Function at 0x100025e0
Capabilities:
Create service
Delete service
Modify service
Persist via run registry key
Persist via windows service
Query or enumerate registry value
Set registry value
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002023b
mov eax, dword fs:[0]
push eax
sub esp, 0xa4c
mov eax, dword [0x10028100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.10007220
test eax, eax
je 0x100026af
push 0x20000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x1000270c
push 0x20010000
push str.Winhlpsvr
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x100026a6
xor eax, eax
mov dword [ebp - 0xa50], eax
mov dword [ebp - 0xa4c], eax
mov dword [ebp - 0xa48], eax
mov dword [ebp - 0xa44], eax
mov dword [ebp - 0xa40], eax
mov dword [ebp - 0xa3c], eax
lea eax, [ebp - 0xa54]
push eax
push 1
push esi
mov dword [ebp - 0xa54], 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x10002698
cmp dword [ebp - 0xa50], 1
jne 0x1000269f
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1000270c
lea ecx, [ebp - 0xa38]
call fcn.10005e10
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
lea ecx, [ebp - 0xa38]
mov dword [ebp - 4], 0
call fcn.10005f20
test eax, eax
je 0x100026fa
push str.Winhlpsvr
lea ecx, [ebp - 0xa38]
call fcn.10006770
lea ecx, [ebp - 0xa38]
call fcn.10005f00
lea ecx, [ebp - 0xa38]
mov dword [ebp - 4], 0xffffffff
call fcn.10005f00
xor esi, esi
cmp dword [0x1002cbe8], esi
je 0x10002730
push str.CMonitorThread::CheckService_1
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 8
push 0x206
lea edx, [ebp - 0x616]
xor ecx, ecx
push esi
push edx
mov word [ebp - 0x618], cx
call fcn.10011ef0
add esp, 0xc
push str.winrdgv3.exe
push ecx
call fcn.10001120
add esp, 4
push eax
push 0x100230a8
lea eax, [ebp - 0x618]
push 0x103
push eax
call fcn.100081a0
add esp, 0x14
lea ecx, [ebp - 0x618]
push ecx
push str.__s_
lea edx, [ebp - 0xa28]
push 0x103
push edx
call fcn.100081a0
add esp, 0x10
call fcn.10007220
test eax, eax
je 0x10002b18
mov dword [ebp - 0xa30], esi
lea esp, [esp]
push 0xf003f
push 0
push 0
mov dword [ebp - 0xa2c], 1
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x10002aed
push 0xf01ff
push str..Winhlpsvr
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp esi, edi
jne 0x10002849
push edi
push edi
push edi
push edi
push str..OcularServices
lea eax, [ebp - 0xa28]
push eax
push 1
push 2
push 0x110
push 0xf01ff
push str.Windows_Helper_Service
push str..Winhlpsvr
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
cmp dword [0x1002cbe8], edi
je 0x10002ac9
push esi
push str.CMonitorThread::CheckService_3__0x_lx_
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 0xc
jmp 0x10002ac9
push 0x3ff
lea ecx, [ebp - 0x40f]
push edi
push ecx
mov byte [ebp - 0x410], 0
call fcn.10011ef0
add esp, 0xc
lea edx, [ebp - 0xa34]
push edx
push 0x400
lea eax, [ebp - 0x410]
push eax
push esi
mov dword [ebp - 0xa34], edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x100029e6
mov eax, dword [ebp - 0x3f4]
cmp eax, edi
je 0x100028af
push str.LocalSystem
push eax
call fcn.10008431
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x3f4]
je 0x100028b4
mov edi, 1
cmp dword [0x1002cbe8], 0
je 0x10002910
mov edx, dword [ebp - 0x400]
test edx, edx
jne 0x100028cc
mov edx, str.NULL
mov ecx, dword [ebp - 0x404]
test ecx, ecx
jne 0x100028db
mov ecx, str.NULL
test eax, eax
jne 0x100028e4
mov eax, str.NULL
push edx
mov edx, dword [ebp - 0x40c]
push ecx
mov ecx, dword [ebp - 0x410]
