Function at 0x10003710
Capabilities:
Create service
Get common file path
Modify service
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x83c
mov eax, dword [0x100621b0]
xor eax, esp
mov dword [esp + 0x838], eax
push ebx
push edi
xor edi, edi
mov ebx, ecx
push 0x206
lea ecx, [esp + 0x436]
xor eax, eax
push edi
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov word [esp + 0x43c], ax
call fcn.1000e610
add esp, 0xc
cmp esi, edi
je 0x100039f5
cmp ebx, edi
je 0x100039f5
lea ecx, [esp + 0x14]
call fcn.10004270
test eax, eax
jne 0x100039d4
push 0x206
lea eax, [esp + 0x22e]
xor edx, edx
push edi
push eax
mov word [esp + 0x234], dx
call fcn.1000e610
add esp, 0xc
push 0x104
lea ecx, [esp + 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x206
lea eax, [esp + 0x26]
xor edx, edx
push edi
push eax
mov word [esp + 0x2c], dx
call fcn.1000e610
push esi
lea ecx, [esp + 0x238]
push ecx
push str._s_svchost.exe__k__s
mov ecx, 0x104
lea ebx, [esp + 0x38]
call fcn.10002c90
push 0x208
lea edx, [esp + 0x654]
push edi
push edx
call fcn.1000e610
add esp, 0x24
push 0x104
lea eax, [esp + 0x63c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10003814
sub eax, edx
mov edx, dword [esp + 0x14]
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push esi
push 7
push edi
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100039b0
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [esp + 0x1c], ebx
cmp ebx, edi
je 0x100039a6
push ebp
push edi
push edi
push edi
push edi
push edi
lea eax, [esp + 0x38]
push eax
push 1
push 2
push 0x10
push 0xf01ff
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebp, eax
cmp ebp, edi
jne 0x1000390a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
cmp eax, 0x431
jne 0x100038ae
push 0xf01ff
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, eax
cmp ebp, edi
jne 0x100038e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [esp + 0x18]
pop ebp
call fcn.10004090
mov eax, dword [esp + 8]
pop edi
pop ebx
mov ecx, dword [esp + 0x838]
xor ecx, esp
call fcn.1000d1df
add esp, 0x83c
ret
push edi
push edi
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x3c]
push ecx
push 1
push 2
push 0x10
push ebp
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x1000390a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
push esi
push 0x1005e270
push 0x1005e6ec
mov ecx, 0x104
lea ebx, [esp + 0x440]
call fcn.10002c90
mov edi, ebx
add esp, 0xc
lea ecx, [esp + 0x14]
mov ebx, 0x80000002
call fcn.100041c0
test eax, eax
jne 0x10003996
mov ebx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
mov edi, str.Parameters
call fcn.100041c0
test eax, eax
jne 0x1000398d
mov edi, dword [esp + 0x1c]
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10003960
mov ebx, dword [esp + 0x10]
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
call fcn.10004120
test eax, eax
jne 0x10003984
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x10]
call fcn.10004090
mov ecx, dword [esp + 0x14]
call fcn.10004090
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [esp + 0x20]
jmp 0x100038b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x14]
call fcn.10004090
mov eax, dword [esp + 8]
pop edi
pop ebx
mov ecx, dword [esp + 0x838]
xor ecx, esp
call fcn.1000d1df
add esp, 0x83c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov dword [esp + 4], eax
pop ebx
mov ecx, dword [esp + 0x838]
xor ecx, esp
call fcn.1000d1df
add esp, 0x83c
ret
mov ecx, dword [esp + 0x840]
pop edi
pop ebx
xor ecx, esp
mov eax, 0x57
call fcn.1000d1df
add esp, 0x83c
ret