Function at 0x40128a
Capabilities:
Contain obfuscated stackstrings
Listen for remote procedure calls

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
test byte [0x40406c], 8
mov dword [ebp - 0x48], 0x7069705c
mov dword [ebp - 0x44], 0x69775c65
mov dword [ebp - 0x40], 0x705f656e
mov dword [ebp - 0x3c], 0x7067756c
mov dword [ebp - 0x38], 0x79616c
mov dword [ebp - 0x51], 0x6361636e
mov dword [ebp - 0x4d], 0x706e5f6e
mov byte [ebp - 0x49], 0
jne 0x401315
lea eax, [ebp - 0x48]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x51]
mov dword [esp], eax
call dword [sym.imp.rpcrt4.dll_RpcServerUseProtseqEpA]
sub esp, 0x10
test eax, eax
je 0x401340
test byte [0x40406c], 2
jne 0x4013a0
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0xc], str.starting_service_n
mov dword [esp + 8], str.ServiceMain
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.1
jmp 0x4012d1
mov eax, dword [0x404094]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.rpcrt4.dll_RpcServerRegisterIf]
sub esp, 0xc
test eax, eax
je 0x4013d5
test byte [0x40406c], 2
je 0x401308
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RpcServerRegisterIf___failed__error__lu_n
mov dword [esp + 8], str.ServiceMain
mov dword [esp + 4], global___dbch
mov dword [esp], 1
call sym._wine_dbg_log.constprop.1
jmp 0x401308
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RpcServerUseProtseqEp___failed__error__lu_n
mov dword [esp + 8], str.ServiceMain
mov dword [esp + 4], global___dbch
mov dword [esp], 1
call sym._wine_dbg_log.constprop.1
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 8], 1
mov dword [esp + 4], 0x4d2
mov dword [esp], 1
call dword [sym.imp.rpcrt4.dll_RpcServerListen]
sub esp, 0xc
test eax, eax
je 0x401433
test byte [0x40406c], 2
je 0x401308
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RpcServerListen___failed__error__lu_n
mov dword [esp + 8], str.ServiceMain
mov dword [esp + 4], global___dbch
mov dword [esp], 1
call sym._wine_dbg_log.constprop.1
jmp 0x401308
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateEventW]
sub esp, 0x10
mov dword [section..bss], eax
mov dword [esp + 8], 0
mov dword [esp + 4], dbg.service_handler
mov dword [esp], str.PlugPlay
call dword [sym.imp.advapi32.dll_RegisterServiceCtrlHandlerExW]
sub esp, 0xc
test eax, eax
mov dword [0x406004], eax
je 0x401308
lea esi, [ebp - 0x34]
mov ebx, dword [sym.imp.advapi32.dll_SetServiceStatus]
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0x2710
mov dword [esp + 4], esi
mov dword [esp], eax
call ebx
mov eax, dword [section..bss]
sub esp, 8
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
mov dword [esp], 0
call dword [sym.imp.rpcrt4.dll_RpcMgmtStopServerListening]
mov eax, dword [0x404094]
sub esp, 4
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.rpcrt4.dll_RpcServerUnregisterIf]
sub esp, 0xc
call dword [sym.imp.rpcrt4.dll_RpcMgmtWaitServerListen]
mov eax, dword [0x406004]
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call ebx
sub esp, 8
test byte [0x40406c], 8
je 0x401308
mov dword [esp + 0xc], str.service_stopped_n
mov dword [esp + 8], str.ServiceMain
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.1
jmp 0x401308