Function at 0x10015040
Capabilities:
Modify service

Disassembly:
mov eax, 0x10056057
call fcn.1005557c
sub esp, 0x58
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x100151e7
mov dword [ebp - 0x28], 1
xor ebx, ebx
mov dword [ebp - 0x2c], 0x905d09ea
mov dword [ebp - 0x1c], ebx
jmp 0x10015081
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x34], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10015073
mov dword [ebp - 0x28], 0x47fd
cmp dword [ebp - 0x28], 0x48eb
jle 0x10015104
mov dword [ebp - 0x24], ebx
mov eax, ebx
mov dword [ebp - 0x20], 0x69bc
mov dword [ebp - 0x1c], eax
mov edi, ebx
mov esi, ebx
lea ecx, [esi + edi]
shl eax, cl
lea ecx, [ebp - 0x4c]
cdq
push edx
push eax
call fcn.100042e3
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100150c4
mov eax, dword [eax]
push eax
call fcn.10039f30
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x4c]
call fcn.10002764
mov eax, dword [ebp - 0x1c]
inc esi
cmp esi, 0x68e6
jl 0x100150aa
inc edi
cmp edi, 0x3a99
jl 0x100150a8
mov esi, dword [ebp - 0x24]
add eax, esi
dec dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
jne 0x100150a6
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x5428
jl 0x1001509a
lea eax, [ebp - 0x2c]
push eax
push 1
call fcn.100142fb
cmp dword [ebp - 0x28], 0x45fe
pop ecx
pop ecx
jge 0x10015125
push str.gfyucenc_rvbjvozm_ywmac_azssozkc_rcr_sstbpqvqc_lotfygl_aspuhf_dojrzgt
call fcn.10039f30
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x24], 0xc4a
cmp dword [ebp - 0x24], 0xd30
jle 0x10015192
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1206
push 0x1e3f
push 0x27b
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esi, ebx
mov edi, esi
mov dword [ebp - 0x28], 0x1ffe
mov dword [ebp - 0x20], ebx
mov ecx, ebx
mov eax, edi
shl eax, cl
mov ecx, 0x1006f688
cdq
push edx
push eax
call fcn.10002383
inc ebx
cmp ebx, 0x129a
jl 0x10015164
dec edi
dec dword [ebp - 0x28]
push 0
pop ebx
jne 0x10015161
inc esi
cmp esi, 0x3f71
jl 0x10015158
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0xc2c
jge 0x100151cf
mov edx, str.sjrzyg_vgmydtosv_ijyt_aaxnqk_gdfhlf_cqrmcm
mov ecx, 0x1006f688
call fcn.10003d52
jmp 0x100151cf
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], bl
push 1
push eax
xor dl, dl
mov cl, 1
call fcn.100152cd
pop ecx
jmp 0x1001526b
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x100151fe
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x24], 0x6f9d
cmp dword [ebp - 0x24], 0x71ba
jle 0x10015258
xor ebx, ebx
mov esi, ebx
mov dword [ebp - 0x28], ebx
mov edi, esi
mov esi, 0x4ef
mov eax, edi
lea ecx, [ebp - 0x64]
cdq
push edx
push eax
call fcn.100042e3
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10015233
mov eax, dword [eax]
push eax
call fcn.10039f30
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.10002764
dec edi
dec esi
jne 0x1001521c
mov esi, dword [ebp - 0x28]
inc esi
mov dword [ebp - 0x28], esi
cmp esi, 0x6d30
jl 0x10015215
cmp dword [ebp - 0x24], 0x6c7f
jge 0x1001526c
push str.qqdvm_zgz_oxvgkrvs_ruvynn_ptzdtjsx_iiyhtyttx_hvwsdc_siduigbzw
call fcn.10039f30
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret