Function at 0x43a210
Capabilities:
Create process on windows
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x864
mov eax, dword [0x4bd450]
xor eax, esp
mov dword [esp + 0x860], eax
push esi
xor eax, eax
push 0x7fe
mov esi, ecx
push eax
lea ecx, [esp + 0x6a]
push ecx
mov word [esp + 0x6c], ax
call fcn.00476ef0
push str.ignore
push 0x4a9750
push str.auto
push 0x4a22c0
push esi
push 0x4a22c0
push str.sc_create__s_binPath___s__DisplayName___s__start__s_type__s_error__s
lea edx, [esp + 0x88]
push 0x400
push edx
call fcn.00472300
push 0x44
lea eax, [esp + 0x4c]
push 0
push eax
call fcn.00476ef0
mov esi, dword [sym.imp.KERNEL32.dll_CreateProcessW]
add esp, 0x3c
xor eax, eax
xor ecx, ecx
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 8], eax
lea eax, [esp + 0x1c]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov word [esp + 0x68], cx
lea ecx, [esp + 0x80]
push ecx
push 0
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x6c], 0x81
call esi
test eax, eax
je 0x43a33c
mov edx, dword [esp + 8]
push 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 4], eax
test eax, eax
jne 0x43a317
mov ecx, dword [esp + 8]
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 4]
test eax, eax
je 0x43a320
cmp eax, 0x431
je 0x43a320
add eax, 0x7a120
jmp 0x43a31c
add eax, 0x61a80
mov dword [esp + 4], eax
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 4]
jmp 0x43a34b
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0x493e0
mov dword [esp + 4], eax
test eax, eax
je 0x43a35a
cmp eax, 0x431
jne 0x43a459
push 0x800
lea ecx, [esp + 0x64]
push 0
push ecx
call fcn.00476ef0
push 0x44
lea edx, [esp + 0x28]
push 0
push edx
call fcn.00476ef0
xor eax, eax
push 0x4a22c0
push str.sc_start__s
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x80]
push 0x400
push eax
call fcn.00472300
add esp, 0x28
xor ecx, ecx
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x1c]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov word [esp + 0x68], cx
lea ecx, [esp + 0x80]
push ecx
push 0
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x6c], 0x81
call esi
test eax, eax
je 0x43a44e
mov edx, dword [esp + 8]
push 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 4], eax
test eax, eax
jne 0x43a41a
mov ecx, dword [esp + 8]
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 4], 0
je 0x43a423
add dword [esp + 4], 0xaae60
jmp 0x43a423
add eax, 0xc3500
mov dword [esp + 4], eax
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0xc]
push eax
call esi
mov eax, dword [esp + 4]
pop esi
mov ecx, dword [esp + 0x860]
xor ecx, esp
call fcn.00471eba
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0x927c0
mov ecx, dword [esp + 0x864]
pop esi
xor ecx, esp
call fcn.00471eba
mov esp, ebp
pop ebp
ret