Function at 0x554c50
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x674f08
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x654
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x664], ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x65c], bl
push 0x3ff
push ebx
lea eax, [ebp - 0x65b]
push eax
call fcn.005dfd60
add esp, 0xc
cmp esi, ebx
je 0x554cbb
mov byte [esi], bl
cmp edi, ebx
je 0x554cc1
mov byte [edi], bl
call fcn.004d9930
test eax, eax
jne 0x5552a1
call fcn.004d9b00
test eax, eax
jne 0x554ce4
call fcn.004d9d50
test eax, eax
je 0x5552a1
lea ecx, [ebp - 0x65c]
push ecx
push str.wscsvc
call fcn.0050d920
add esp, 8
test eax, eax
je 0x554d5c
push 1
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x65c]
push edx
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x554d5c
push ebx
push ebx
push str.wscsvc
call fcn.00510980
add esp, 0xc
cmp eax, 1
jle 0x554d32
cmp eax, 3
jne 0x5552c6
push str.wscsvc
push 1
call fcn.005001f0
push str.wscsvc
call fcn.00514980
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x5552f9
cmp dword [ebp + 8], ebx
jne 0x554d6f
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x5552f9
cmp esi, ebx
je 0x554d81
push str._WSC__Putting_back_WSCSVC_Service_Entries...
push esi
call fcn.005dfb23
add esp, 8
mov byte [ebp - 0x25c], bl
push 0x103
push ebx
lea eax, [ebp - 0x25b]
push eax
call fcn.005dfd60
add esp, 0xc
call fcn.004d9b00
test eax, eax
je 0x55509f
mov byte [ebp - 0x48], 0x80
mov byte [ebp - 0x47], 0x51
mov byte [ebp - 0x46], 1
mov byte [ebp - 0x45], bl
mov byte [ebp - 0x44], bl
mov byte [ebp - 0x43], bl
mov byte [ebp - 0x42], bl
mov byte [ebp - 0x41], bl
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], bl
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 3
mov byte [ebp - 0x3b], bl
mov byte [ebp - 0x3a], bl
mov byte [ebp - 0x39], bl
mov byte [ebp - 0x38], 0x14
mov byte [ebp - 0x37], bl
mov byte [ebp - 0x36], bl
mov byte [ebp - 0x35], bl
mov byte [ebp - 0x34], 1
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], 0xc0
mov byte [ebp - 0x2f], 0xd4
mov byte [ebp - 0x2e], 1
mov byte [ebp - 0x2d], bl
mov byte [ebp - 0x2c], 1
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], bl
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0xe0
mov byte [ebp - 0x27], 0x93
mov byte [ebp - 0x26], 4
mov byte [ebp - 0x25], bl
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x23], bl
mov byte [ebp - 0x22], bl
mov byte [ebp - 0x21], bl
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1f], bl
mov byte [ebp - 0x1e], bl
mov byte [ebp - 0x1d], bl
push 1
push str.DelayedAutoStart
push str.SYSTEMCurrentControlSetServiceswscsvc
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 1
push str.ErrorControl
push str.SYSTEMCurrentControlSetServiceswscsvc
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 1
push str.ServiceSidType
push str.SYSTEMCurrentControlSetServiceswscsvc
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 2
push str.Start
push str.SYSTEMCurrentControlSetServiceswscsvc
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x20
push str.Type
push str.SYSTEMCurrentControlSetServiceswscsvc
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push str.NT_AUTHORITYLocalService
push str.ObjectName
push str.SYSTEMCurrentControlSetServiceswscsvc
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
push str.__SystemRoot_System32wscsvc.dll__200
push str.DisplayName
push str.SYSTEMCurrentControlSetServiceswscsvc
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
push str.__SystemRoot_System32wscsvc.dll__201
push str.Description
push str.SYSTEMCurrentControlSetServiceswscsvc
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
lea ecx, [ebp - 0x660]
push ecx
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetServiceswscsvc
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x14
cmp eax, ebx
jne 0x555064
mov edx, dword [str.RpcSs]
mov dword [ebp - 0x58], edx
mov eax, dword [0x658d58]
mov dword [ebp - 0x54], eax
mov ecx, dword [0x658d5c]
mov dword [ebp - 0x50], ecx
mov edx, dword [0x658d60]
mov dword [ebp - 0x4c], edx
mov ecx, 0x10
mov esi, str._SystemRoot_System32_svchost.exe__k_LocalServiceNetworkRestricted
lea edi, [ebp - 0x158]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0xc
mov esi, str.SeChangeNotifyPrivilege
lea edi, [ebp - 0x114]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x664], 1
push 0x2c
lea eax, [ebp - 0x48]
push eax
push 3
push ebx
push str.FailureActions
mov ecx, dword [ebp - 0x660]
push ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call esi
push 0x10
lea edx, [ebp - 0x58]
push edx
push 7
push ebx
