Function at 0x10013ac0
Capabilities:
Accept command line arguments
Persist via windows service
Set registry value
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100313b6
mov eax, dword fs:[0]
push eax
sub esp, 0xf58
mov eax, dword [0x1003f050]
xor eax, esp
mov dword [esp + 0xf50], eax
push ebx
push esi
push edi
mov eax, dword [0x1003f050]
xor eax, esp
push eax
lea eax, [esp + 0xf68]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
mov esi, ecx
call dword [sym.imp.ole32.dll_OleInitialize]
push 0x7fe
lea ecx, [esp + 0x762]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x768], ax
call fcn.1001eb30
add esp, 0xc
push esi
lea edx, [esp + 0x760]
push 0x100374a8
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x760]
push ecx
mov dword [esp + 0x20], ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, dword [esp + 0x18]
push edx
push str.internal_DllCmd
push str._s__d_n
mov esi, eax
call fcn.10005ce0
add esp, 0xc
cmp dword [esp + 0x18], 1
jl 0x1001435c
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x10037a10
push eax
call edi
test eax, eax
je 0x10014354
mov ecx, dword [esi]
push str._protect_service
push ecx
call edi
test eax, eax
je 0x10014354
mov edx, dword [esi]
push 0x10037a3c
push edx
call edi
test eax, eax
je 0x1001434d
mov eax, dword [esi]
push str._inject_to_q
push eax
call edi
test eax, eax
je 0x1001434d
mov ecx, dword [esi]
push str._install
push ecx
call edi
test eax, eax
jne 0x10013dff
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x1001435c
cmp eax, 4
jle 0x1001435c
cmp eax, 6
jg 0x1001435c
push 0x104
lea edx, [esp + 0x241]
push ebx
push edx
mov byte [esp + 0x248], bl
call fcn.1001eb30
add esp, 0xc
lea eax, [esp + 0x23c]
push 0x104
push eax
call fcn.10005c00
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x103
lea ecx, [esp + 0x659]
push ebx
push ecx
mov byte [esp + 0x660], bl
call fcn.1001eb30
add esp, 0xc
lea edx, [esp + 0x23c]
push edx
lea eax, [esp + 0x658]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x103
lea ecx, [esp + 0x139]
push ebx
push ecx
mov byte [esp + 0x140], bl
call fcn.1001eb30
mov edx, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edx
lea eax, [esp + 0x138]
push 0x100353a8
push eax
call edi
add esp, 0xc
push 0x103
lea ecx, [esp + 0x551]
push ebx
push ecx
mov byte [esp + 0x558], bl
call fcn.1001eb30
mov edx, dword [esi + 8]
add esp, 0xc
push edx
lea eax, [esp + 0x550]
push 0x100353a8
push eax
call edi
add esp, 0xc
push 0x103
lea ecx, [esp + 0x31]
push ebx
push ecx
mov byte [esp + 0x38], bl
call fcn.1001eb30
mov edx, dword [esi + 0xc]
add esp, 0xc
push edx
lea eax, [esp + 0x30]
push 0x100353a8
push eax
call edi
mov ecx, dword [esi + 0x10]
add esp, 0xc
push ecx
xor eax, eax
lea edx, [esp + 0x24]
push 0x100353a8
push edx
mov byte [esp + 0x2c], bl
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov byte [esp + 0x35], al
call edi
add esp, 0xc
xor edi, edi
push str.true
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10013d3b
mov edi, 1
push edi
lea ecx, [esp + 0x550]
push ecx
lea edx, [esp + 0x244]
push edx
lea ecx, [esp + 0x38]
lea edx, [esp + 0x140]
call fcn.10013770
add esp, 0xc
cmp dword [esp + 0x18], 6
jne 0x1001435c
mov eax, dword [esi + 0x14]
push eax
call fcn.1001dc76
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
je 0x1001435c
push 0x103
lea ecx, [esp + 0x349]
push ebx
push ecx
mov byte [esp + 0x350], bl
call fcn.1001eb30
add esp, 0xc
push str.SYSTEMCurrentControlSetServices_
lea edx, [esp + 0x348]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x348]