push eax
push ecx
push edx
push edi
push str.CMonitorThread::CheckService_5___lu___lu___lu____s_____s_____s__
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 0x20
cmp dword [ebp - 0x40c], 2
jne 0x10002967
mov eax, dword [ebp - 0x404]
test eax, eax
je 0x10002967
lea ecx, [ebp - 0xa28]
push ecx
push eax
call fcn.10008431
add esp, 8
test eax, eax
jne 0x10002967
mov eax, dword [ebp - 0x400]
test eax, eax
je 0x10002967
push str..OcularServices
push eax
call fcn.10008431
add esp, 8
test eax, eax
jne 0x10002967
cmp dword [ebp - 0x410], 0x110
jne 0x10002967
test edi, edi
je 0x10002ac9
push 0
push 0
push 0
push 0
push 0
push str..OcularServices
lea edx, [ebp - 0xa28]
push edx
push 0xffffffffffffffff
push 2
push 0x110
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
cmp dword [0x1002cbe8], 0
je 0x100029b1
push eax
push str.CMonitorThread::CheckService_6___lu_
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 0xc
test edi, edi
je 0x10002ac9
cmp dword [0x1002cbe8], 0
je 0x100029dc
push str.CMonitorThread::CheckService_7
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 8
call fcn.10003610
jmp 0x10002ac9
cmp dword [0x1002cbe8], edi
je 0x10002a08
push str.CMonitorThread::CheckService_4
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x45b
je 0x10002aa7
xor eax, eax
mov dword [ebp - 0xa50], eax
mov dword [ebp - 0xa4c], eax
mov dword [ebp - 0xa48], eax
mov dword [ebp - 0xa44], eax
mov dword [ebp - 0xa40], eax
mov dword [ebp - 0xa3c], eax
lea eax, [ebp - 0xa54]
push eax
push 1
push esi
mov dword [ebp - 0xa54], edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp dword [0x1002cbe8], edi
je 0x10002a78
push eax
push str.CMonitorThread::CheckService_5.1___lu_
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
cmp dword [0x1002cbe8], edi
je 0x10002aa2
push eax
push str.CMonitorThread::CheckService_5.2___lu_
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 0xc
call fcn.10003610
mov eax, dword [ebp - 0xa30]
inc eax
mov dword [ebp - 0xa2c], edi
mov dword [ebp - 0xa30], eax
cmp eax, 2
jbe 0x10002ac9
mov dword [ebp - 0xa2c], 1
test esi, esi
je 0x10002ad4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0xa2c], 0
je 0x100027b0
jmp 0x10002bfd
cmp dword [0x1002cbe8], edi
je 0x10002bfd
push str.CMonitorThread::CheckService_2
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 8
jmp 0x10002bfd
lea ecx, [ebp - 0xa2c]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
mov dword [ebp - 0xa2c], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x10002bfd
push 0x206
lea eax, [ebp - 0x81e]
xor edx, edx
push esi
push eax
mov word [ebp - 0x820], dx
call fcn.10011ef0
add esp, 0xc
lea ecx, [ebp - 0xa58]
push ecx
mov ecx, dword [ebp - 0xa2c]
lea edx, [ebp - 0x820]
push edx
lea eax, [ebp - 0xa30]
push eax
push esi
push str..Winhlpsvr
push ecx
mov dword [ebp - 0xa58], 0x208
mov dword [ebp - 0xa30], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10002bba
cmp dword [ebp - 0xa30], 1
jne 0x10002bba
lea edx, [ebp - 0x618]
push edx
lea eax, [ebp - 0x820]
push eax
call fcn.10008431
add esp, 8
test eax, eax
je 0x10002bf0
lea eax, [ebp - 0x618]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x10002bc3
sub eax, edx
mov edx, dword [ebp - 0xa2c]
sar eax, 1
inc eax
push eax
lea ecx, [ebp - 0x618]
push ecx
push 1
push esi
push str..Winhlpsvr
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0xa2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10007ab0
mov esp, ebp
pop ebp
ret