Function at 0x63d47187
Capabilities:
Check mutex on windows
Create service
Delete service
Persist via windows service
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2ac
mov eax, dword [ebp + 0x10]
cmp dword [ebp + 0xc], 4
mov dword [ebp - 0x264], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x268], eax
ja 0x63d472cd
mov eax, dword [ebp - 0x25c]
and eax, 0xffffffc0
or eax, dword [ebp - 0x268]
jne 0x63d472cd
mov eax, dword [ebp - 0x25c]
and eax, 3
cmp eax, 3
je 0x63d472cd
mov eax, dword [ebp - 0x25c]
and eax, 0xc
cmp eax, 0xc
je 0x63d472cd
mov eax, dword [ebp - 0x264]
add ax, 0x7530
cmp ax, 0xea60
ja 0x63d472cd
mov dword [esp + 8], 0x20000
mov dword [esp + 4], 0x3000
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [ebp - 0x250], eax
sub esp, 0xc
xor eax, eax
cmp dword [ebp - 0x250], 0
je 0x63d47be7
mov eax, dword [ebp - 0x250]
mov dword [esp + 8], 0x1800
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
mov dword [ebp - 0x24c], eax
jne 0x63d4728f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [ebp - 0x250]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
xor eax, eax
jmp 0x63d47be7
lea eax, [ebp - 0x23c]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x250]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24c]
mov dword [esp], eax
mov eax, dword [ebp + 8]
call fcn.63d441eb
test edx, edx
mov dword [ebp - 0x254], edx
je 0x63d472d9
mov eax, dword [ebp - 0x250]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push eax
mov dword [esp], 0x57
jmp 0x63d47bc9
mov ebx, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x24c]
xor ecx, ecx
mov dword [esp], 0
mov edx, ebx
call fcn.63d4284a
test eax, eax
je 0x63d47533
cmp dword [ebp + 0xc], 1
ja 0x63d4738f
mov eax, dword [ebp - 0x24c]
mov dword [esp], 1
mov ecx, 1
mov edx, ebx
xor esi, esi
call fcn.63d4284a
test eax, eax
je 0x63d47349
mov eax, dword [ebp - 0x24c]
mov dword [esp], 0
mov ecx, 2
mov edx, ebx
call fcn.63d4284a
cmp eax, 1
sbb esi, esi
not esi
and esi, 0x10
mov eax, dword [ebp - 0x24c]
mov edx, ebx
mov dword [esp], 1
mov ecx, 2
call fcn.63d4284a
xor edx, edx
test eax, eax
je 0x63d4738b
mov eax, dword [ebp - 0x24c]
mov edx, ebx
mov dword [esp], 0
mov ecx, 1
call fcn.63d4284a
cmp eax, 1
sbb edx, edx
not edx
and edx, 0x20
or esi, edx
jmp 0x63d4739b
cmp dword [ebp + 0xc], 4
je 0x63d47533
xor esi, esi
mov eax, dword [ebp - 0x24c]
mov edx, ebx
mov dword [esp], 1
mov ecx, 5
call fcn.63d4284a
xor edx, edx
test eax, eax
je 0x63d473dd
mov eax, dword [ebp - 0x24c]
mov edx, ebx
mov dword [esp], 0
mov ecx, 6
call fcn.63d4284a
cmp eax, 1
sbb edx, edx
not edx
and edx, 0x40
mov eax, dword [ebp - 0x24c]
or esi, edx
mov dword [esp], 1
mov edx, ebx
mov ecx, 6
call fcn.63d4284a
xor edx, edx
test eax, eax
je 0x63d47424
mov eax, dword [ebp - 0x24c]
mov edx, ebx
mov dword [esp], 0
mov ecx, 5
call fcn.63d4284a
cmp eax, 1
sbb edx, edx
not edx
and edx, 0x80
or esi, edx
cmp dword [ebp + 0xc], 2
je 0x63d474f8
cmp dword [ebp + 0xc], 3
jne 0x63d4752d
mov eax, dword [ebp - 0x24c]
mov ecx, 0x46
mov edx, ebx
mov dword [esp], 3
call fcn.63d4284a
cmp eax, 1
mov ecx, 0x46
mov edx, ebx
sbb eax, eax
mov dword [esp], 4
not eax
and eax, 0x200
or esi, eax
mov eax, dword [ebp - 0x24c]
call fcn.63d4284a
cmp eax, 1
mov ecx, 0x46
mov edx, ebx
sbb eax, eax
mov dword [esp], 7
not eax
and eax, 0x400
or esi, eax
mov eax, dword [ebp - 0x24c]
call fcn.63d4284a
cmp eax, 1
mov ecx, 0x46
mov edx, ebx
sbb eax, eax
mov dword [esp], 5
not eax
and eax, 0x2000
or esi, eax
mov eax, dword [ebp - 0x24c]
call fcn.63d4284a
cmp eax, 1
mov dword [esp], 6
mov ecx, 0x46
sbb eax, eax
mov edx, ebx
not eax
and eax, 0x800
or esi, eax
mov eax, dword [ebp - 0x24c]
call fcn.63d4284a
test eax, eax
mov eax, 0x1000
jmp 0x63d47518
