Function at 0x10002b10
Capabilities:
Check if file exists
Create service
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10013df8
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x1001b5dc]
xor eax, esp
mov dword [esp + 0x6c], eax
push esi
push edi
mov eax, dword [0x1001b5dc]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
cmp byte [esi], 0
jne 0x10002b6a
xor ecx, ecx
jmp 0x10002b79
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002b70
sub ecx, edx
push ecx
push esi
lea ecx, [esp + 0x48]
call fcn.10001cd0
mov dword [esp + 0x88], 0
cmp byte [esi], 0
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
jne 0x10002bad
xor ecx, ecx
jmp 0x10002bbb
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002bb2
sub ecx, edx
push ecx
push esi
lea ecx, [esp + 0x30]
call fcn.10001cd0
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
push esi
mov byte [esp + 0x8c], 2
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x10002bf6
lea esi, [eax + 0x57]
jmp 0x10002d74
push 0
lea eax, [esp + 0x5c]
mov byte [esp + 0x5c], 0
push eax
push 0
xorps xmm0, xmm0
mov dword [esp + 0x7d], 0
push 0
push esi
movdqu xmmword [esp + 0x6d], xmm0
mov word [esp + 0x89], 0
movq qword [esp + 0x7d], xmm0
mov byte [esp + 0x8b], 0
call fcn.100051f2
add esp, 0x14
cmp byte [esp + 0x58], 0
jne 0x10002c43
xor ecx, ecx
jmp 0x10002c59
lea ecx, [esp + 0x58]
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002c50
sub ecx, edx
push ecx
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x18]
call fcn.10001cd0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x10002c8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 1
jmp 0x10002d74
cmp dword [esp + 0x3c], 0x10
lea esi, [esp + 0x28]
push 0
cmovae esi, dword [esp + 0x2c]
lea edi, [esp + 0x14]
cmp dword [esp + 0x28], 0x10
lea edx, [esp + 0x14]
push 0
cmovae edi, dword [esp + 0x18]
cmovae edx, dword [esp + 0x18]
push 0
push 0
push 0
push esi
mov esi, dword [esp + 0x24]
push 0
push 3
push 1
push 0xf01ff
push edi
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov edi, eax
test edi, edi
jne 0x10002d2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x10002cfb
cmp eax, 0x431
je 0x10002cfb
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
jmp 0x10002d6e
cmp dword [esp + 0x24], 0x10
lea eax, [esp + 0x10]
push 0xf01ff
cmovae eax, dword [esp + 0x14]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x10002d2d
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
jmp 0x10002d6e
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x10002d63
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov esi, eax
cmp esi, 0x3e5
je 0x10002d5c
cmp esi, 0x420
jne 0x10002d65
mov esi, 0x9527
jmp 0x10002d65
mov esi, 0x3e5
jmp 0x10002d65
xor esi, esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push dword [esp + 0xc]
call edi
cmp dword [esp + 0x24], 0x10
jb 0x10002d87
push dword [esp + 0x10]
call fcn.1000403d
add esp, 4
cmp dword [esp + 0x3c], 0x10
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
jb 0x10002daf
push dword [esp + 0x28]
call fcn.1000403d
add esp, 4
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], 0
mov byte [esp + 0x28], 0
jb 0x10002dd7
push dword [esp + 0x40]
call fcn.1000403d
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.100034c9
mov esp, ebp
pop ebp
ret