Function at 0x1005aca0
Capabilities:
Create service
Delete service
Get disk information
Query service status
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x108
mov eax, dword [0x100cd008]
xor eax, esp
mov dword [esp + 0x104], eax
movsd xmm0, qword [0x100c2608]
lea eax, [esp + 0x1c]
push esi
push edi
push eax
push 0
push 0
push 0
push 0
push pe_nt_image_headers32
lea eax, [esp + 0x34]
movsd qword [esp + 0x3c], xmm0
movsd xmm0, qword [0x100c24b8]
mov esi, ecx
push eax
lea eax, [esp + 0x74]
mov dword [esp + 0x48], esi
push eax
mov byte [esp + 0x32], 1
mov byte [esp + 0x33], 1
movsd qword [esp + 0x3c], xmm0
call fcn.1000c5f0
movsd xmm5, qword [esp + 0x78]
add esp, 0x20
movsd xmm4, qword [0x100c1a28]
movaps xmm3, xmm5
movq xmm0, qword [str.Ysdf:MountX]
subsd xmm3, xmm4
mov eax, dword [0x1007de40]
movsd xmm2, qword [0x100c4130]
movq qword [esp + 0xa4], xmm0
xorps xmm0, xmm0
mov dword [esp + 0xac], eax
mov al, byte [0x1007de44]
ucomisd xmm3, xmm0
mov byte [esp + 0xb0], al
lahf
test ah, 0x44
jnp 0x1005adb3
movsd xmm0, qword [0x100c07d0]
movaps xmm1, xmm3
andps xmm1, xmm2
andps xmm0, xmm2
comisd xmm1, xmm0
jbe 0x1005adb3
movaps xmm0, xmm4
mov dword [esi], 1
divsd xmm0, xmm3
sub esp, 0x18
andps xmm0, xmm2
movsd qword [esp + 0x10], xmm0
movsd qword [esp + 8], xmm5
movsd qword [esp], xmm4
push 0x1007cb80
push str.eraPmat00
push str._s_failed:__s_want__.20g_got__.20g__1__.3g__n
call fcn.100010e0
add esp, 0x24
jmp 0x1005ade1
cmp dword [0x100ceab0], 0
je 0x1005ade9
sub esp, 0x10
movsd qword [esp + 8], xmm5
movsd qword [esp], xmm4
push 0x1007cb80
push str.eraPmat00
push str._s_passed:__s_want__.20g_got__.20g_n
call fcn.100010e0
add esp, 0x1c
movsd xmm2, qword [0x100c4130]
movsd xmm6, qword [esp + 0x60]
xorps xmm0, xmm0
movsd xmm5, qword [0x100c10f8]
movaps xmm3, xmm6
movsd xmm4, qword [0x100c0798]
subsd xmm3, xmm5
ucomisd xmm3, xmm0
lahf
test ah, 0x44
jnp 0x1005ae62
movaps xmm1, xmm3
movaps xmm0, xmm4
andps xmm1, xmm2
andps xmm0, xmm2
comisd xmm1, xmm0
jbe 0x1005ae62
movaps xmm0, xmm5
mov dword [esi], 1
divsd xmm0, xmm3
sub esp, 0x18
andps xmm0, xmm2
movsd qword [esp + 0x10], xmm0
movsd qword [esp + 8], xmm6
movsd qword [esp], xmm5
push 0x1007cb90
push str.eraPmat00
push str._s_failed:__s_want__.20g_got__.20g__1__.3g__n
call fcn.100010e0
add esp, 0x24
jmp 0x1005ae90
cmp dword [0x100ceab0], 0
je 0x1005ae98
sub esp, 0x10
movsd qword [esp + 8], xmm6
movsd qword [esp], xmm5
push 0x1007cb90
push str.eraPmat00
push str._s_passed:__s_want__.20g_got__.20g_n
call fcn.100010e0
add esp, 0x1c
movsd xmm4, qword [0x100c0798]
