Function at 0x10002530
Capabilities:
Contain obfuscated stackstrings
Copy file
Create service
Delete file
Move file
Persist via windows service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100149db
mov eax, dword fs:[0]
push eax
sub esp, 0x814
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x804], esi
mov ebx, dword [ebp + 8]
call fcn.10001e00
call fcn.10001eb0
test ebx, ebx
jne 0x10002583
call fcn.10001b30
mov esi, eax
jmp 0x10002b88
push 0x138
lea eax, [ebp - 0x7fc]
mov dword [ebp - 0x800], 0
push 0
push eax
call fcn.1000c7d0
mov eax, dword [esi]
lea ecx, [ebp - 0x800]
add esp, 0xc
push ecx
mov ecx, esi
call dword [eax + 0x14]
mov esi, eax
test esi, esi
jne 0x10002b88
cmp word [ebp - 0x764], ax
jne 0x100025da
push str.gmboxdrv
lea eax, [ebp - 0x764]
push 0x20
push eax
call fcn.100051ae
add esp, 0xc
push ebx
call fcn.100032a0
mov esi, eax
test esi, esi
jne 0x10002b88
push 1
push eax
push eax
mov dword [ebp - 0x820], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x1000262c
push 1
lea eax, [ebp - 0x764]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x10002625
push eax
mov dword [ebp - 0x820], 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, ebx
mov edi, ebx
mov dword [ebp - 0x808], edi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10002640
sub ecx, edx
sar ecx, 1
je 0x10002675
lea eax, [ebx - 2]
lea eax, [eax + ecx*2]
movzx edx, word [eax]
cmp edx, 0x5c
je 0x1000266c
cmp edx, 0x2f
je 0x1000266c
sub eax, 2
dec ecx
jne 0x10002657
jmp 0x10002675
lea edi, [ebx + ecx*2]
mov dword [ebp - 0x808], edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x4a0], ax
lea eax, [ebp - 0x49e]
push eax
call fcn.1000c7d0
add esp, 0xc
cmp dword [ebp - 0x820], 0
je 0x10002716
push ecx
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x764]
push eax
call fcn.10002d60
test eax, eax
jne 0x10002714
cmp word [ebp - 0x4a0], ax
je 0x10002714
lea edi, [ebp - 0x4a0]
mov ecx, edi
mov dword [ebp - 0x808], edi
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100026d0
sub ecx, edx
sar ecx, 1
je 0x10002714
lea eax, [ebp + ecx*2 - 0x4a2]
movzx edx, word [eax]
cmp edx, 0x5c
je 0x100026fd
cmp edx, 0x2f
je 0x100026fd
sub eax, 2
dec ecx
jne 0x100026e8
jmp 0x10002714
lea eax, [ebp - 0x4a0]
cmp word [eax + ecx*2], 0x2e
lea eax, [eax + ecx*2]
cmovne edi, eax
mov dword [ebp - 0x808], edi
xor esi, esi
push 0x7e
lea eax, [ebp - 0x8e]
push 0
push eax
call fcn.1000c7d0
xor eax, eax
mov dword [ebp - 0x90], 0x790053
push 0x206
push eax
mov word [ebp - 0x298], ax
lea eax, [ebp - 0x296]
push eax
mov dword [ebp - 0x8c], 0x740073
mov dword [ebp - 0x88], 0x6d0065
mov dword [ebp - 0x84], 0x320033
mov dword [ebp - 0x80], 0x64005c
mov dword [ebp - 0x7c], 0x690072
mov dword [ebp - 0x78], 0x650076
mov dword [ebp - 0x74], 0x730072
mov dword [ebp - 0x70], 0x5c
call fcn.1000c7d0
add esp, 0x18
lea eax, [ebp - 0x298]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
lea ecx, [ebp - 0x298]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100027b0
sub ecx, edx
sar ecx, 1
je 0x100029c6
movzx eax, word [ebp + ecx*2 - 0x29a]
cmp eax, 0x5c
je 0x100027fd
cmp eax, 0x2f
je 0x100027fd
mov eax, 0x5c
mov word [ebp + ecx*2 - 0x298], ax
inc ecx
add ecx, ecx
cmp ecx, 0x208
jae 0x100028c0
xor eax, eax
mov word [ebp + ecx - 0x298], ax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x298]
push 0x104
push eax
call fcn.100050f7
push edi
lea eax, [ebp - 0x298]
push 0x104
push eax
call fcn.100050f7
lea eax, [ebp - 0x298]
push eax
push ebx
call fcn.1000532e
add esp, 0x20
test eax, eax
je 0x100029c6
push str.kernel32.dll
mov dword [ebp - 0x81c], 0
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x814], 0
