Function at 0x719c7ca5
Capabilities:
Read file via mapping

Disassembly:
push 0x1f0
push 0x719c8268
call fcn.719c1450
mov eax, dword [0x719f7264]
mov dword [ebp - 0x1c], eax
push 0x719e57cb
push 0x719c8950
call dword [sym.imp._CADVAPI.DLL_RegisterServiceCtrlHandlerA]
mov dword [0x719f73cc], eax
xor esi, esi
xor ebx, ebx
inc ebx
cmp eax, esi
je 0x719c8235
push 7
pop ecx
xor eax, eax
mov edx, 0x719f73d0
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [0x719f73d0], 0x20
mov dword [0x719f73d8], ebx
mov dword [0x719f73d4], 2
mov dword [0x719f73e8], 0xea60
push edx
push dword [0x719f73cc]
mov edi, dword [sym.imp._CADVAPI.DLL_SetServiceStatus]
call edi
cmp dword [0x719f7668], esi
jne 0x719d2fd4
mov dword [0x719f73f0], esi
push esi
push esi
push esi
call dword [sym.imp._CKERNEL.DLL_HeapCreate]
mov dword [0x719f73f8], eax
cmp eax, esi
je 0x719d3005
mov eax, dword [0x719f73f4]
push dword [eax + 0x28]
call dword [sym.imp._CADVAPI.DLL_GetLengthSid]
mov edi, eax
add edi, 0x10
push edi
push esi
push dword [0x719f73f8]
call dword [sym.imp._CKERNEL.DLL_HeapAlloc]
mov dword [ebp - 0x1b0], eax
cmp eax, esi
je 0x719c8235
push 2
push edi
push eax
call dword [sym.imp._CADVAPI.DLL_InitializeAcl]
test eax, eax
je 0x719d3015
mov eax, dword [0x719f73f4]
push dword [eax + 4]
push 0x1f0001
push 2
mov edi, dword [ebp - 0x1b0]
push edi
call dword [sym.imp._CADVAPI.DLL_AddAccessAllowedAce]
test eax, eax
je 0x719c8224
push 0x719caf10
lea eax, [ebp - 0x1d8]
push eax
call dword [sym.imp._Cntl.DLL_RtlInitUnicodeString]
push ebx
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp._CADVAPI.DLL_InitializeSecurityDescriptor]
test eax, eax
je 0x719c8224
push ebx
push edi
push ebx
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp._CADVAPI.DLL_SetSecurityDescriptorDacl]
test eax, eax
je 0x719c8224
mov dword [ebp - 0x1c8], 0x18
mov dword [ebp - 0x1c4], esi
mov dword [ebp - 0x1bc], esi
lea eax, [ebp - 0x1d8]
mov dword [ebp - 0x1c0], eax
lea eax, [ebp - 0x200]
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1b4], esi
push esi
push 0x48
push 0x30
lea eax, [ebp - 0x1c8]
push eax
push 0x719f7400
call dword [sym.imp._Cntl.DLL_NtCreateWaitablePort]
push edi
push esi
push dword [0x719f73f8]
test eax, eax
jne 0x719d3022
mov edi, dword [sym.imp._CKERNEL.DLL_HeapFree]
call edi
mov eax, dword [0x719f73f4]
push dword [eax + 0x28]
mov ebx, dword [sym.imp._CADVAPI.DLL_GetLengthSid]
call ebx
mov ecx, dword [0x719f73f4]
push dword [ecx + 0x18]
mov dword [ebp - 0x1dc], eax
call ebx
mov ecx, dword [ebp - 0x1dc]
add ecx, eax
mov eax, dword [0x719f73f4]
push dword [eax + 0x14]
mov dword [ebp - 0x1ec], ecx
call ebx
mov ecx, dword [ebp - 0x1ec]
add ecx, eax
mov eax, dword [0x719f73f4]
push dword [eax + 0x10]
mov dword [ebp - 0x1e8], ecx
call ebx
mov ecx, dword [ebp - 0x1e8]
lea ebx, [ecx + eax + 0x28]
push ebx
push esi
push dword [0x719f73f8]