movsd xmm6, qword [esp + 0x68]
movsd xmm5, qword [0x100c0fc0]
movaps xmm3, xmm6
movq xmm0, qword [0x1007cbc8]
subsd xmm3, xmm5
mov eax, dword [0x1007cbd0]
movq qword [esp + 0xcc], xmm0
xorps xmm0, xmm0
mov dword [esp + 0xd4], eax
ucomisd xmm3, xmm0
lahf
test ah, 0x44
jnp 0x1005af2e
movsd xmm2, qword [0x100c4130]
movaps xmm1, xmm3
movaps xmm0, xmm4
andps xmm1, xmm2
andps xmm0, xmm2
comisd xmm1, xmm0
jbe 0x1005af2e
movaps xmm0, xmm5
mov dword [esi], 1
divsd xmm0, xmm3
sub esp, 0x18
andps xmm0, xmm2
movsd qword [esp + 0x10], xmm0
movsd qword [esp + 8], xmm6
movsd qword [esp], xmm5
push 0x1007cb94
push str.eraPmat00
push str._s_failed:__s_want__.20g_got__.20g__1__.3g__n
call fcn.100010e0
add esp, 0x24
jmp 0x1005af5c
cmp dword [0x100ceab0], 0
je 0x1005af5c
sub esp, 0x10
movsd qword [esp + 8], xmm6
movsd qword [esp], xmm5
push 0x1007cb94
push str.eraPmat00
push str._s_passed:__s_want__.20g_got__.20g_n
call fcn.100010e0
add esp, 0x1c
movsd xmm5, qword [esp + 0x70]
movsd xmm4, qword [0x100c2d88]
movaps xmm3, xmm5
movq xmm0, qword [0x1007cbc8]
subsd xmm3, xmm4
mov eax, dword [0x1007cbd0]
movq qword [esp + 0xc0], xmm0
xorps xmm0, xmm0
mov dword [esp + 0xc8], eax
ucomisd xmm3, xmm0
lahf
test ah, 0x44
jnp 0x1005aff7
movsd xmm2, qword [0x100c4130]
movaps xmm1, xmm3
movsd xmm0, qword [0x100c0798]
andps xmm1, xmm2
andps xmm0, xmm2
comisd xmm1, xmm0
jbe 0x1005aff7
movaps xmm0, xmm4
mov dword [esi], 1
divsd xmm0, xmm3
sub esp, 0x18
andps xmm0, xmm2
movsd qword [esp + 0x10], xmm0
movsd qword [esp + 8], xmm5
movsd qword [esp], xmm4
push 0x1007cb98
push str.eraPmat00
push str._s_failed:__s_want__.20g_got__.20g__1__.3g__n
call fcn.100010e0
add esp, 0x24
jmp 0x1005b025
cmp dword [0x100ceab0], 0
je 0x1005b025
sub esp, 0x10
movsd qword [esp + 8], xmm5
movsd qword [esp], xmm4
push 0x1007cb98
push str.eraPmat00
push str._s_passed:__s_want__.20g_got__.20g_n
call fcn.100010e0
add esp, 0x1c
movsd xmm5, qword [esp + 0x78]
movsd xmm4, qword [0x100c1a70]
movaps xmm3, xmm5
movq xmm0, qword [str.NameDisplay]
subsd xmm3, xmm4
mov eax, dword [0x1007cbdc]
movq qword [esp + 0xb4], xmm0
xorps xmm0, xmm0
mov dword [esp + 0xbc], eax
ucomisd xmm3, xmm0
lahf
test ah, 0x44
jnp 0x1005b0c0
movsd xmm2, qword [0x100c4130]
movaps xmm1, xmm3
movsd xmm0, qword [0x100c07d0]
andps xmm1, xmm2
andps xmm0, xmm2
comisd xmm1, xmm0
jbe 0x1005b0c0
movaps xmm0, xmm4
mov dword [esi], 1
divsd xmm0, xmm3
sub esp, 0x18
andps xmm0, xmm2
movsd qword [esp + 0x10], xmm0
movsd qword [esp + 8], xmm5
movsd qword [esp], xmm4
push 0x1007cb9c
push str.eraPmat00
