Function at 0x100141dd
Capabilities:
Check for time delay via gettickcount
Check mutex on windows
Create service
Query service status
Start service

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x10037800]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 0x4c
mov eax, 0x1001c2da
call fcn.1001ace1
lea eax, [ebp - 0x2c]
push eax
mov edi, ecx
call sym.RTCore.dll_public:_class_CStringLite___thiscall_CRTCoreDriver::GetName_void_
xor ebx, ebx
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], ebx
call dword [sym.imp.RTFC.dll_public:_void___thiscall_CStringLite::constructor_void_]
push dword [ebp - 0x28]
lea eax, [ebp - 0x38]
push str.GlobalAccess__s_sys
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.RTFC.dll_public:_void___cdecl_CStringLite::Format_char_const__]
add esp, 0xc
push dword [ebp - 0x34]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x1001424e
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push str.._
push eax
call dword [sym.imp.RTFC.dll_class_CStringLite___cdecl_operator_char_const___class_CStringLite_const__]
mov eax, dword [eax + 4]
add esp, 0xc
push ebx
push 0x80
push 3
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, dword [sym.imp.RTFC.dll_public_virtual:_void___thiscall_CStringLite::destructor_void_]
lea ecx, [ebp - 0x1c]
mov dword [edi + 4], eax
call esi
cmp dword [edi + 4], 0xffffffff
je 0x100142ca
mov ecx, edi
call sym.RTCore.dll_public:_int___thiscall_CRTCoreDriver::ReferenceCountIncrease_void_
cmp dword [ebp - 0x10], ebx
je 0x100142b0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], bl
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call esi
mov eax, edi
jmp 0x100145ac
lea eax, [ebp - 0x24]
push eax
call fcn.100149a1
push ebx
push dword [ebp - 0x20]
mov byte [ebp - 4], 2
call dword [sym.imp.MSVCR90.dll__access]
add esp, 0xc
test eax, eax
je 0x1001430f
cmp dword [ebp - 0x10], ebx
je 0x100142ff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call esi
mov edi, 0x80040400
jmp 0x100142b2
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x1001434d
cmp dword [ebp - 0x10], ebx
je 0x1001433a
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call esi
mov edi, 0x80040401
jmp 0x100142b2
xor eax, eax
push 0x206
mov word [ebp + 0x208], ax
lea eax, [ebp + 0x20a]
push ebx
push eax
call sub.MSVCR90.dll_memset
xor eax, eax
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
call sub.MSVCR90.dll_memset
mov eax, dword [ebp - 0x28]
push eax
mov dword [ebp - 0x18], eax
call sub.MSVCR90.dll_strlen
push eax
push dword [ebp - 0x18]
lea eax, [ebp + 0x208]
push 0x104
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.MSVCR90.dll_mbstowcs_s]
mov eax, dword [ebp - 0x20]
push eax
mov dword [ebp - 0x18], eax
call sub.MSVCR90.dll_strlen
push eax
push dword [ebp - 0x18]
lea eax, [ebp]
push 0x104
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.MSVCR90.dll_mbstowcs_s]
add esp, 0x48
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp]
push eax
push 1
push 3
push 1
push 0xf01ff
lea eax, [ebp + 0x208]
push eax
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
cmp eax, ebx
je 0x100143f9
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0xf01ff
lea eax, [ebp + 0x208]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x30], eax
cmp eax, ebx
je 0x1001456d
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1001445d
cmp dword [ebp - 0x10], ebx
je 0x1001444a
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call esi
mov edi, 0x80040402
jmp 0x100142b2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x14], eax
jmp 0x100144ba
mov eax, dword [ebp - 0x40]
push 0xa
xor edx, edx
pop ecx
div ecx
mov ecx, 0x3e8
cmp eax, ecx
jb 0x1001448a
mov ecx, 0x2710
cmp eax, ecx
jbe 0x1001448c
mov eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x100144c0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x44], eax
ja 0x1001445d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x40]
ja 0x100144c0
cmp dword [ebp - 0x54], 2
je 0x1001446e
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push str.._
push eax
call dword [sym.imp.RTFC.dll_class_CStringLite___cdecl_operator_char_const___class_CStringLite_const__]
mov eax, dword [eax + 4]
add esp, 0xc
push ebx
push 0x80
push 3
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [ebp - 0x1c]
mov dword [edi + 4], eax
call esi
cmp dword [edi + 4], 0xffffffff
jne 0x10014531
cmp dword [ebp - 0x10], ebx
je 0x1001451e
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call esi
mov edi, 0x80040404
jmp 0x100142b2
mov ecx, edi
call sym.RTCore.dll_public:_int___thiscall_CRTCoreDriver::ReferenceCountIncrease_void_
cmp dword [ebp - 0x10], ebx
je 0x1001454f
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call esi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], bl
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call esi
xor eax, eax
jmp 0x100145ac
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x10], ebx
je 0x1001458d
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call esi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], bl
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call esi
mov eax, 0x80040403
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.1001acd2
add ebp, 0x414
leave
ret 4