Function at 0x408910
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f0
mov eax, dword [0x424308]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [section..data]
push edi
lea ecx, [ebp - 0x2bc]
push 0x8a000003
push ecx
mov dword [ebp - 0x2c8], eax
call fcn.00401460
mov edi, eax
mov eax, esi
add esp, 8
lea edx, [eax + 2]
xor ebx, ebx
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x408952
sub eax, edx
lea edx, [ebp - 0x2d4]
sar eax, 1
push edx
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x2d4], esi
mov dword [ebp - 0x2d0], eax
call fcn.004013d0
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x238]
push edi
push ecx
call fcn.00408590
mov eax, dword [ebp - 0x290]
add esp, 0xc
cmp eax, ebx
je 0x4089b3
lea edx, [ebp - 0x284]
cmp eax, edx
je 0x4089b3
push eax
call fcn.0041021f
add esp, 4
mov eax, dword [ebp - 0x2bc]
cmp eax, ebx
je 0x4089d0
lea ecx, [ebp - 0x2b0]
cmp eax, ecx
je 0x4089d0
push eax
call fcn.0041021f
add esp, 4
push str..sys
lea ecx, [ebp - 0x238]
call fcn.00408440
mov esi, 0x8007139f
lea ecx, [ebp - 0x2d8]
mov dword [ebp - 0x2c4], esi
call fcn.004015e0
push ebx
lea ecx, [ebp - 0x2d8]
call fcn.00401620
test al, al
je 0x408a62
lea ecx, [ebp - 0x2dc]
call fcn.004015e0
lea edx, [ebp - 0x2d0]
push edx
lea ecx, [ebp - 0x2dc]
call fcn.004016a0
push 0x40
push str.DRIVERFILE
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x2cc]
push ecx
call fcn.00408180
mov edx, dword [eax]
mov eax, dword [ebp - 0x2d0]
add esp, 0x10
push eax
lea ecx, [ebp - 0x2dc]
mov dword [ebp - 0x2c4], edx
call fcn.004016c0
mov eax, dword [ebp - 0x2c4]
jmp 0x408a87
push 0x20
push str.DRIVERFILE
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x2cc]
push edx
call fcn.00408180
mov eax, dword [eax]
add esp, 0x10
mov dword [ebp - 0x2c4], eax
cmp eax, ebx
jge 0x408aa0
mov esi, dword [ebp - 0x2c8]
mov dword [esi], eax
mov eax, dword [ebp - 0x238]
cmp eax, ebx
jmp 0x40900a
push 0xffffffffffffffff
push str.system32drivers_
lea ecx, [ebp - 0x264]
call fcn.00401300
mov edx, dword [section..data]
push edx
lea ecx, [ebp - 0x264]
call fcn.00408440
push str..sys
lea ecx, [ebp - 0x264]
call fcn.00408440
cmp byte [ebp + 0xc], bl
je 0x408e99
push ebx
push 1
lea eax, [ebp - 0x2c4]
push eax
lea ecx, [ebp - 0x2c0]
call fcn.00402a50
mov eax, dword [ebp - 0x2c4]
lea ecx, [ebp - 0x2c0]
cmp eax, ebx
jge 0x408b47
mov esi, dword [ebp - 0x2c8]
mov dword [esi], eax
call fcn.00403970
mov eax, dword [ebp - 0x264]
cmp eax, ebx
je 0x408b2c
lea ecx, [ebp - 0x258]
cmp eax, ecx
je 0x408b2c
push eax
call fcn.0041021f
add esp, 4
mov eax, dword [ebp - 0x238]
cmp eax, ebx
je 0x40901f
lea edx, [ebp - 0x22c]
cmp eax, edx
jmp 0x409014
push ebx
lea eax, [ebp - 0x2dc]
push eax
call fcn.00402ed0
mov eax, dword [ebp - 0x2d8]
mov esi, dword [ebp - 0x2dc]
mov edi, eax
cmp esi, eax
je 0x408bde
jmp 0x408b70
push 0x206
lea edx, [ebp - 0x20a]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x20c], cx
call fcn.004104c0
mov eax, dword [esi]
add esp, 0xc
cmp eax, ebx
jne 0x408b99
mov eax, 0x421594
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.00402de0
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x2cc]
push eax
lea ecx, [ebp - 0x2c0]
call fcn.00402970
mov eax, dword [eax]
mov dword [ebp - 0x2c4], eax
cmp eax, ebx
jl 0x408c72
add esi, 0x3c
cmp esi, edi
jne 0x408b70
lea ecx, [ebp - 0x2dc]
call fcn.00403f00
mov eax, dword [ebp - 0x2c0]
cmp eax, ebx
je 0x408c28
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 4]
lea esi, [edx + eax + 4]
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
jne 0x408c28
mov ecx, dword [esi + 8]
cmp ecx, ebx
je 0x408c1b
push esi
call fcn.004017d0
test al, al
je 0x408c28
mov dword [esi + 8], ebx
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x2c0], ebx
test ebx, ebx
jne 0x408c4b
call edi
mov ecx, dword [section..data]
push 0x30
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x2e4], esi
test esi, esi
je 0x408d11
xor eax, eax
jmp 0x408d2a
mov edi, dword [ebp - 0x2c8]
lea ecx, [ebp - 0x2dc]
mov dword [edi], eax
call fcn.00403f00
mov eax, dword [ebp - 0x2c0]
cmp eax, ebx
je 0x408cc4
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 4]
lea esi, [edx + eax + 4]
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
jne 0x408cc4
mov ecx, dword [esi + 8]
cmp ecx, ebx
je 0x408cb7
push esi
call fcn.004017d0
test al, al
je 0x408cc4
mov dword [esi + 8], ebx
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov eax, dword [ebp - 0x264]
cmp eax, ebx
je 0x408ce1
lea ecx, [ebp - 0x258]
cmp eax, ecx
je 0x408ce1
push eax
call fcn.0041021f
add esp, 4
mov eax, dword [ebp - 0x238]
cmp eax, ebx
je 0x408cfe
lea edx, [ebp - 0x22c]
cmp eax, edx
je 0x408cfe
push eax
call fcn.0041021f
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004104b1
mov esp, ebp
pop ebp
ret
call edi
test eax, eax
je 0x408d25
jle 0x408d2a
and eax, 0xffff
or eax, 0x80070000
jmp 0x408d2a
mov eax, 0x8007054f
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x2c4], eax
test eax, eax
jns 0x408da7
mov edx, dword [ebp - 0x2c8]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [edx], eax
test esi, esi
je 0x408d4f
push esi
call edi
test ebx, ebx
je 0x408d56
push ebx
call edi
mov eax, dword [ebp - 0x264]
test eax, eax
je 0x408d73
lea ecx, [ebp - 0x258]
cmp eax, ecx
je 0x408d73
push eax
call fcn.0041021f
add esp, 4
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x408d90
lea edx, [ebp - 0x22c]
cmp eax, edx
je 0x408d90
push eax
call fcn.0041021f
add esp, 4
mov eax, dword [ebp - 0x2c8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004104b1
mov esp, ebp
pop ebp
ret
push 0
push 1
lea eax, [ebp - 0x2cc]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.00407d90
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x2c4], eax
test eax, eax
jns 0x408e19
mov edi, dword [ebp - 0x2c8]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [edi], eax
mov eax, dword [ebp - 0x2e4]
test eax, eax
je 0x408de8
push eax
call esi
test ebx, ebx
je 0x408def
push ebx
call esi
mov eax, dword [ebp - 0x264]
test eax, eax
je 0x408e0c
lea ecx, [ebp - 0x258]
cmp eax, ecx
je 0x408e0c
push eax
call fcn.0041021f
add esp, 4
mov eax, dword [ebp - 0x238]
test eax, eax
jmp 0x408ce9
