Function at 0x100297a0
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b85b5
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x100dcdc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x50]
mov edi, dword [ebp + 0x60]
mov esi, dword [ebp + 0x58]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 0x5c]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa8], edi
push 0xf003f
push 0
push 0
mov dword [ebp - 4], 2
mov dword [edi], 0x1adb1
mov byte [ebp - 0x89], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x98], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x98], 0
mov ecx, dword [ebp - 0xa0]
mov dword [ecx], eax
mov dword [esi], eax
mov eax, dword [ebp - 0xa4]
mov dword [eax], 1
je 0x10029b8b
mov esi, dword [ebp + 0x18]
mov eax, accept
sub eax, esi
cmp eax, 1
jb 0x10029c84
cmp dword [ebp + 0x1c], 7
lea eax, [ebp + 8]
lea ecx, [esi + 1]
mov dword [ebp - 0x30], 0
cmova eax, dword [ebp + 8]
mov edx, 7
mov dword [ebp - 0xac], eax
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], eax
movups xmmword [ebp - 0x40], xmm0
cmp ecx, edx
jbe 0x100298d8
mov eax, ecx
or eax, edx
cmp eax, 0x7ffffffe
jbe 0x100298a3
mov eax, accept
jmp 0x100298ad
mov ecx, 0xa
cmp eax, ecx
cmovb eax, ecx
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10007420
mov edx, dword [ebp - 0x9c]
lea ecx, [esi + 1]
add esp, 8
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x40], eax
add esi, esi
mov dword [ebp - 0x30], ecx
push esi
push dword [ebp - 0xac]
mov dword [ebp - 0x2c], edx
push eax
call fcn.1008dd90
mov eax, dword [ebp - 0x90]
mov ecx, 0x20
xor edx, edx
add esp, 0xc
mov word [eax + esi], cx
mov ecx, dword [ebp - 0x94]
mov word [eax + ecx*2], dx
cmp dword [ebp + 0x34], 7
lea eax, [ebp + 0x20]
push dword [ebp + 0x30]
cmova eax, dword [ebp + 0x20]
lea ecx, [ebp - 0x40]
push eax
mov byte [ebp - 4], 3
call fcn.1000e4a0
mov dword [ebp - 0x60], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x5c], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x70], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x60], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 5
cmp ecx, 7
jbe 0x1002999d
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10029993
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10029c89
push ecx
push edx
call fcn.1008c535
add esp, 8
cmp dword [ebp - 0x5c], 7
lea esi, [ebp + 0x38]
push 0
push 0
push 0
push 0
push 0
mov dword [edi], 0x1adb2
lea edx, [ebp + 0x38]
lea edi, [ebp - 0x70]
cmova edi, dword [ebp - 0x70]
cmp dword [ebp + 0x4c], 7
push edi
cmova esi, dword [ebp + 0x38]
cmova edx, dword [ebp + 0x38]
push 1
push 2
push 0x10
push 0xf01ff
push esi
push edx
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
mov dword [ebp - 0x90], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0xa0]
mov edi, dword [ebp - 0xa8]
mov dword [ecx], eax
mov eax, dword [ebp - 0xa4]
mov dword [eax], 2
test esi, esi
je 0x10029b43
xorps xmm0, xmm0
mov byte [ebp - 0x89], 1
xor eax, eax
mov dword [edi], 0x1adb3
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov eax, dword [ebp + 0x64]
mov byte [ebp - 4], 6
cmp eax, 1
jne 0x10029a4c
push 8
jmp 0x10029a53
cmp eax, 2
jne 0x10029a76
push 9
lea eax, [ebp - 0x88]
push eax
call fcn.1002f510
add esp, 8
lea ecx, [ebp - 0x58]
push eax
call fcn.1000ece0
lea ecx, [ebp - 0x88]
call fcn.100076d0
cmp dword [ebp - 0x44], 7
lea eax, [ebp - 0x58]
cmova eax, dword [ebp - 0x58]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x94]
push eax
push 1
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
call esi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x3c]
push eax
push 2
push dword [ebp - 0x90]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 0x64
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 0x64
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0x64
mov dword [edi], 0x1adb4
call esi
push dword [ebp - 0x90]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov ecx, dword [ebp - 0x44]
cmp ecx, 7
jbe 0x10029b49
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10029b37
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10029c8e
push ecx
push edx
call fcn.1008c535
add esp, 8
jmp 0x10029b49
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x98]
call esi
mov ecx, dword [ebp - 0x5c]
cmp ecx, 7
jbe 0x10029b8b
mov edx, dword [ebp - 0x70]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10029b81
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10029c93
push ecx
push edx
call fcn.1008c535
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov dword [edi], 0x1adb5
cmp ecx, 7
jbe 0x10029bcb
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10029bc1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10029c98
push ecx
push edx
call fcn.1008c535
add esp, 8
mov ecx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
cmp ecx, 7
jbe 0x10029c19
mov edx, dword [ebp + 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10029c0f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10029c98
push ecx
push edx
call fcn.1008c535
add esp, 8
mov ecx, dword [ebp + 0x4c]
xor eax, eax
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 7
mov word [ebp + 0x20], ax
cmp ecx, 7
jbe 0x10029c63
mov edx, dword [ebp + 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10029c59
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10029c98
push ecx
push edx
call fcn.1008c535
add esp, 8
mov al, byte [ebp - 0x89]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008c543
mov esp, ebp
pop ebp
ret
call fcn.10002500
call fcn.10091a0f
call fcn.10091a0f
call fcn.10091a0f
call fcn.10091a0f
int3