Function at 0x100036b0
Capabilities:
Create service
Get common file path
Modify service
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x83c
mov eax, dword [0x100301b0]
xor eax, esp
mov dword [esp + 0x838], eax
push ebx
push edi
xor edi, edi
mov ebx, ecx
push 0x206
lea ecx, [esp + 0x436]
xor eax, eax
push edi
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov word [esp + 0x43c], ax
call fcn.1000e5a0
add esp, 0xc
cmp esi, edi
je 0x10003995
cmp ebx, edi
je 0x10003995
lea ecx, [esp + 0x14]
call fcn.10004210
test eax, eax
jne 0x10003974
push 0x206
lea eax, [esp + 0x22e]
xor edx, edx
push edi
push eax
mov word [esp + 0x234], dx
call fcn.1000e5a0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x206
lea eax, [esp + 0x26]
xor edx, edx
push edi
push eax
mov word [esp + 0x2c], dx
call fcn.1000e5a0
push esi
lea ecx, [esp + 0x238]
push ecx
push str._s_svchost.exe__k__s
mov ecx, 0x104
lea ebx, [esp + 0x38]
call fcn.10002cb0
push 0x208
lea edx, [esp + 0x654]
push edi
push edx
call fcn.1000e5a0
add esp, 0x24
push 0x104
lea eax, [esp + 0x63c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x100037b4
sub eax, edx
mov edx, dword [esp + 0x14]
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push esi
push 7
push edi
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10003950
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [esp + 0x1c], ebx
cmp ebx, edi
je 0x10003946
push ebp
push edi
push edi
push edi
push edi
push edi
lea eax, [esp + 0x38]
push eax
push 1
push 2
push 0x10
push 0xf01ff
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebp, eax
cmp ebp, edi
jne 0x100038aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
cmp eax, 0x431
jne 0x1000384e
push 0xf01ff
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, eax
cmp ebp, edi
jne 0x10003884
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [esp + 0x18]
pop ebp
call fcn.10004030
mov eax, dword [esp + 8]
pop edi
pop ebx
mov ecx, dword [esp + 0x838]
xor ecx, esp
call fcn.1000d16f
add esp, 0x83c
ret
push edi
push edi
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x3c]
push ecx
push 1
push 2
push 0x10
push ebp
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x100038aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
push esi
push 0x1002c008
push 0x1002c484
mov ecx, 0x104
lea ebx, [esp + 0x440]
call fcn.10002cb0
mov edi, ebx
add esp, 0xc
lea ecx, [esp + 0x14]
mov ebx, 0x80000002
call fcn.10004160
test eax, eax
jne 0x10003936
mov ebx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
mov edi, str.Parameters
call fcn.10004160
test eax, eax
jne 0x1000392d
mov edi, dword [esp + 0x1c]
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10003900
mov ebx, dword [esp + 0x10]
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
call fcn.100040c0
test eax, eax
jne 0x10003924
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x10]
call fcn.10004030
mov ecx, dword [esp + 0x14]
call fcn.10004030
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [esp + 0x20]
jmp 0x10003858
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x14]
call fcn.10004030
mov eax, dword [esp + 8]
pop edi
pop ebx
mov ecx, dword [esp + 0x838]
xor ecx, esp
call fcn.1000d16f
add esp, 0x83c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov dword [esp + 4], eax
pop ebx
mov ecx, dword [esp + 0x838]
xor ecx, esp
call fcn.1000d16f
add esp, 0x83c
ret
mov ecx, dword [esp + 0x840]
pop edi
pop ebx
xor ecx, esp
mov eax, 0x57
call fcn.1000d16f
add esp, 0x83c
ret