Function at 0x1027024
Capabilities:
Create service
Modify service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x860
mov eax, dword [0x102c358]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
xor esi, esi
push 0x7fe
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push esi
push eax
mov dword [ebp - 0x808], esi
mov dword [ebp - 0x824], esi
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x1014c70
mov ebx, 0x102c3b8
push ebx
mov dword [ebp - 0x810], esi
mov dword [ebp - 0x81c], esi
call fcn.01018f8f
lea eax, [ebp - 0x824]
push eax
call fcn.0102480f
test eax, eax
jne 0x10270a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x808], eax
jmp 0x1027372
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x818], eax
cmp eax, esi
jne 0x10270cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x808], eax
jmp 0x102734a
lea eax, [ebp - 0x810]
push eax
call fcn.01026ac1
xor ecx, ecx
inc ecx
test eax, eax
je 0x10270e5
mov dword [ebp - 0x81c], ecx
mov edx, dword [ebp - 0x824]
mov eax, 0x1f4
mov dword [ebp - 0x82c], 0x1014c10
cmp edx, eax
je 0x1027108
mov dword [ebp - 0x82c], 0x1014bb0
sub edx, eax
je 0x1027128
dec edx
dec edx
je 0x102711c
mov dword [ebp - 0x814], 0x1014ba0
jmp 0x1027132
mov dword [ebp - 0x814], 0x1014b78
jmp 0x1027132
mov dword [ebp - 0x814], 0x1014b58
push edi
xor eax, eax
lea edi, [ebp - 0x848]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x860]
mov dword [ebp - 0x838], eax
mov eax, 0xea60
mov dword [ebp - 0x848], 0x258
mov dword [ebp - 0x844], esi
mov dword [ebp - 0x840], esi
mov dword [ebp - 0x83c], 3
mov dword [ebp - 0x860], ecx
mov dword [ebp - 0x85c], eax
mov dword [ebp - 0x858], ecx
mov dword [ebp - 0x854], eax
mov dword [ebp - 0x850], esi
mov dword [ebp - 0x84c], eax
cmp dword [ebp - 0x81c], esi
je 0x10271cd
push 0x400
lea eax, [ebp - 0x804]
push eax
push dword [0x104081c]
push dword [ebp - 0x810]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x10271cd
lea eax, [ebp - 0x804]
mov dword [ebp - 0x830], eax
jmp 0x10271d7
mov dword [ebp - 0x830], 0x1014b08
mov dword [ebp - 0x820], esi
mov edi, dword [ebp - 0x820]
push 0x1014ac8
push esi
inc edi
push edi
push 0x1014ab0
push ebx
call fcn.01018f8f
push eax
call fcn.01018fc7
push eax
call fcn.01018f8f
push esi
push esi
push dword [ebp - 0x814]
push esi
push esi
push dword [ebp - 0x82c]
push 1
push 3
push 0x20
push 0xf01ff
push dword [ebp - 0x830]
push 0x1014364
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x80c], eax
cmp eax, esi
jne 0x1027291
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1002440
push esi
push eax
push 0x1014a60
push ebx
mov dword [ebp - 0x834], eax
call fcn.01018f8f
push eax
call fcn.01018fc7
push eax
call fcn.01018f8f
mov eax, dword [ebp - 0x834]
cmp eax, 0x430
jne 0x102732f
cmp dword [ebp - 0x820], 0xf
jae 0x102732f
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x820], edi
cmp dword [ebp - 0x80c], esi
je 0x10271dd
push 0x1014a48
push ebx
call fcn.01018f8f
cmp dword [ebp - 0x81c], esi
je 0x10272e6
push 0x400
lea eax, [ebp - 0x804]
push eax
push dword [0x1040820]
push dword [ebp - 0x810]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x10272e6
lea eax, [ebp - 0x804]
mov dword [ebp - 0x828], eax
jmp 0x10272f0
mov dword [ebp - 0x828], 0x1014860
mov edi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
lea eax, [ebp - 0x828]
push eax
push 1
push dword [ebp - 0x80c]
call edi
test eax, eax
je 0x1027329
lea eax, [ebp - 0x848]
push eax
push 2
push dword [ebp - 0x80c]
call edi
test eax, eax
je 0x1027329
call fcn.0102661f
test eax, eax
jne 0x1027335
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x808], eax
pop edi
cmp dword [ebp - 0x80c], esi
je 0x102734a
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x818], esi
je 0x102735e
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x810], esi
je 0x1027372
push dword [ebp - 0x810]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x808]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x808], esi
pop esi
sete al
xor ecx, ebp
pop ebx
call fcn.01027ce5
leave
ret