Function at 0x10087520
Capabilities:
Create service
Modify service
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100e6018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0xf003f
push 0
push 0
mov byte [ebp - 0x211], dl
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x10087562
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x25c]
xor edx, edx
cmp dword [eax], edx
push edi
lea edi, [esi + 0x3c]
cmovne edx, eax
cmp dword [edi + 0x14], 8
jb 0x10087583
mov eax, dword [edi]
mov dword [ebp - 0x21c], eax
jmp 0x10087589
mov dword [ebp - 0x21c], edi
cmp dword [esi + 0x2c], 8
lea ecx, [esi + 0x18]
jb 0x10087594
mov ecx, dword [ecx]
cmp dword [esi + 0x14], 8
jb 0x100875a4
mov eax, dword [esi]
mov dword [ebp - 0x218], eax
jmp 0x100875aa
mov dword [ebp - 0x218], esi
cmp byte [ebp - 0x211], 0
push 0
push 0
lea eax, [esi + 0x260]
push eax
push edx
mov edx, str.SpoolerGroup
mov eax, str.SchedulerGroup
cmove eax, edx
push eax
push dword [ebp - 0x21c]
push dword [esi + 0x38]
push dword [esi + 0x34]
push dword [esi + 0x30]
push 0xf01ff
push ecx
push dword [ebp - 0x218]
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ecx, eax
mov dword [ebp - 0x218], ecx
test ecx, ecx
jne 0x10087613
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x480], 8
lea eax, [esi + 0x46c]
jb 0x10087624
mov eax, dword [eax]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x210]
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push str.SYSTEMCurrentControlSetServicesEventLogApplication_
lea eax, [ebp - 0x204]
push 0x100
push eax
mov dword [ebp - 0x20c], 0
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x10087668
mov eax, dword [esi]
jmp 0x1008766a
mov eax, esi
push eax
lea eax, [ebp - 0x204]
push 0x100
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x100876c1
push dword [ebp - 0x218]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100947be
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x14], 8
mov eax, dword [esi + 0x4c]
jb 0x100876cc
mov edi, dword [edi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
inc eax
push eax
push edi
push 2
push 0
push str.EventMessageFile
push dword [ebp - 0x20c]
call esi
push 4
lea eax, [ebp - 0x208]
push eax
push 4
push 0
push str.TypesSupported
push dword [ebp - 0x20c]
mov dword [ebp - 0x208], 7
call esi
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x218]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.100947be
mov esp, ebp
pop ebp
ret