push str._s_failed:__s_want__.20g_got__.20g__1__.3g__n
call fcn.100010e0
add esp, 0x24
jmp 0x1005b0ee
cmp dword [0x100ceab0], 0
je 0x1005b0ee
sub esp, 0x10
movsd qword [esp + 8], xmm5
movsd qword [esp], xmm4
push 0x1007cb9c
push str.eraPmat00
push str._s_passed:__s_want__.20g_got__.20g_n
call fcn.100010e0
add esp, 0x1c
movsd xmm5, qword [esp + 0x80]
xorps xmm0, xmm0
movsd xmm4, qword [0x100c2890]
movaps xmm3, xmm5
subsd xmm3, xmm4
ucomisd xmm3, xmm0
lahf
test ah, 0x44
jnp 0x1005b16f
movsd xmm2, qword [0x100c4130]
movaps xmm1, xmm3
movsd xmm0, qword [0x100c0798]
andps xmm1, xmm2
andps xmm0, xmm2
comisd xmm1, xmm0
jbe 0x1005b16f
movaps xmm0, xmm4
mov dword [esi], 1
divsd xmm0, xmm3
sub esp, 0x18
andps xmm0, xmm2
movsd qword [esp + 0x10], xmm0
movsd qword [esp + 8], xmm5
movsd qword [esp], xmm4
push 0x1007cba0
push str.eraPmat00
push str._s_failed:__s_want__.20g_got__.20g__1__.3g__n
call fcn.100010e0
add esp, 0x24
jmp 0x1005b19d
cmp dword [0x100ceab0], 0
je 0x1005b19d
sub esp, 0x10
movsd qword [esp + 8], xmm5
movsd qword [esp], xmm4
push 0x1007cba0
push str.eraPmat00
push str._s_passed:__s_want__.20g_got__.20g_n
call fcn.100010e0
add esp, 0x1c
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push 3
push 0x10
push 0xf01ff
lea eax, [esp + 0xdc]
mov dword [esp + 0x70], 0
push eax
lea eax, [esp + 0xec]
xorps xmm0, xmm0
push eax
push 0
movaps xmmword [esp + 0x64], xmm0
movq qword [esp + 0x74], xmm0
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
push 1
push 0
push 0
mov dword [esp + 0x20], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
movsd xmm5, qword [esp + 0x88]
xorps xmm0, xmm0
movsd xmm4, qword [0x100c2cc0]
movaps xmm3, xmm5
subsd xmm3, xmm4
mov edi, eax
mov dword [esp + 0x18], edi
ucomisd xmm3, xmm0
lahf
test ah, 0x44
jnp 0x1005b279
movsd xmm2, qword [0x100c4130]
movaps xmm1, xmm3
movsd xmm0, qword [0x100c0798]
andps xmm1, xmm2
andps xmm0, xmm2
comisd xmm1, xmm0
jbe 0x1005b279
movaps xmm0, xmm4
mov dword [esi], 1
divsd xmm0, xmm3
sub esp, 0x18
andps xmm0, xmm2
movsd qword [esp + 0x10], xmm0
movsd qword [esp + 8], xmm5
movsd qword [esp], xmm4
push 0x1007cba4
push str.eraPmat00
push str._s_failed:__s_want__.20g_got__.20g__1__.3g__n
call fcn.100010e0
add esp, 0x24
jmp 0x1005b2a7
cmp dword [0x100ceab0], 0
je 0x1005b2a7
sub esp, 0x10
movsd qword [esp + 8], xmm5
movsd qword [esp], xmm4
push 0x1007cba4
push str.eraPmat00
push str._s_passed:__s_want__.20g_got__.20g_n
call fcn.100010e0
add esp, 0x1c
movsd xmm5, qword [esp + 0x90]
xor edx, edx
movsd xmm4, qword [0x100c28f8]
movaps xmm3, xmm5
mov ecx, dword [esp + 0x14]
