Function at 0x10009cc4
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
push 0x28
call fcn.10015408
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0xa
rep stosd dword es:[edi], eax
add ebx, 0x20
push ebx
push 0x108
call fcn.10015408
add esp, 4
pop ebx
mov dword [ebx], eax
mov edi, eax
mov esi, 0x1001a870
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
add ebx, 4
push ebx
push 0x108
call fcn.10015408
add esp, 4
pop ebx
mov dword [ebx], eax
mov edi, eax
mov esi, 0x1001a870
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
push dword [ebp + 8]
push 8
xor eax, eax
call dword [0x100190f8]
nop
nop
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 4
jne 0x10009d89
push dword [ebp - 4]
xor eax, eax
call dword [0x1001da19]
nop
nop
call fcn.1000a548
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
jmp 0x1000a504
cmp dword [ebp - 4], 0xffffffff
jne 0x10009da8
push 1
push dword [ebp + 8]
call fcn.1000a6d6
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
jmp 0x1000a504
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx], 0x400
mov eax, dword [ebp - 8]
push eax
push 0x220
call fcn.10015408
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
mov ebx, dword [ebx]
add ebx, 8
mov ecx, pe_nt_image_headers32
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
add ebx, 8
mov ecx, pe_nt_image_headers32
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop ebx
add ebx, 4
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
nop
nop
push eax
mov ebx, dword [ebp - 0x10]
push ebx
mov edi, dword [ebp - 0x14]
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
push edi
push 1
mov eax, 2
call fcn.10015af0
add esp, 4
pop edi
pop ebx
push ebx
push edi
mov edi, dword [edi]
mov ecx, dword [edi]
add edi, 4
test ecx, ecx
je 0x10009ee2
mov eax, dword [edi]
add edi, 4
dec ecx
je 0x10009ee0
imul eax, dword [edi]
jmp 0x10009ed5
mov ecx, eax
cmp ecx, 0x100
jle 0x10009eef
mov ecx, pe_nt_image_headers32
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop edi
pop ebx
add edi, 4
add ebx, 0x100
push ebx
push edi
push 1
mov eax, 2
call fcn.10015af0
add esp, 4
pop edi
pop ebx
push ebx
push edi
mov edi, dword [edi]
mov ecx, dword [edi]
add edi, 4
test ecx, ecx
je 0x10009f2d
mov eax, dword [edi]
add edi, 4
dec ecx
je 0x10009f2b
imul eax, dword [edi]
jmp 0x10009f20
mov ecx, eax
cmp ecx, 0x100
jle 0x10009f3a
mov ecx, pe_nt_image_headers32
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop edi
pop ebx
add edi, 4
add ebx, 0x100
call fcn.10015402
add esp, 4
pop eax
mov ebx, dword [ebp - 8]
add ebx, 0x24
mov dword [ebp - 0x10], ebx
push 0xa0000101
push 0
mov ebx, dword [ebp - 0x10]
push dword [ebx]
push 1
mov ebx, 0x168
call fcn.10015cd0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x10009f90
push ebx
call fcn.10015402
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0xb
push 0x80000004
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x10009fb3
mov eax, 0x1001a200
push eax
push 2
mov ebx, 0x134
call fcn.10016500
add esp, 0x1c
mov dword [ebp - 0x10], eax
mov eax, 0x1001a7a6
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.100071e0
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x10009ffb
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x10009ff7
imul eax, dword [ebx]
jmp 0x10009fec
mov ecx, eax
test ecx, ecx
je 0x1000a01a
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x1000a013
push ebx
push eax
call fcn.10015402
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x1000a001
call fcn.10015402
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x1000a035
mov eax, 0x1001a200
push eax
push 1
mov ebx, 0x168
call fcn.10015cd0
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x1000a05b
push ebx
call fcn.10015402
add esp, 4
mov eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call fcn.1000119a
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x1000a088
push ebx
call fcn.10015402
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x1000a098
push ebx
call fcn.10015402
add esp, 4
cmp dword [ebp - 0x20], 0
je 0x1000a2a7
mov eax, 0x1001a7da
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
call fcn.100071e0
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x1000a0d4
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x1000a0d0
imul eax, dword [ebx]
jmp 0x1000a0c5
mov ecx, eax
test ecx, ecx
je 0x1000a0f3
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x1000a0ec
push ebx
push eax
call fcn.10015402
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x1000a0da
call fcn.10015402
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x1000a10e
mov eax, 0x1001a200
push eax
push 1
mov ebx, 0x168
call fcn.10015cd0
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x1000a134
push ebx
call fcn.10015402
add esp, 4
lea eax, [ebp - 0x18]
push eax
call fcn.1000532c
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x1000a150
push ebx
call fcn.10015402
add esp, 4
mov eax, 0x1001a80a
