
push 0
push dword [0x4a0328]
push dword [esp + 0x1868]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4655f1
test esi, esi
jne 0x4655f1
push 0x30
push dword [0x4a0328]
push 0x4b4e20
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [esp + 0x1854]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4652f1
push 0x40
push dword [0x4a0328]
push 0x4b5c40
call fcn.0046768c
add esp, 0xc
jmp 0x4652f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x46565d
cmp eax, 0x431
jne 0x465648
push 0x30
push dword [0x4a0328]
push 0x4b4de0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x46565d
push 0x30
push dword [0x4a0328]
push 0x4b4ce0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4652f1