Function at 0x10029460
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b8315
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x100dbe80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x50]
mov edi, dword [ebp + 0x60]
mov esi, dword [ebp + 0x58]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 0x5c]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa8], edi
push 0xf003f
push 0
push 0
mov dword [ebp - 4], 2
mov dword [edi], 0x1adb1
mov byte [ebp - 0x89], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x98], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x98], 0
mov ecx, dword [ebp - 0xa0]
mov dword [ecx], eax
mov dword [esi], eax
mov eax, dword [ebp - 0xa4]
mov dword [eax], 1
je 0x1002984b
mov esi, dword [ebp + 0x18]
mov eax, accept
sub eax, esi
cmp eax, 1
jb 0x10029944
cmp dword [ebp + 0x1c], 7
lea eax, [ebp + 8]
lea ecx, [esi + 1]
mov dword [ebp - 0x30], 0
cmova eax, dword [ebp + 8]
mov edx, 7
mov dword [ebp - 0xac], eax
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x40]
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], eax
movups xmmword [ebp - 0x40], xmm0
cmp ecx, edx
jbe 0x10029598
mov eax, ecx
or eax, edx
cmp eax, 0x7ffffffe
jbe 0x10029563
mov eax, accept
jmp 0x1002956d
mov ecx, 0xa
cmp eax, ecx
cmovb eax, ecx
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10007420
mov edx, dword [ebp - 0x9c]
lea ecx, [esi + 1]
add esp, 8
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x40], eax
add esi, esi
mov dword [ebp - 0x30], ecx
push esi
push dword [ebp - 0xac]
mov dword [ebp - 0x2c], edx
push eax
call fcn.1008db40
mov eax, dword [ebp - 0x90]
mov ecx, 0x20
xor edx, edx
add esp, 0xc
mov word [eax + esi], cx
mov ecx, dword [ebp - 0x94]
mov word [eax + ecx*2], dx
cmp dword [ebp + 0x34], 7
lea eax, [ebp + 0x20]
push dword [ebp + 0x30]
cmova eax, dword [ebp + 0x20]
lea ecx, [ebp - 0x40]
push eax
mov byte [ebp - 4], 3
call fcn.1000e4a0
mov dword [ebp - 0x60], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x5c], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x70], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x60], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 5
cmp ecx, 7
jbe 0x1002965d
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10029653
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10029949
push ecx
push edx
call fcn.1008c2e7
add esp, 8
cmp dword [ebp - 0x5c], 7
lea esi, [ebp + 0x38]
push 0
push 0
push 0
push 0
push 0
mov dword [edi], 0x1adb2
lea edx, [ebp + 0x38]
lea edi, [ebp - 0x70]
cmova edi, dword [ebp - 0x70]
cmp dword [ebp + 0x4c], 7
push edi
cmova esi, dword [ebp + 0x38]
cmova edx, dword [ebp + 0x38]
push 1
push 2
push 0x10
push 0xf01ff
push esi
push edx
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
mov dword [ebp - 0x90], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0xa0]
mov edi, dword [ebp - 0xa8]
mov dword [ecx], eax
mov eax, dword [ebp - 0xa4]
mov dword [eax], 2
test esi, esi
je 0x10029803
xorps xmm0, xmm0
mov byte [ebp - 0x89], 1
xor eax, eax
mov dword [edi], 0x1adb3
movups xmmword [ebp - 0x58], xmm0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov eax, dword [ebp + 0x64]
mov byte [ebp - 4], 6
cmp eax, 1
jne 0x1002970c
push 8
jmp 0x10029713
cmp eax, 2
jne 0x10029736
push 9
lea eax, [ebp - 0x88]
push eax
call fcn.1002f1d0
add esp, 8
lea ecx, [ebp - 0x58]
push eax
call fcn.1000ece0
lea ecx, [ebp - 0x88]
call fcn.100076d0
cmp dword [ebp - 0x44], 7
lea eax, [ebp - 0x58]
cmova eax, dword [ebp - 0x58]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x94]
push eax
push 1
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
call esi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x3c]
push eax
push 2
push dword [ebp - 0x90]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 0x64
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 0x64
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0x64
mov dword [edi], 0x1adb4
call esi
push dword [ebp - 0x90]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov ecx, dword [ebp - 0x44]
cmp ecx, 7
jbe 0x10029809
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100297f7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002994e
push ecx
push edx
call fcn.1008c2e7
add esp, 8
jmp 0x10029809
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x98]
call esi
mov ecx, dword [ebp - 0x5c]
cmp ecx, 7
jbe 0x1002984b
mov edx, dword [ebp - 0x70]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10029841
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10029953
push ecx
push edx
call fcn.1008c2e7
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov dword [edi], 0x1adb5
cmp ecx, 7
jbe 0x1002988b
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10029881
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10029958
push ecx
push edx
call fcn.1008c2e7
add esp, 8
mov ecx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
cmp ecx, 7
jbe 0x100298d9
mov edx, dword [ebp + 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100298cf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10029958
push ecx
push edx
call fcn.1008c2e7
add esp, 8
mov ecx, dword [ebp + 0x4c]
xor eax, eax
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 7
mov word [ebp + 0x20], ax
cmp ecx, 7
jbe 0x10029923
mov edx, dword [ebp + 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10029919
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10029958
push ecx
push edx
call fcn.1008c2e7
add esp, 8
mov al, byte [ebp - 0x89]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008c2f5
mov esp, ebp
pop ebp
ret
call fcn.10002500
call fcn.100917bf
call fcn.100917bf
call fcn.100917bf
call fcn.100917bf
int3