Function at 0x10029790
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b8445
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x100dcc00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x50]
mov edi, dword [ebp + 0x60]
mov esi, dword [ebp + 0x58]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 0x5c]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa8], edi
push 0xf003f
push 0
push 0
mov dword [ebp - 4], 2
mov dword [edi], 0x1adb1
mov byte [ebp - 0x89], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x98], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x98], 0
mov ecx, dword [ebp - 0xa0]
mov dword [ecx], eax
mov dword [esi], eax
mov eax, dword [ebp - 0xa4]
mov dword [eax], 1
je 0x10029b7b
mov esi, dword [ebp + 0x18]
mov eax, accept
sub eax, esi
cmp eax, 1
jb 0x10029c74
cmp dword [ebp + 0x1c], 7
lea eax, [ebp + 8]
lea ecx, [esi + 1]
mov dword [ebp - 0x30], 0
cmova eax, dword [ebp + 8]
mov edx, 7
mov dword [ebp - 0xac], eax
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], eax
movups xmmword [ebp - 0x40], xmm0
cmp ecx, edx
jbe 0x100298c8
mov eax, ecx
or eax, edx
cmp eax, 0x7ffffffe
jbe 0x10029893
mov eax, accept
jmp 0x1002989d
mov ecx, 0xa
cmp eax, ecx
cmovb eax, ecx
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10007420
mov edx, dword [ebp - 0x9c]
lea ecx, [esi + 1]
add esp, 8
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x40], eax
add esi, esi
mov dword [ebp - 0x30], ecx
push esi
push dword [ebp - 0xac]
mov dword [ebp - 0x2c], edx
push eax
call fcn.1008dc20
mov eax, dword [ebp - 0x90]
mov ecx, 0x20
xor edx, edx
add esp, 0xc
mov word [eax + esi], cx
mov ecx, dword [ebp - 0x94]
mov word [eax + ecx*2], dx
cmp dword [ebp + 0x34], 7
lea eax, [ebp + 0x20]
push dword [ebp + 0x30]
cmova eax, dword [ebp + 0x20]
lea ecx, [ebp - 0x40]
push eax
mov byte [ebp - 4], 3
call fcn.1000e4a0
mov dword [ebp - 0x60], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x5c], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x70], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x60], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 5
cmp ecx, 7
jbe 0x1002998d
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10029983
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10029c79
push ecx
push edx
call fcn.1008c3c5
add esp, 8
cmp dword [ebp - 0x5c], 7
lea esi, [ebp + 0x38]
push 0
push 0
push 0
push 0
push 0
mov dword [edi], 0x1adb2
lea edx, [ebp + 0x38]
lea edi, [ebp - 0x70]
cmova edi, dword [ebp - 0x70]
cmp dword [ebp + 0x4c], 7
push edi
cmova esi, dword [ebp + 0x38]
cmova edx, dword [ebp + 0x38]
push 1
push 2
push 0x10
push 0xf01ff
push esi
push edx
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
mov dword [ebp - 0x90], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0xa0]
mov edi, dword [ebp - 0xa8]
mov dword [ecx], eax
mov eax, dword [ebp - 0xa4]
mov dword [eax], 2
test esi, esi
je 0x10029b33
xorps xmm0, xmm0
mov byte [ebp - 0x89], 1
xor eax, eax
mov dword [edi], 0x1adb3
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov eax, dword [ebp + 0x64]
mov byte [ebp - 4], 6
cmp eax, 1
jne 0x10029a3c
push 8
jmp 0x10029a43
cmp eax, 2
jne 0x10029a66
push 9
lea eax, [ebp - 0x88]
push eax
call fcn.1002f500
add esp, 8
lea ecx, [ebp - 0x58]
push eax
call fcn.1000ece0
lea ecx, [ebp - 0x88]
call fcn.100076d0
cmp dword [ebp - 0x44], 7
lea eax, [ebp - 0x58]
cmova eax, dword [ebp - 0x58]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x94]
push eax
push 1
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
call esi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x3c]
push eax
push 2
push dword [ebp - 0x90]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 0x64
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 0x64
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0x64
mov dword [edi], 0x1adb4
call esi
push dword [ebp - 0x90]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov ecx, dword [ebp - 0x44]
cmp ecx, 7
jbe 0x10029b39
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10029b27
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10029c7e
push ecx
push edx
call fcn.1008c3c5
add esp, 8
jmp 0x10029b39
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x98]
call esi
mov ecx, dword [ebp - 0x5c]
cmp ecx, 7
jbe 0x10029b7b
mov edx, dword [ebp - 0x70]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10029b71
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10029c83
push ecx
push edx
call fcn.1008c3c5
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov dword [edi], 0x1adb5
cmp ecx, 7
jbe 0x10029bbb
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10029bb1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10029c88
push ecx
push edx
call fcn.1008c3c5
add esp, 8
mov ecx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
cmp ecx, 7
jbe 0x10029c09
mov edx, dword [ebp + 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10029bff
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10029c88
push ecx
push edx
call fcn.1008c3c5
add esp, 8
mov ecx, dword [ebp + 0x4c]
xor eax, eax
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 7
mov word [ebp + 0x20], ax
cmp ecx, 7
jbe 0x10029c53
mov edx, dword [ebp + 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10029c49
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10029c88
push ecx
push edx
call fcn.1008c3c5
add esp, 8
mov al, byte [ebp - 0x89]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008c3d3
mov esp, ebp
pop ebp
ret
call fcn.10002500
call fcn.1009189f
call fcn.1009189f
call fcn.1009189f
call fcn.1009189f
int3