Function at 0x1007baf
Capabilities:
Create service
Modify service

Disassembly:
mov eax, 0x1016be2
call fcn.0100af48
sub esp, 0x22c
mov eax, dword [0x101f7d8]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
push ebx
mov dword [ebp - 0x14], eax
call fcn.01007952
mov esi, eax
cmp esi, ebx
jl 0x1007e49
jne 0x1007bec
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x1001660
mov dword [ebp - 0x238], esi
push 0xf003f
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov dword [ebp - 0x234], eax
je 0x1007dfb
xor eax, eax
mov word [ebp - 0x21c], bx
mov ecx, 0x81
lea edi, [ebp - 0x21a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
push 0x6e
push ebx
mov dword [ebp - 0x220], ebx
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.010076d6
mov dword [ebp - 0x220], eax
jmp 0x1007c75
mov esi, dword [ebp - 0x220]
xor edi, edi
inc edi
cmp esi, ebx
mov dword [ebp - 4], edi
mov eax, esi
jne 0x1007c8c
mov eax, 0x100182c
push ebx
push ebx
push 0x100181c
push ebx
push ebx
lea ecx, [ebp - 0x21c]
push ecx
push edi
push 3
push 0x10
push 0xf01ff
push eax
push dword [0x101f050]
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
cmp eax, ebx
mov dword [ebp - 0x22c], eax
je 0x1007d86
push 0x6f
push ebx
mov esi, 0x8007000e
mov dword [ebp - 0x228], ebx
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.010076d6
cmp eax, ebx
mov dword [ebp - 0x228], eax
je 0x1007dda
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x224]
push eax
push edi
push dword [ebp - 0x22c]
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1007d70
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1007d23
call esi
jmp 0x1007d2f
call esi
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jge 0x1007d51
call esi
test eax, eax
jg 0x1007d3f
call esi
mov esi, eax
jmp 0x1007d70
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1007d70
mov esi, 0x80004005
jmp 0x1007d70
cmp dword [ebp - 0x228], ebx
je 0x1007dda
push dword [ebp - 0x228]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x1007dda
cmp esi, ebx
je 0x1007d97
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [ebp - 0x220], ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1007da7
call esi
jmp 0x1007db3
call esi
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jge 0x1007dd5
call esi
test eax, eax
jg 0x1007dc3
call esi
mov esi, eax
jmp 0x1007dda
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1007dda
mov esi, 0x80004005
cmp dword [ebp - 0x220], ebx
je 0x1007dee
push dword [ebp - 0x220]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
lea ecx, [ebp - 0x230]
call fcn.010066a2
jmp 0x1007e3e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1007e0b
call esi
jmp 0x1007e17
call esi
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jge 0x1007e39
call esi
test eax, eax
jg 0x1007e27
call esi
mov esi, eax
jmp 0x1007e3e
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1007e3e
mov esi, 0x80004005
lea ecx, [ebp - 0x238]
call fcn.010066a2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.0100abde
pop edi
pop esi
pop ebx
leave
ret