mov eax, dword [ebp - 0x24c]
mov dword [esp], 2
mov ecx, 0x46
mov edx, ebx
call fcn.63d4284a
test eax, eax
mov eax, 0x100
cmove eax, dword [ebp - 0x254]
mov dword [ebp - 0x254], eax
or dword [ebp - 0x254], esi
jmp 0x63d47533
mov dword [ebp - 0x254], esi
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], 0x40000080
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
mov dword [esp], str..WinDivert
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
mov ebx, eax
jne 0x63d47a76
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [eax - 2]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
cmp eax, 1
jbe 0x63d475a9
mov eax, dword [ebp - 0x250]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push edi
mov dword [esp], esi
jmp 0x63d475c9
test byte [ebp - 0x25c], 0x10
je 0x63d475d0
mov eax, dword [ebp - 0x250]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push esi
mov dword [esp], 0x424
call ebx
jmp 0x63d47bcf
mov dword [esp], 0
call ebx
push ebx
mov dword [esp + 8], str.WinDivertDriverInstallMutex
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
sub esp, 0xc
test eax, eax
mov dword [ebp - 0x260], eax
je 0x63d479e3
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
push ecx
push ecx
je 0x63d47628
add eax, 0xffffff80
jne 0x63d479e3
mov dword [esp + 8], 0xf003f
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
sub esp, 0xc
test eax, eax
mov dword [ebp - 0x258], eax
je 0x63d4785c
mov dword [esp + 8], 0xf01ff
mov dword [esp + 4], str.WinDivert
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
sub esp, 0xc
test eax, eax
mov ebx, eax
jne 0x63d47941
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [ebp - 0x224]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
push edx
push edx
je 0x63d476a9
cmp dword [ebp - 0x224], 0
sete cl
je 0x63d476af
jmp 0x63d476ab
xor ecx, ecx
xor ebx, ebx
jmp 0x63d476d0
xor ebx, ebx
cmp word [ebx + ebx + str.WinDivert32.sys], 0
je 0x63d476db
cmp ebx, 0x105
je 0x63d47733
inc ebx
jmp 0x63d476b1
cmp ebx, 0x105
je 0x63d47733
inc ebx
cmp word [ebx + ebx + str.WinDivert64.sys], 0
jne 0x63d476c7
mov eax, dword [section..bss]
lea esi, [ebp - 0x224]
mov byte [ebp - 0x269], cl
mov dword [esp + 8], 0x104
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 0xc
test eax, eax
mov cl, byte [ebp - 0x269]
je 0x63d4785c
cmp word [esi + eax*2], 0x5c
je 0x63d4771c
dec eax
jne 0x63d47712
lea edx, [eax + eax]
add edx, esi
cmp word [edx], 0x5c
jne 0x63d47733
lea ebx, [eax + ebx + 1]
cmp ebx, 0x103
jbe 0x63d47746
mov dword [esp], 0xa1
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
jmp 0x63d4785c
test cl, cl
mov ebx, str.WinDivert32.sys
mov ecx, str.WinDivert64.sys
cmove ebx, ecx
mov ecx, 0x103
sub ecx, eax
xor eax, eax
mov si, word [ebx + eax*2]
lea edi, [eax + eax]
test si, si
je 0x63d47775
cmp ecx, eax
jb 0x63d47733
mov word [edx + eax*2], si
inc eax
jmp 0x63d4775e
cmp ecx, eax
jb 0x63d47733
lea eax, [ebp - 0x224]
mov word [edx + edi], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x258]
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 3
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0xf01ff
mov dword [esp + 8], str.WinDivert
mov dword [esp + 4], str.WinDivert
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
sub esp, 0x34
test eax, eax
mov ebx, eax
jne 0x63d47834
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x63d4785c
mov eax, dword [ebp - 0x258]
mov dword [esp + 8], 0xf01ff
mov dword [esp + 4], str.WinDivert
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
sub esp, 0xc
test eax, eax
mov ebx, eax
jne 0x63d47941
jmp 0x63d4785c
mov dword [ebp - 0x234], 7
xor esi, esi
lea edi, [ebp - 0x224]
cmp word [edi + esi*2], 0
je 0x63d47865
cmp esi, 0x105
je 0x63d47941
inc esi