call dword [sym.imp._CKERNEL.DLL_HeapAlloc]
mov dword [ebp - 0x1b0], eax
cmp eax, esi
je 0x719d303c
push 2
push ebx
push eax
call dword [sym.imp._CADVAPI.DLL_InitializeAcl]
test eax, eax
je 0x719d302d
mov eax, dword [0x719f73f4]
push dword [eax + 0x28]
push 0x1f0001
push 2
push dword [ebp - 0x1b0]
mov ebx, dword [sym.imp._CADVAPI.DLL_AddAccessAllowedAce]
call ebx
test eax, eax
je 0x719d302d
mov eax, dword [0x719f73f4]
push dword [eax + 0x10]
push 0x1f0001
push 2
push dword [ebp - 0x1b0]
call ebx
test eax, eax
je 0x719d302d
mov eax, dword [0x719f73f4]
push dword [eax + 0x14]
push 0x1f0001
push 2
push dword [ebp - 0x1b0]
call ebx
test eax, eax
je 0x719d302d
mov eax, dword [0x719f73f4]
push dword [eax + 0x18]
push 0x1f0001
push 2
push dword [ebp - 0x1b0]
call ebx
test eax, eax
je 0x719d302d
push 0x719c8244
lea eax, [ebp - 0x1d8]
push eax
call dword [sym.imp._Cntl.DLL_RtlInitUnicodeString]
xor ebx, ebx
inc ebx
push ebx
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp._CADVAPI.DLL_InitializeSecurityDescriptor]
test eax, eax
je 0x719d3044
push ebx
push dword [ebp - 0x1b0]
push ebx
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp._CADVAPI.DLL_SetSecurityDescriptorDacl]
test eax, eax
je 0x719d3044
mov dword [ebp - 0x1c8], 0x18
mov dword [ebp - 0x1c4], esi
mov dword [ebp - 0x1bc], esi
lea eax, [ebp - 0x1d8]
mov dword [ebp - 0x1c0], eax
lea eax, [ebp - 0x200]
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1b4], esi
push esi
push 0x48
push 0x30
lea eax, [ebp - 0x1c8]
push eax
push 0x719f7408
call dword [sym.imp._Cntl.DLL_NtCreateWaitablePort]
push dword [ebp - 0x1b0]
push esi
push dword [0x719f73f8]
test eax, eax
jne 0x719d3051
call edi
push esi
push esi
push esi
push esi
mov edi, dword [sym.imp._CKERNEL.DLL_CreateEventA]
call edi
mov dword [0x719f7410], eax
cmp eax, esi
je 0x719c822a
push esi
push esi
push esi
push esi
call edi
mov dword [0x719f7418], eax
cmp eax, esi
je 0x719c822a
push esi
push 0x719f7468
push esi
push 0xf003f
push esi
push 0x719caf08
push esi
push 0x719caec0
push reloc.WS2__32_Coverage_C_WINDOWS_system32.DLL_Ordinal_2
call dword [sym.imp._CADVAPI.DLL_RegCreateKeyExA]
cmp eax, esi
jne 0x719c8235
mov eax, 0x719f74a0
mov dword [0x719f74a4], eax
mov dword [0x719f74a0], eax
mov eax, 0x719f74a8
mov dword [0x719f74ac], eax
mov dword [0x719f74a8], eax
mov eax, 0x719f74b0
mov dword [0x719f74b4], eax
mov dword [0x719f74b0], eax
mov dword [ebp - 4], esi
push 0x719f7420
mov edi, dword [sym.imp._CKERNEL.DLL_InitializeCriticalSection]
call edi
or dword [ebp - 4], 0xffffffff
mov dword [0x719f739c], ebx
lea eax, [ebp - 0x1ac]
push eax
push 2
call dword [sym.imp.WS2__32_Coverage_C_WINDOWS_system32.DLL_Ordinal_115]
cmp eax, esi
jne 0x719d3062
mov dword [0x719f73a8], ebx
push ebx
push dword [0x719f7410]
push 5
push ebx
push dword [0x719f7468]
call dword [sym.imp._CADVAPI.DLL_RegNotifyChangeKeyValue]