push str.DependOnService
mov eax, dword [ebp - 0x660]
push eax
call esi
push 0x43
lea ecx, [ebp - 0x158]
push ecx
push 2
push ebx
push 0x648094
mov edx, dword [ebp - 0x660]
push edx
call esi
push 0x31
lea eax, [ebp - 0x114]
push eax
push 7
push ebx
push str.RequiredPrivileges
mov ecx, dword [ebp - 0x660]
push ecx
call esi
mov edx, dword [ebp - 0x660]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push str.ServiceDllUnloadOnStop
push str.SYSTEMCurrentControlSetServiceswscsvcParameters
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
lea eax, [ebp - 0x660]
push eax
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetServiceswscsvcParameters
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x14
cmp eax, ebx
jne 0x55528a
mov ecx, 8
mov esi, str._SystemRoot_System32wscsvc.dll
lea edi, [ebp - 0xb0]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x21
lea ecx, [ebp - 0xb0]
push ecx
push 2
push ebx
push str.ServiceDll
mov edx, dword [ebp - 0x660]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x660]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x55528a
push eax
push str._WSC___1_Unable_to_write_WSCSVC_Service_Entries._MyRegOpenKey_Failed_with_error__u_
lea ecx, [ebp - 0x25c]
push ecx
call fcn.005dfb23
add esp, 0xc
cmp edi, ebx
je 0x55528a
lea ecx, [ebp - 0x25c]
mov edx, edi
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x555090
jmp 0x55528a
push 1
push str.ErrorControl
push str.SYSTEMCurrentControlSetServiceswscsvc
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 2
push str.Start
push str.SYSTEMCurrentControlSetServiceswscsvc
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x20
push str.Type
push str.SYSTEMCurrentControlSetServiceswscsvc
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push str.LocalSystem
push str.ObjectName
push str.SYSTEMCurrentControlSetServiceswscsvc
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
push str.Security_Center
push str.DisplayName
push str.SYSTEMCurrentControlSetServiceswscsvc
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
push str.Monitors_system_security_settings_and_configurations.
push str.Description
push str.SYSTEMCurrentControlSetServiceswscsvc
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
lea edx, [ebp - 0x660]
push edx
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetServiceswscsvc
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x14
cmp eax, ebx
jne 0x55525f
mov eax, dword [str.RpcSs]
mov dword [ebp - 0x68], eax
mov ecx, dword [0x658d58]
mov dword [ebp - 0x64], ecx
mov edx, dword [0x658d5c]
mov dword [ebp - 0x60], edx
mov eax, dword [0x658d60]
mov dword [ebp - 0x5c], eax
mov ecx, 0xb
mov esi, str._SystemRoot_System32_svchost.exe__k_netsvcs
lea edi, [ebp - 0xe0]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x664], 1
push 0x10
lea ecx, [ebp - 0x68]
push ecx
push 7
push ebx
push str.DependOnService
mov edx, dword [ebp - 0x660]
push edx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call esi
push 0x2d
lea eax, [ebp - 0xe0]
push eax
push 2
push ebx
push 0x648094
mov ecx, dword [ebp - 0x660]
push ecx
call esi
mov edx, dword [ebp - 0x660]
push edx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [ebp - 0x660]
push eax
push str.SYSTEMCurrentControlSetServiceswscsvcParameters
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x5551fc
mov ecx, dword [ebp - 0x660]
push ecx
call esi
lea edx, [ebp - 0x660]
push edx
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetServiceswscsvcParameters
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x14
test eax, eax
jne 0x55528a
mov ecx, 8
mov esi, str._SYSTEMROOT__system32wscsvc.dll
lea edi, [ebp - 0x8c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x21
lea eax, [ebp - 0x8c]
push eax
push 2
push ebx
push str.ServiceDll
mov ecx, dword [ebp - 0x660]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x660]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x55528a
push eax
push str._WSC___2_Unable_to_write_WSCSVC_Service_Entries._MyRegOpenKey_Failed_with_error__u_
lea eax, [ebp - 0x25c]
push eax
call fcn.005dfb23
add esp, 0xc
cmp edi, ebx
je 0x55528a
lea ecx, [ebp - 0x25c]
mov edx, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x555280
cmp dword [ebp - 0x664], ebx
je 0x5552ec
push str.wscsvc
call fcn.00514980
add esp, 4
jmp 0x5552ec
lea ecx, [ebp - 0x65c]
push ecx
push str.wscsvc
call fcn.0050d920
add esp, 8
test eax, eax
je 0x5552c6
push str.wscsvc
call fcn.004e9580
add esp, 4
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x5552f9
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x664]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret