Function at 0x43dc00
Capabilities:
Continue service
Get common file path
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x521e28]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x45c], ecx
mov byte [ebp - 0x211], 0
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004ad2c0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call fcn.00451e60
mov ecx, eax
call fcn.004521e0
test eax, eax
je 0x43e08c
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
push SysReAllocString
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x43e070
mov dword [ebp - 0x220], 0
push 0xf01ff
push str.NSPService
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x43e03b
mov dword [ebp - 0x244], 0
xor eax, eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x228], 0
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov eax, dword [ebp - 0x240]
push eax
push 0x4f9b34
call fcn.00405640
add esp, 8
cmp dword [ebp - 0x240], 7
jne 0x43de75
lea ecx, [ebp - 0x244]
push ecx
push 3
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x43de54
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov edx, dword [ebp - 0x240]
push edx
push 0x4f9b64
call fcn.00405640
add esp, 8
cmp dword [ebp - 0x240], 4
je 0x43de1e
mov eax, dword [ebp - 0x22c]
xor edx, edx
mov ecx, 0xa
div ecx
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0x3e8
jae 0x43ddc2
mov dword [ebp - 0x224], 0x3e8
jmp 0x43ddd8
cmp dword [ebp - 0x224], 0x1388
jbe 0x43ddd8
mov dword [ebp - 0x224], 0x1388
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov edx, dword [ebp - 0x228]
add edx, dword [ebp - 0x224]
mov dword [ebp - 0x228], edx
cmp dword [ebp - 0x228], 0x7530
jbe 0x43de19
jmp 0x43de1e
jmp 0x43dd88
cmp dword [ebp - 0x228], 0x7530
jbe 0x43de48
mov eax, dword [ebp - 0x240]
push eax
push str._SVCJOB_StartMainService__SERVICE_PAUSED__Waiting__d__failed_
push 1
call fcn.00442530
push eax
call fcn.00442bb0
add esp, 0x10
jmp 0x43de52
mov dword [ebp - 0x21c], 1
jmp 0x43de70
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SVCJOB_StartMainService__SERVICE_PAUSED__ControlService_failed__d__
push 1
call fcn.00442530
push eax
call fcn.00442bb0
add esp, 0x10
jmp 0x43e022
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x24c], 0x1e
mov dword [ebp - 0x248], 0
jmp 0x43dea4
mov ecx, dword [ebp - 0x248]
add ecx, 1
mov dword [ebp - 0x248], ecx
cmp dword [ebp - 0x248], 0x1e
jge 0x43e022
cmp dword [ebp - 0x240], 1
jne 0x43dfd5
push 0
push 0
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x43dfb7
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x240], 4
je 0x43df81
mov eax, dword [ebp - 0x22c]
xor edx, edx
mov ecx, 0xa
div ecx
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0x3e8
jae 0x43df25
mov dword [ebp - 0x224], 0x3e8
jmp 0x43df3b
cmp dword [ebp - 0x224], 0x1388
jbe 0x43df3b
mov dword [ebp - 0x224], 0x1388
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov edx, dword [ebp - 0x228]
add edx, dword [ebp - 0x224]
mov dword [ebp - 0x228], edx
cmp dword [ebp - 0x228], 0x7530
jbe 0x43df7c
jmp 0x43df81
jmp 0x43deeb
cmp dword [ebp - 0x228], 0x7530
jbe 0x43dfab
mov eax, dword [ebp - 0x240]
push eax
push str._SVCJOB_StartMainService__NOT_SERVICE_PAUSED__Waiting__d__failed_
push 1
call fcn.00442530
push eax
call fcn.00442bb0
add esp, 0x10
jmp 0x43dfb5
mov dword [ebp - 0x21c], 1
jmp 0x43dfd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SVCJOB_StartMainService__StartService_failed__d__
push 1
call fcn.00442530
push eax
call fcn.00442bb0
add esp, 0x10
jmp 0x43e01d
cmp dword [ebp - 0x240], 4
jne 0x43dfea
mov dword [ebp - 0x248], 0x1e
jmp 0x43e01d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov eax, dword [ebp - 0x240]
push eax
push str.QueryServiceStatus___d
call fcn.00405640
add esp, 8
jmp 0x43de95
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x220], 0
jmp 0x43e057
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SVCJOB_StartMainService__OpenService_failed__d_
push 1
call fcn.00442530
push eax
call fcn.00442bb0
add esp, 0x10
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x218], 0
jmp 0x43e08c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SVCJOB_StartMainService__OpenSCManager_failed__d_
push 1
call fcn.00442530
push eax
call fcn.00442bb0
add esp, 0x10
mov eax, dword [ebp - 0x45c]
movzx ecx, byte [eax]
test ecx, ecx
je 0x43e143
mov word [ebp - 0x458], 0
push 0x206
push 0
lea edx, [ebp - 0x456]
push edx
call fcn.004ad2c0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.npacmon.exe
lea ecx, [ebp - 0x458]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x458]
push edx
call fcn.00439a80
mov ecx, eax
call fcn.00439d20
movzx eax, al
test eax, eax
je 0x43e11b
push 1
push 0x4f9b94
push str.Failed_to_start_NPAC_service.
push 0x4f9f58
push 1
call fcn.00442530
mov ecx, eax
call fcn.00442990
jmp 0x43e13a
push 1
push 0x4f9c1c
push str.Successfully_started_NPAC_service.
push 0x4f9fb8
push 3
call fcn.00442530
mov ecx, eax
call fcn.00442990
mov ecx, dword [ebp - 0x45c]
mov byte [ecx], 0
mov al, byte [ebp - 0x211]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad2aa
mov esp, ebp
pop ebp
ret