mov dword [ebp - 0x810], 0
mov byte [ebp - 0x80c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x818], eax
test eax, eax
je 0x100028c5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64DisableWow64FsRedirection
push eax
call edi
mov dword [ebp - 0x814], eax
test eax, eax
je 0x100028b4
push str.Wow64RevertWow64FsRedirection
push dword [ebp - 0x818]
call edi
mov dword [ebp - 0x810], eax
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0x818], 0
jmp 0x100028cb
call fcn.10004ee4
mov eax, dword [ebp - 0x814]
mov dword [ebp - 4], 0
test eax, eax
je 0x100028f6
lea ecx, [ebp - 0x81c]
push ecx
call eax
movzx ecx, byte [ebp - 0x80c]
test eax, eax
mov eax, 1
cmovne ecx, eax
mov byte [ebp - 0x80c], cl
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x298]
push 0
push eax
push ebx
call edi
test eax, eax
jne 0x10002985
push 0x206
push eax
mov word [ebp - 0x6a8], ax
lea eax, [ebp - 0x6a6]
push eax
call fcn.1000c7d0
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x6a8]
push 0x104
push eax
call fcn.100051ae
push 0x100196dc
lea eax, [ebp - 0x6a8]
push 0x104
push eax
call fcn.100050f7
add esp, 0x24
lea eax, [ebp - 0x6a8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
lea eax, [ebp - 0x6a8]
push eax
lea eax, [ebp - 0x298]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0
lea eax, [ebp - 0x298]
push eax
push ebx
call edi
mov ecx, dword [ebp - 0x810]
mov al, byte [ebp - 0x80c]
test ecx, ecx
je 0x100029af
test al, al
je 0x100029af
push dword [ebp - 0x81c]
call ecx
mov ecx, dword [ebp - 0x810]
xor al, al
mov byte [ebp - 0x80c], al
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x100029c6
test al, al
je 0x100029c6
push dword [ebp - 0x81c]
call ecx
cmp dword [ebp - 0x820], 0
je 0x10002ab7
push 1
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x804], eax
test eax, eax
je 0x10002a53
push 4
lea ecx, [ebp - 0x764]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
je 0x10002a3f
nop
lea eax, [ebp - 0x6c4]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x10002a27
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 5
jb 0x10002a00
xor edi, edi
jmp 0x10002a38
xor edi, edi
mov eax, 1
cmp dword [ebp - 0x6c0], 4
cmove edi, eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x804]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
jne 0x10002b88
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x10002afb
push 0x10
lea eax, [ebp - 0x764]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x10002a8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10002b81
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x10002b7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor eax, eax
cmp esi, 0x420
cmove esi, eax
jmp 0x10002b7a
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x298]
push 0x104
push eax
call fcn.100051ae
push dword [ebp - 0x808]
lea eax, [ebp - 0x298]
push 0x104
push eax
call fcn.100050f7
add esp, 0x18
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x10002b08
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10002b88
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x298]
push eax
push 1
push 2
push 1
push 0xf01ff
lea eax, [ebp - 0x764]
push eax
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
test edi, edi
jne 0x10002b51
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x431
jne 0x10002b4d
xor esi, esi
jmp 0x10002b51
test esi, esi
jne 0x10002b81
mov ecx, dword [ebp - 0x804]
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [ebp - 0x804]
mov dword [ebp - 0x7a8], eax
lea eax, [ebp - 0x800]
push 0
push eax
call fcn.10002ec0
test edi, edi
je 0x10002b81
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10004797
mov esp, ebp
pop ebp
ret 4