mov ebx, dword [ebp - 0x2e4]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
jmp 0x408e30
mov eax, dword [ebp - 0x2e0]
test eax, eax
js 0x408e6a
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x408e68
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x408e61
jle 0x408e6a
and eax, 0xffff
or eax, 0x80070000
jmp 0x408e6a
mov eax, 0x8007054f
jmp 0x408e6a
xor eax, eax
mov dword [ebp - 0x2c4], eax
test eax, eax
jns 0x408e85
cmp eax, 0x80070420
jne 0x408e85
push 0x64
call edi
inc esi
cmp esi, 0xa
jl 0x408e30
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x408fc5
push ebx
jmp 0x408fc3
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x2c0], eax
cmp eax, ebx
jne 0x408eb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2ec], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x2e8], esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edi, edi
mov eax, dword [ebp - 0x264]
test eax, eax
jne 0x408edf
mov eax, 0x421594
mov ecx, dword [section..data]
push 0
push 0
push 0
push 0
push 0
push eax
push 1
push 3
push 1
push 0xf01ff
push 0x41e8d4
push ecx
lea edx, [ebp - 0x2ec]
push edx
lea eax, [ebp - 0x2cc]
push eax
lea ecx, [ebp - 0x2c0]
call fcn.00407e90
mov eax, dword [eax]
mov dword [ebp - 0x2c4], eax
test eax, eax
jns 0x408fb8
cmp eax, 0x80070431
je 0x409032
cmp eax, 0x80070430
jne 0x409095
test edi, edi
je 0x408f4b
push 0x12c
call ebx
mov edx, dword [section..data]
lea ecx, [ebp - 0x2c4]
push ecx
push 0xf01ff
push edx
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x2d4]
call fcn.00407f60
cmp dword [ebp - 0x2c4], 0
jl 0x408fa1
push 0
push 1
lea ecx, [ebp - 0x2f0]
push ecx
lea ecx, [ebp - 0x2d4]
call fcn.00407d90
lea edx, [ebp - 0x2e0]
push edx
lea ecx, [ebp - 0x2d4]
call fcn.00407e30
mov eax, dword [ebp - 0x2d4]
test eax, eax
je 0x408fae
push eax
call esi
inc edi
cmp edi, 5
jl 0x408ed0
mov eax, dword [ebp - 0x2ec]
test eax, eax
je 0x408fc5
push eax
call esi
cmp dword [ebp - 0x2c0], 0
je 0x408fd7
mov eax, dword [ebp - 0x2c0]
push eax
call esi
mov eax, dword [ebp - 0x264]
mov esi, dword [ebp - 0x2c8]
mov ecx, dword [ebp - 0x2c4]
mov dword [esi], ecx
test eax, eax
je 0x409002
lea edx, [ebp - 0x258]
cmp eax, edx
je 0x409002
push eax
call fcn.0041021f
add esp, 4
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x40901f
lea ecx, [ebp - 0x22c]
cmp eax, ecx
je 0x40901f
push eax
call fcn.0041021f
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004104b1
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x2c8]
mov dword [eax], 0
mov eax, dword [ebp - 0x2ec]
test eax, eax
je 0x40904b
push eax
call esi
cmp dword [ebp - 0x2c0], 0
je 0x40905d
mov ecx, dword [ebp - 0x2c0]
push ecx
call esi
mov eax, dword [ebp - 0x264]
test eax, eax
je 0x40907a
lea edx, [ebp - 0x258]
cmp eax, edx
je 0x40907a
push eax
call fcn.0041021f
add esp, 4
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x408d90
lea ecx, [ebp - 0x22c]
cmp eax, ecx
jmp 0x408d85
mov edx, dword [ebp - 0x2c8]
mov dword [edx], eax
mov eax, dword [ebp - 0x2ec]
test eax, eax
je 0x4090aa
push eax
call esi
cmp dword [ebp - 0x2c0], 0
je 0x408d56
mov eax, dword [ebp - 0x2c0]
push eax
call esi
jmp 0x408d56