push ecx
call edi
push str.Parameters
lea edx, [esp + 0x348]
push edx
call edi
push 4
lea eax, [esp + 0x18]
push eax
push 4
push str.Interval
lea ecx, [esp + 0x354]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
jmp 0x1001435c
mov edx, dword [esi]
push str._uninstall
push edx
call edi
test eax, eax
jne 0x10013e5f
mov eax, dword [esp + 0x18]
sub eax, 1
je 0x1001435c
sub eax, 1
jne 0x1001435c
push 0x103
lea eax, [esp + 0x31]
push ebx
push eax
mov byte [esp + 0x38], bl
call fcn.1001eb30
mov ecx, dword [esi + 4]
add esp, 0xc
push ecx
lea edx, [esp + 0x30]
push 0x100353a8
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edi, [esp + 0x2c]
call fcn.100139d0
jmp 0x1001435c
mov eax, dword [esi]
push str._start
push eax
call edi
test eax, eax
jne 0x1001400a
mov eax, dword [esp + 0x18]
sub eax, 1
je 0x10013f1e
sub eax, 1
jne 0x1001435c
push 0x103
lea ecx, [esp + 0x31]
push ebx
push ecx
mov byte [esp + 0x38], bl
call fcn.1001eb30
mov edx, dword [esi + 4]
add esp, 0xc
push edx
lea eax, [esp + 0x30]
push 0x100353a8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0x30
lea ecx, [esp + 0x30]
push ecx
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push ebx
mov edi, eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x10013ef6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Start
push str.___sDllService_FAIL._d__n
jmp 0x10013f01
push edi
push str.Start
push str.___sDllService_SUCCESS._d__n
call fcn.10005ce0
add esp, 0xc
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
mov edx, dword [esp + 0x14]
push edx
call edi
jmp 0x1001435c
push 0x104
lea eax, [esp + 0x241]
push ebx
push eax
mov byte [esp + 0x248], bl
call fcn.1001eb30
add esp, 0xc
lea ecx, [esp + 0x23c]
push 0x104
push ecx
call fcn.10005c00
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x103
lea edx, [esp + 0x139]
push ebx
push edx
mov byte [esp + 0x140], bl
call fcn.1001eb30
add esp, 0xc
lea eax, [esp + 0x23c]
push eax
lea ecx, [esp + 0x138]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x134]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionA]
lea eax, [esp + 0x134]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push 0xf003f
push ebx
push ebx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0x30
push edi
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push ebx
mov edi, eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x10013fe2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Start
push str.___sDllService_FAIL._d__n
jmp 0x10013fed
push edi
push str.Start
push str.___sDllService_SUCCESS._d__n
call fcn.10005ce0
add esp, 0xc
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
mov ecx, dword [esp + 0x14]
push ecx
call edi
jmp 0x1001435c
mov edx, dword [esi]
push str._stop
push edx
call edi
test eax, eax
jne 0x1001416d
mov eax, dword [esp + 0x18]
sub eax, 1
je 0x100140ab
sub eax, 1
jne 0x1001435c
push 0x103
lea eax, [esp + 0x31]
push ebx
push eax
mov byte [esp + 0x38], bl
call fcn.1001eb30
mov ecx, dword [esi + 4]
add esp, 0xc
push ecx
lea edx, [esp + 0x30]
push 0x100353a8
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
push 0x30
lea eax, [esp + 0x30]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push 0x10042140
mov edi, eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x10014149
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Stop
push str.___sDllService_FAIL._d__n
jmp 0x10014154
push 0x104
lea ecx, [esp + 0x241]
push ebx
push ecx
mov byte [esp + 0x248], bl