jmp 0x63d47840
xor ebx, ebx
xor esi, esi
jmp 0x63d47982
lea eax, [ebp - 0x238]
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SystemCurrentControlSetServicesEventLogSystemWinDivert
mov dword [esp], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
sub esp, 0x24
test eax, eax
jne 0x63d47941
lea eax, [esi + esi + 2]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.EventMessageFile
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x238]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x234]
sub esp, 0x18
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x238]
mov dword [esp + 8], 0
mov dword [esp + 4], str.TypesSupported
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x238]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
sub esp, 0xc
test eax, eax
mov esi, eax
jne 0x63d47978
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
sete al
movzx eax, al
mov esi, eax
jmp 0x63d47982
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x258], 0
mov edi, eax
je 0x63d479a3
mov eax, dword [ebp - 0x258]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edx
test ebx, ebx
je 0x63d479b1
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
mov eax, dword [ebp - 0x260]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push eax
mov eax, dword [ebp - 0x260]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov dword [esp], edi
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
call edi
push eax
mov eax, esi
test al, al
jne 0x63d47a0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ebx, eax
mov eax, 0x6e
cmove ebx, eax
mov eax, dword [ebp - 0x250]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push eax
mov dword [esp], ebx
jmp 0x63d47bc9
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], 0x40000080
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
mov dword [esp], str..WinDivert
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
mov ebx, eax
jne 0x63d47a76
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [ebp - 0x250]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push eax
mov dword [esp], ebx
call edi
jmp 0x63d47bcf
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x224]
mov ecx, 0x10
lea esi, [ebp - 0x234]
mov edi, edx
mov dword [ebp - 0x234], eax
movsx eax, word [ebp - 0x264]
add eax, 0x7530
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x228], eax
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [esp], edx
mov dword [esp + 8], 0
mov ecx, esi
mov dword [esp + 4], 0x40
mov edx, 0x12e486
mov eax, ebx
mov dword [ebp - 0x224], 0x69645724
mov dword [ebp - 0x220], 0x4c4c4476
mov dword [ebp - 0x21c], 2
mov dword [ebp - 0x218], 2
mov dword [ebp - 0x214], 0x20
call fcn.63d41feb
test eax, eax
je 0x63d47ba4
cmp dword [ebp - 0x220], 0x53595376
jne 0x63d47b3c
cmp dword [ebp - 0x224], 0x69645723
jne 0x63d47b3c
cmp dword [ebp - 0x21c], 1
ja 0x63d47b5f
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x250]
push esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push edi
mov dword [esp], 0x28e
jmp 0x63d47bc9
xor eax, eax
mov ecx, 4
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x254]
mov dword [esp + 8], 0
mov ecx, esi
mov edx, 0x12e489
mov dword [ebp - 0x234], eax
imul eax, dword [ebp - 0x23c], 0x18
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24c]
mov dword [esp], eax
mov eax, ebx
call fcn.63d41feb
test eax, eax
jne 0x63d47bd5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x250]
push ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push ebx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
push edx
jmp 0x63d47be7
mov eax, dword [ebp - 0x250]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push eax
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret