Function at 0x10003610
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
mov eax, dword [0x10028100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x624]
push eax
push str.SYSTEMCurrentControlSetServices.Winhlpsvr
push 0x80000002
mov dword [ebp - 0x624], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x100039d4
mov edx, dword [ebp - 0x624]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea ecx, [ebp - 0x62c]
push ecx
push 4
push eax
push str.Type
push edx
mov dword [ebp - 0x62c], 0x110
call esi
cmp dword [0x1002cbe8], 0
je 0x1000369d
push eax
push str.InstallWinhlpsvr_1___lu_
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 0xc
mov ecx, dword [ebp - 0x624]
push 4
lea eax, [ebp - 0x62c]
push eax
push 4
push 0
push str.Start
push ecx
mov dword [ebp - 0x62c], 2
call esi
cmp dword [0x1002cbe8], 0
je 0x100036e6
push eax
push str.InstallWinhlpsvr_2___lu_
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 0xc
mov eax, dword [ebp - 0x624]
push 4
lea edx, [ebp - 0x62c]
push edx
push 4
push 0
push str.ErrorControl
push eax
mov dword [ebp - 0x62c], 1
call esi
cmp dword [0x1002cbe8], 0
je 0x1000372f
push eax
push str.InstallWinhlpsvr_3___lu_
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x20e]
push edx
mov word [ebp - 0x210], cx
call fcn.10011ef0
add esp, 0xc
push str.Windows_Helper_Service
lea eax, [ebp - 0x210]
push 0x103
mov edi, 0x208
push eax
mov dword [ebp - 0x628], edi
call fcn.100081a0
mov ecx, dword [ebp - 0x628]
mov eax, dword [ebp - 0x624]
add esp, 0xc
push ecx
lea edx, [ebp - 0x210]
push edx
push 1
push 0
push str.DisplayName
push eax
call esi
cmp dword [0x1002cbe8], 0
je 0x100037b5
push eax
push str.InstallWinhlpsvr_4___lu_
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 0xc
push str..OcularServices
lea ecx, [ebp - 0x210]
push 0x103
push ecx
mov dword [ebp - 0x628], edi
call fcn.100081a0
mov edx, dword [ebp - 0x628]
mov ecx, dword [ebp - 0x624]
add esp, 0xc
push edx
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push str.Group
push ecx
call esi
cmp dword [0x1002cbe8], 0
je 0x10003818
push eax
push str.InstallWinhlpsvr_5___lu_
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 0xc
push str.LocalSystem
lea edx, [ebp - 0x210]
push 0x103
push edx
mov dword [ebp - 0x628], edi
call fcn.100081a0
mov eax, dword [ebp - 0x628]
mov edx, dword [ebp - 0x624]
add esp, 0xc
push eax
lea ecx, [ebp - 0x210]
push ecx
push 1
push 0
push str.ObjectName
push edx
call esi
cmp dword [0x1002cbe8], 0
je 0x1000387b
push eax
push str.InstallWinhlpsvr_6___lu_
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x61e]
push ecx
mov word [ebp - 0x620], ax
call fcn.10011ef0
add esp, 0xc
lea ebx, [ebp - 0x620]
call fcn.10002040
test eax, eax
je 0x100039b6
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x416]
push eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x628], edi
mov word [ebp - 0x418], dx
call fcn.10011ef0
add esp, 0xc
lea ecx, [ebp - 0x628]
push ecx
mov ecx, dword [ebp - 0x624]
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x630]
push eax
push 0
push str.ImagePath
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [0x1002cbe8], 0
je 0x1000392e
lea edx, [ebp - 0x418]
push edx
push eax
push str.InstallWinhlpsvr_7___lu____S__
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 0x10
push str.winrdgv3.exe
lea eax, [ebp - 0x620]
push eax
push str.__s_s_
lea ecx, [ebp - 0x210]
push 0x103
push ecx
call fcn.100081a0
add esp, 0x14
push 0x104
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.1001f2ba
add esp, 0xc
test eax, eax
je 0x100039b6
mov ecx, dword [ebp - 0x628]
mov eax, dword [ebp - 0x624]
push ecx
lea edx, [ebp - 0x210]
push edx
push 1
push 0
push str.ImagePath
push eax
call esi
cmp dword [0x1002cbe8], 0
je 0x100039b6
push eax
push str.InstallWinhlpsvr_8___lu_
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 0xc
mov ecx, dword [ebp - 0x624]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007ab0
mov esp, ebp
pop ebp
ret
cmp dword [0x1002cbe8], 0
je 0x100039f7
push str.CMonitorThread::CheckService_9
push str.Monitor
or ecx, 0xffffffff
mov edx, 0x1002cb7c
call fcn.10004720
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10007ab0
mov esp, ebp
pop ebp
ret