call fcn.1001eb30
add esp, 0xc
lea edx, [esp + 0x23c]
push 0x104
push edx
call fcn.10005c00
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x103
lea eax, [esp + 0x139]
push ebx
push eax
mov byte [esp + 0x140], bl
call fcn.1001eb30
add esp, 0xc
lea ecx, [esp + 0x23c]
push ecx
lea edx, [esp + 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x134]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionA]
lea ecx, [esp + 0x134]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push 0xf003f
push ebx
push ebx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0x30
mov ebx, eax
push edi
jmp 0x10014076
push edi
push str.Stop
push str.___sDllService_SUCCESS._d__n
call fcn.10005ce0
add esp, 0xc
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push ebx
call edi
jmp 0x1001435c
mov edx, dword [esi]
push str._runscript
push edx
call edi
test eax, eax
jne 0x10014185
call fcn.100174d0
jmp 0x1001435c
mov eax, dword [esi]
push str._dllrequest
push eax
call edi
test eax, eax
jne 0x1001419e
push ebx
call fcn.10012700
jmp 0x1001435c
mov ecx, dword [esi]
push str._runapp
push ecx
call edi
test eax, eax
jne 0x1001424b
mov edi, dword [esi + 4]
lea edx, [esp + 0x14]
push edx
call fcn.10004f70
lea eax, [esp + 0x1c]
mov dword [esp + 0xf70], ebx
mov edi, dword [esi + 8]
push eax
call fcn.10004f70
lea eax, [esp + 0x1c]
mov byte [esp + 0xf70], 1
call fcn.1000bce0
push eax
lea eax, [esp + 0x18]
call fcn.1000bce0
push eax
push str._s__s_n
call fcn.10005ce0
add esp, 0xc
cmp dword [esp + 0x18], 4
jl 0x10014206
call fcn.10003d70
push 1
push 0x12c
push 0x258
push ebx
push ebx
lea eax, [esp + 0x30]
call fcn.1000bce0
push eax
lea eax, [esp + 0x2c]
call fcn.1000bce0
push eax
call sym.QQUtil.dll_CreateWebCtl
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea edi, [esp + 0x1c]
call fcn.100012d0
lea edi, [esp + 0x14]
call fcn.100012d0
jmp 0x10014363
mov ecx, dword [esi]
push 0x10037b04
push ecx
call edi
test eax, eax
je 0x10014344
mov edx, dword [esi]
push str._appins
push edx
call edi
test eax, eax
je 0x10014344
mov eax, dword [esi]
push 0x10037b24
push eax
call edi
test eax, eax
je 0x100142f5
mov ecx, dword [esi]
push str._delete_registrykey_knowndll
push ecx
call edi
test eax, eax
je 0x100142f5
mov edx, dword [esi]
push 0x10037b9c
push edx
call edi
test eax, eax
jne 0x100142a3
call sym.QQUtil.dll_CloseQQ
jmp 0x1001435c
mov eax, dword [esi]
push 0x10037ba4
push eax
call edi
test eax, eax
jne 0x100142ea
call sym.QQUtil.dll_IsInstalled
test eax, eax
jne 0x100142db
call sym.QQUtil.dll_DoInstall
test eax, eax
mov eax, 0x10037bac
jne 0x100142cd
mov eax, 0x10037bb8
push eax
call fcn.10005ce0
add esp, 4
jmp 0x1001435c
push 0x10037bc4
call fcn.10005ce0
add esp, 4
jmp 0x1001435c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x10014368
push 0x206
lea edx, [esp + 0x34a]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x350], cx
call fcn.1001eb30
mov eax, dword [esi + 4]
add esp, 0xc
push eax
lea ecx, [esp + 0x348]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [esp + 0x344]
push edx
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
lea eax, [esp + 0x344]
push eax
call sym.QQUtil.dll_delete_registrykey_knowndll
jmp 0x1001435c
push 1
call fcn.10012700
jmp 0x1001435c
call fcn.10012250
jmp 0x1001435c
mov ecx, dword [esi + 4]
call fcn.100107d0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 1
mov ecx, dword [esp + 0xf68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xf50]
xor ecx, esp
call fcn.1001c89c
mov esp, ebp
pop ebp
ret