subsd xmm3, xmm4
movzx eax, byte [esp + 0x12]
test ecx, ecx
xorps xmm0, xmm0
cmove eax, edx
mov dword [esp + 0x1c], eax
ucomisd xmm3, xmm0
lahf
test ah, 0x44
jnp 0x1005b33c
movsd xmm1, qword [0x100c4130]
movaps xmm0, xmm3
movsd xmm2, qword [0x100c0798]
andps xmm0, xmm1
andps xmm2, xmm1
comisd xmm0, xmm2
jbe 0x1005b33c
movaps xmm0, xmm4
mov dword [esi], 1
divsd xmm0, xmm3
sub esp, 0x18
andps xmm0, xmm1
movsd qword [esp + 0x10], xmm0
movsd qword [esp + 8], xmm5
movsd qword [esp], xmm4
push 0x1007cba8
push str.eraPmat00
push str._s_failed:__s_want__.20g_got__.20g__1__.3g__n
call fcn.100010e0
add esp, 0x24
jmp 0x1005b369
cmp dword [0x100ceab0], edx
je 0x1005b36d
sub esp, 0x10
movsd qword [esp + 8], xmm5
movsd qword [esp], xmm4
push 0x1007cba8
push str.eraPmat00
push str._s_passed:__s_want__.20g_got__.20g_n
call fcn.100010e0
add esp, 0x1c
mov ecx, dword [esp + 0x14]
movzx eax, byte [esp + 0x13]
xor edx, edx
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
cmove eax, edx
mov dword [esp + 0x24], eax
cmp byte [esp + 0x1c], dl
je 0x1005b396
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push dword [esp + 0x14]
call esi
push 0x32
lea eax, [esp + 0xdc]
push eax
lea eax, [esp + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
cmp byte [esp + 0x24], 0
je 0x1005b3e4
push 0xf01ff
lea eax, [esp + 0xd0]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x1005b3de
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push edi
call esi
push dword [esp + 0x18]
call esi
movsd xmm4, qword [esp + 0x98]
xorps xmm0, xmm0
movsd xmm3, qword [0x100c1b30]
movaps xmm2, xmm4
subsd xmm2, xmm3
ucomisd xmm2, xmm0
lahf
test ah, 0x44
jnp 0x1005b47b
movsd xmm1, qword [0x100c4130]
movaps xmm0, xmm2
movsd xmm5, qword [0x100c07d0]
andps xmm0, xmm1
andps xmm5, xmm1
comisd xmm0, xmm5
jbe 0x1005b47b
movaps xmm0, xmm3
mov eax, dword [esp + 0x2c]
divsd xmm0, xmm2
sub esp, 0x18
mov dword [eax], 1
andps xmm0, xmm1
movsd qword [esp + 0x10], xmm0
movsd qword [esp + 8], xmm4
movsd qword [esp], xmm3
push 0x1007cbac
push str.eraPmat00
push str._s_failed:__s_want__.20g_got__.20g__1__.3g__n
call fcn.100010e0
add esp, 0x24
pop edi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10062dbb
mov esp, ebp
pop ebp
ret
cmp dword [0x100ceab0], 0
je 0x1005b4a9
sub esp, 0x10
movsd qword [esp + 8], xmm4
movsd qword [esp], xmm3
push 0x1007cbac
push str.eraPmat00
push str._s_passed:__s_want__.20g_got__.20g_n
call fcn.100010e0
add esp, 0x1c
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
xor ecx, esp
call fcn.10062dbb
mov esp, ebp
pop ebp
ret