Function at 0x1003482
Capabilities:
Create service
Modify service
Persist via windows service
Query environment variable

Disassembly:
mov eax, 0x100f6d0
call fcn.01003f88
sub esp, 0x19c
mov eax, dword [0x1014030]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], eax
mov esi, 0x104
push esi
xor ebx, ebx
lea eax, [ebp - 0x118]
push eax
push ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x128], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, ebx
jne 0x100350d
push esi
lea eax, [ebp - 0x118]
push eax
push 1
call fcn.01006394
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, ebx
jne 0x100350d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10034ff
call esi
mov dword [ebp - 0x11c], eax
jmp 0x1003944
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x10034f4
push 0x10
mov dword [ebp - 4], ebx
call fcn.01006394
push ebx
push 0xfffffffffffffff0
mov esi, 0xf003f
push esi
push eax
push 0x80000002
lea ecx, [ebp - 0x164]
call fcn.01004a7e
push ebx
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 1
call fcn.01004449
mov edi, dword [ebp - 0x164]
push 0x11
call fcn.01006394
push ebx
push 0xfffffffffffffff0
push esi
push eax
push edi
lea ecx, [ebp - 0x1a8]
call fcn.01004a7e
push ebx
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 2
call fcn.01004449
mov edi, dword [ebp - 0x1a8]
push 2
call fcn.01006394
push ebx
push ebx
push esi
push eax
push edi
lea ecx, [ebp - 0x18c]
call fcn.01004a7e
push 0x12
mov byte [ebp - 4], 3
call fcn.01006394
push 1
lea ecx, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x18c]
call fcn.010045c8
push 0x13
call fcn.01006394
push 4
push 7
push eax
lea ecx, [ebp - 0x18c]
call fcn.01004614
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 2
call fcn.01004775
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 1
call fcn.01004775
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], bl
call fcn.01004775
jmp 0x1003618
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x11c], ebx
jne 0x1003944
push esi
push ebx
push ebx
mov dword [ebp - 4], 5
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [ebp - 0x124], eax
jne 0x100365e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x144], eax
push 0x10101d0
lea eax, [ebp - 0x144]
jmp 0x1003894
push 0x21
call fcn.01006394
push 0x65
mov esi, eax
call fcn.01006394
push 2
mov edi, eax
call fcn.01006394
push ebx
push ebx
push esi
push ebx
push ebx
lea ecx, [ebp - 0x118]
push ecx
push ebx
push 3
push 0x20
mov esi, 0xf01ff
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CreateServiceA]
push eax
push dword [ebp - 0x124]
call edi
cmp eax, ebx
mov dword [ebp - 0x120], eax
jne 0x10036c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x148], eax
push 0x10101d0
lea eax, [ebp - 0x148]
jmp 0x1003894
push 0x69
call fcn.01006394
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x128]
push eax
push 1
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
cmp eax, ebx
jne 0x1003706
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x134], eax
push 0x10101d0
lea eax, [ebp - 0x134]
jmp 0x1003894
lea ecx, [ebp - 0x16c]
call fcn.01005041
push ebx
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 6
call fcn.010058e6
push 0x201fd
push 0x1001544
lea ecx, [ebp - 0x16c]
call fcn.010057b1
push esi
push 0x1001558
lea ecx, [ebp - 0x16c]
call fcn.010057b1
push esi
push 0x10014b8
lea ecx, [ebp - 0x16c]
call fcn.010057b1
push esi
push 0x10014cc
lea ecx, [ebp - 0x16c]
call fcn.010057b1
push 0x2019d
push 0x100147c
lea ecx, [ebp - 0x16c]
call fcn.010057b1
push dword [ebp - 0x16c]
push 4
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_SetServiceObjectSecurity]
cmp eax, ebx
jne 0x10037b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x13c], eax
push 0x10101d0
lea eax, [ebp - 0x13c]
jmp 0x1003894
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x17
mov dword [ebp - 0x120], ebx
call fcn.01006394
push 0x66
mov dword [ebp - 0x11c], eax
call fcn.01006394
push 3
mov dword [ebp - 0x12c], eax
call fcn.01006394
push ebx
push ebx
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x118]
push ebx
push ebx
push ecx
push ebx
push 3
push 0x20
push esi
push dword [ebp - 0x12c]
push eax
push dword [ebp - 0x124]
call edi
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x120], esi
jne 0x1003830
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x140], eax
push 0x10101d0
lea eax, [ebp - 0x140]
jmp 0x1003894
push 0x6a
call fcn.01006394
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x128]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
cmp eax, ebx
jne 0x100386a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x138], eax
push 0x10101d0
lea eax, [ebp - 0x138]
jmp 0x1003894
push dword [ebp - 0x16c]
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_SetServiceObjectSecurity]
cmp eax, ebx
jne 0x100389a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x130], eax
push 0x10101d0
lea eax, [ebp - 0x130]
push eax
call sub.msvcrt.dll__CxxThrowException
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov dword [ebp - 0x120], ebx
call fcn.01002fe9
cmp eax, ebx
mov dword [ebp - 0x11c], eax
je 0x10038cd
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 5
call fcn.0100505c
or dword [ebp - 4], 0xffffffff
jmp 0x1003944
push dword [ebp - 0x124]
call esi
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0x124], ebx
mov byte [ebp - 4], 5
call fcn.0100505c
jmp 0x1003938
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x11c], ebx
je 0x1003951
call fcn.01002a85
mov eax, dword [ebp - 0x11c]
jmp 0x1003953
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.01003cd7
pop edi
pop esi
pop ebx
leave
ret