Function at 0x100294b0
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b8715
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x100dcd80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x50]
mov edi, dword [ebp + 0x60]
mov esi, dword [ebp + 0x58]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 0x5c]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa8], edi
push 0xf003f
push 0
push 0
mov dword [ebp - 4], 2
mov dword [edi], 0x1adb1
mov byte [ebp - 0x89], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x98], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x98], 0
mov ecx, dword [ebp - 0xa0]
mov dword [ecx], eax
mov dword [esi], eax
mov eax, dword [ebp - 0xa4]
mov dword [eax], 1
je 0x1002989b
mov esi, dword [ebp + 0x18]
mov eax, accept
sub eax, esi
cmp eax, 1
jb 0x10029994
cmp dword [ebp + 0x1c], 7
lea eax, [ebp + 8]
lea ecx, [esi + 1]
mov dword [ebp - 0x30], 0
cmova eax, dword [ebp + 8]
mov edx, 7
mov dword [ebp - 0xac], eax
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], eax
movups xmmword [ebp - 0x40], xmm0
cmp ecx, edx
jbe 0x100295e8
mov eax, ecx
or eax, edx
cmp eax, 0x7ffffffe
jbe 0x100295b3
mov eax, accept
jmp 0x100295bd
mov ecx, 0xa
cmp eax, ecx
cmovb eax, ecx
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.100073f0
mov edx, dword [ebp - 0x9c]
lea ecx, [esi + 1]
add esp, 8
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x40], eax
add esi, esi
mov dword [ebp - 0x30], ecx
push esi
push dword [ebp - 0xac]
mov dword [ebp - 0x2c], edx
push eax
call fcn.1008df10
mov eax, dword [ebp - 0x90]
mov ecx, 0x20
xor edx, edx
add esp, 0xc
mov word [eax + esi], cx
mov ecx, dword [ebp - 0x94]
mov word [eax + ecx*2], dx
cmp dword [ebp + 0x34], 7
lea eax, [ebp + 0x20]
push dword [ebp + 0x30]
cmova eax, dword [ebp + 0x20]
lea ecx, [ebp - 0x40]
push eax
mov byte [ebp - 4], 3
call fcn.1000e440
mov dword [ebp - 0x60], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x5c], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x70], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x60], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 5
cmp ecx, 7
jbe 0x100296ad
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100296a3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10029999
push ecx
push edx
call fcn.1008c554
add esp, 8
cmp dword [ebp - 0x5c], 7
lea esi, [ebp + 0x38]
push 0
push 0
push 0
push 0
push 0
mov dword [edi], 0x1adb2
lea edx, [ebp + 0x38]
lea edi, [ebp - 0x70]
cmova edi, dword [ebp - 0x70]
cmp dword [ebp + 0x4c], 7
push edi
cmova esi, dword [ebp + 0x38]
cmova edx, dword [ebp + 0x38]
push 1
push 2
push 0x10
push 0xf01ff
push esi
push edx
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
mov dword [ebp - 0x90], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0xa0]
mov edi, dword [ebp - 0xa8]
mov dword [ecx], eax
mov eax, dword [ebp - 0xa4]
mov dword [eax], 2
test esi, esi
je 0x10029853
xorps xmm0, xmm0
mov byte [ebp - 0x89], 1
xor eax, eax
mov dword [edi], 0x1adb3
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov eax, dword [ebp + 0x64]
mov byte [ebp - 4], 6
cmp eax, 1
jne 0x1002975c
push 8
jmp 0x10029763
cmp eax, 2
jne 0x10029786
push 9
lea eax, [ebp - 0x88]
push eax
call fcn.1002f4a0
add esp, 8
lea ecx, [ebp - 0x58]
push eax
call fcn.1000ec70
lea ecx, [ebp - 0x88]
call fcn.10007690
cmp dword [ebp - 0x44], 7
lea eax, [ebp - 0x58]
cmova eax, dword [ebp - 0x58]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x94]
push eax
push 1
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
call esi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x3c]
push eax
push 2
push dword [ebp - 0x90]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 0x64
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 0x64
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0x64
mov dword [edi], 0x1adb4
call esi
push dword [ebp - 0x90]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov ecx, dword [ebp - 0x44]
cmp ecx, 7
jbe 0x10029859
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10029847
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002999e
push ecx
push edx
call fcn.1008c554
add esp, 8
jmp 0x10029859
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x98]
call esi
mov ecx, dword [ebp - 0x5c]
cmp ecx, 7
jbe 0x1002989b
mov edx, dword [ebp - 0x70]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10029891
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100299a3
push ecx
push edx
call fcn.1008c554
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov dword [edi], 0x1adb5
cmp ecx, 7
jbe 0x100298db
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100298d1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100299a8
push ecx
push edx
call fcn.1008c554
add esp, 8
mov ecx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
cmp ecx, 7
jbe 0x10029929
mov edx, dword [ebp + 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1002991f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100299a8
push ecx
push edx
call fcn.1008c554
add esp, 8
mov ecx, dword [ebp + 0x4c]
xor eax, eax
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 7
mov word [ebp + 0x20], ax
cmp ecx, 7
jbe 0x10029973
mov edx, dword [ebp + 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10029969
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100299a8
push ecx
push edx
call fcn.1008c554
add esp, 8
mov al, byte [ebp - 0x89]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008c562
mov esp, ebp
pop ebp
ret
call fcn.10002500
call fcn.10091b9f
call fcn.10091b9f
call fcn.10091b9f
call fcn.10091b9f
int3