test eax, eax
jne 0x719d3076
mov dword [ebp - 4], ebx
push 0x719f7488
call edi
or dword [ebp - 4], 0xffffffff
mov dword [0x719f73a4], ebx
push esi
push 4
push esi
push 0x8000004
push esi
push 0xffffffffffffffff
call dword [sym.imp._CKERNEL.DLL_CreateFileMappingA]
mov dword [0x719f746c], eax
cmp eax, esi
je 0x719c822a
push 4
push esi
push esi
push 2
push eax
call dword [sym.imp._CKERNEL.DLL_MapViewOfFile]
mov edi, eax
mov dword [0x719f7470], edi
cmp edi, esi
je 0x719c822a
xor eax, eax
stosd dword es:[edi], eax
mov dword [0x719f745c], ebx
mov dword [0x719f7438], ebx
mov eax, dword [0x719f7470]
mov dword [eax], ebx
mov dword [ebp - 4], 2
push 0x719f73ac
mov edi, dword [sym.imp._CKERNEL.DLL_InitializeCriticalSection]
call edi
or dword [ebp - 4], 0xffffffff
mov dword [0x719f7398], ebx
mov dword [ebp - 4], 3
push 0x719f7444
call edi
or dword [ebp - 4], 0xffffffff
mov dword [0x719f73a0], ebx
push 4
pop edi
mov dword [0x719f73d4], edi
push 0x719f73d0
push dword [0x719f73cc]
call dword [sym.imp._CADVAPI.DLL_SetServiceStatus]
call fcn.719c829d
test al, al
je 0x719d3081
push edi
push 0xffffffffffffffff
push ebx
push 0x719c9bce
push dword [0x719f7400]
push 0x719f7404
mov edi, dword [sym.imp._Cntl.DLL_RtlRegisterWait]
call edi
test eax, eax
jne 0x719c8235
push 4
push 0xffffffffffffffff
push 2
push 0x719c9bce
push dword [0x719f7408]
push 0x719f740c
call edi
test eax, eax
jne 0x719c8235
push 4
push 0xffffffffffffffff
push 3
push 0x719c9bce
push dword [0x719f7410]
push 0x719f7414
call edi
test eax, eax
jne 0x719c8235
push 4
push 0xffffffffffffffff
push 4
push 0x719c9bce
push dword [0x719f7418]
push 0x719f741c
call edi
test eax, eax
jne 0x719c8235
mov ecx, dword [ebp - 0x1c]
call fcn.719c15f6
call fcn.719c1430
ret 8
push edi
jmp 0x719d301b
call dword [sym.imp._CKERNEL.DLL_GetLastError]
jmp 0x719d3058
push esi
push esi
push ebx
call fcn.719e667f
jmp 0x719d3139
call fcn.719e5712
cmp eax, esi
je 0x719c7d2b
mov dword [0x719f73d4], ebx
push eax
call dword [sym.imp._Cntl.DLL_RtlNtStatusToDosError]
mov dword [0x719f73dc], eax
push 0x719f73d0
push dword [0x719f73cc]
call edi
jmp 0x719c8214
call dword [sym.imp._CKERNEL.DLL_GetProcessHeap]
mov dword [0x719f73f8], eax
jmp 0x719c7d47
push dword [ebp - 0x1b0]
push esi
push dword [0x719f73f8]
call dword [sym.imp._CKERNEL.DLL_HeapFree]
jmp 0x719c8235
push dword [ebp - 0x1b0]
push esi
push dword [0x719f73f8]
call edi
xor ebx, ebx
inc ebx
jmp 0x719c8235
push dword [ebp - 0x1b0]
push esi
push dword [0x719f73f8]
call edi
jmp 0x719c8235
mov dword [0x719f73dc], eax
jmp 0x719c8235
mov dword [0x719f73dc], 0x42a
mov dword [0x719f73e0], eax
jmp 0x719c8235
mov dword [0x719f73c4], ebx
jmp 0x719c80dd
mov dword [0x719f73c8], ebx
jmp 0x719c81a0
call fcn.719e5712
mov dword [0x719f73d4], ebx
push 0x719f73d0
push dword [0x719f73cc]
call dword [sym.imp._CADVAPI.DLL_SetServiceStatus]
jmp 0x719c8214