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
call fcn.100071e0
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x20]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x1000a182
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x1000a17e
imul eax, dword [ebx]
jmp 0x1000a173
mov ecx, eax
test ecx, ecx
je 0x1000a1a1
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x1000a19a
push ebx
push eax
call fcn.10015402
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x1000a188
call fcn.10015402
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x1000a1bc
mov eax, 0x1001a200
push eax
push 1
mov ebx, 0x168
call fcn.10015cd0
add esp, 0x10
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x1000a1e2
push ebx
call fcn.10015402
add esp, 4
push 0x80000002
push 0
push 0
push 0x80000301
push 0
push 1
push 0
push 0
push 0
push 0x80000004
push 0
push 0x1001a200
push 0x80000004
push 0
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x1000a21f
mov eax, 0x1001a200
push eax
push 0x80000004
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x1000a233
mov eax, 0x1001a200
push eax
push 6
mov ebx, 0x180
call fcn.10016c70
add esp, 0x4c
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x1000a259
push ebx
call fcn.10015402
add esp, 4
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
mov ecx, 2
call fcn.1000106b
add esp, 8
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x1000a27f
push ebx
call fcn.10015402
add esp, 4
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x1000a28f
push ebx
call fcn.10015402
add esp, 4
mov eax, dword [ebp - 0x30]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x1000a2a3
push ebx
call fcn.10015402
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 4
push 0x80000004
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x1000a2c6
mov eax, 0x1001a200
push eax
push 2
mov ebx, 0x134
call fcn.10016500
add esp, 0x1c
mov dword [ebp - 0x10], eax
mov eax, 0x1001a840
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.100071e0
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x1000a30e
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x1000a30a
imul eax, dword [ebx]
jmp 0x1000a2ff
mov ecx, eax
test ecx, ecx
je 0x1000a32d
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x1000a326
push ebx
push eax
call fcn.10015402
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x1000a314
call fcn.10015402
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x1000a348
mov eax, 0x1001a200
push eax
push 1
mov ebx, 0x168
call fcn.10015cd0
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x1000a36e
push ebx
call fcn.10015402
add esp, 4
mov eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call fcn.1000119a
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x1000a39b
push ebx
call fcn.10015402
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x1000a3ab
push ebx
call fcn.10015402
add esp, 4
cmp dword [ebp - 0x20], 0
je 0x1000a4d6
mov eax, 0x1001a858
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
call fcn.100071e0
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x1000a3e7
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x1000a3e3
imul eax, dword [ebx]
jmp 0x1000a3d8
mov ecx, eax
test ecx, ecx
je 0x1000a406
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x1000a3ff
push ebx
push eax
call fcn.10015402
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x1000a3ed
call fcn.10015402
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x1000a421
mov eax, 0x1001a200
push eax
push 1
mov ebx, 0x168
call fcn.10015cd0
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x1000a447
push ebx
call fcn.10015402
add esp, 4
push 0x80000002
push 0
push 0
push 0x80000301
push 0
push 1
push 0
push 0
push 0
push 0x80000004
push 0
push 0x1001a200
push 0x80000004
push 0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x1000a484
mov eax, 0x1001a200
push eax
push 0x80000004
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x1000a498
mov eax, 0x1001a200
push eax
push 6
mov ebx, 0x180
call fcn.10016c70
add esp, 0x4c
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x1000a4be
push ebx
call fcn.10015402
add esp, 4
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x1000a4d2
push ebx
call fcn.10015402
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
xor eax, eax
call dword [0x1001da19]
nop
nop
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x1000a4ff
push eax
mov ebx, eax
call fcn.10001000
inc eax
push eax
call fcn.10015408
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x1000a504
push eax
mov ebx, dword [ebp - 8]
push ebx
add ebx, 0x20
push ebx
mov ebx, dword [ebx]
push ebx
call fcn.10015402
add esp, 4
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
push ebx
call fcn.10015402
add esp, 4
pop ebx
call fcn.10015402
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x1000a541
push ebx
call fcn.10015402
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4