Function at 0x10055060
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1070
call fcn.1005cad0
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1006c374]
movups xmm0, xmmword [str.ImagePath]
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x630]
push ecx
push str.SYSTEMCurrentControlSetServices_
push str._s_s
push 0xffffffffffffffff
push 0x104
xor esi, esi
mov dword [ebp - 0x1070], ecx
push eax
mov dword [ebp - 0x106c], esi
movups xmmword [ebp - 0x18], xmm0
call fcn.1000f290
add esp, 0x18
test eax, eax
js 0x100552bb
lea eax, [ebp - 0x106c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x630]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100552bb
mov word [ebp - 0x220], ax
mov word [ebp - 0x428], ax
mov dword [ebp - 0xc54], eax
lea eax, [ebp - 0xc50]
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0xc50], 0x104
push eax
lea eax, [ebp - 0xc54]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x106c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100552bb
push ecx
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.10054510
push 0x105
lea eax, [ebp - 0xc4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.svchost.exe
lea eax, [ebp - 0xc4c]
push eax
push 0x100676d8
push 0xffffffffffffffff
lea eax, [ebp - 0x838]
push 0x104
push eax
call fcn.1000f290
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x838]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 0x20
test eax, eax
jne 0x10055250
push str.Parameters
lea eax, [ebp - 0x630]
push eax
push 0x100676d8
push 0xffffffffffffffff
lea eax, [ebp - 0xa40]
push 0x104
push eax
call fcn.1000f290
add esp, 0x18
test eax, eax
js 0x100552bb
lea eax, [ebp - 0x106c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0xa40]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100552bb
mov word [ebp - 0x220], ax
mov dword [ebp - 0xc54], eax
lea eax, [ebp - 0xc50]
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0xc50], 0x104
push eax
lea eax, [ebp - 0xc54]
push eax
push esi
push str.ServiceDll
push dword [ebp - 0x106c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100552bb
push ecx
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.10054510
xor eax, eax
cmp ax, word [ebp - 0x428]
je 0x100552b6
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea eax, [ebp - 0x1064]
push 0xffffffffffffffff
push dword [ebp - 0x1070]
mov dword [ebp - 0x1068], 4
push 0x104
push eax
call esi
push 0xffffffffffffffff
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0xe5c]
push 0x104
push eax
call esi
mov eax, dword [ebx + 4]
lea edx, [ebp - 0x1068]
add esp, 0x20
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 4]
test eax, eax
jne 0x100552b6
mov dword [ebx + 8], 1
mov esi, 1
push dword [ebp - 0x106c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 4