Function at 0x1003647d
Capabilities:
Modify service
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10071ac7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xfc
push esi
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100366fe
lea eax, [ebp + 0xc]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x60], 0x1391
cmp dword [ebp - 0x60], 0xb62
jge 0x10036681
lea eax, [ebp - 0x44]
push eax
mov ecx, 0x10663d30
call fcn.10019717
lea ecx, [ebp - 0x84]
call fcn.1001951f
and dword [ebp - 4], 0
lea edx, [ebp - 0x84]
mov ecx, 0x10663d30
call fcn.1001e8bf
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x9c]
call fcn.100194f9
mov byte [ebp - 4], 1
and dword [ebp - 0x10], 0
jmp 0x10036518
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x84]
call fcn.10019635
dec eax
cmp dword [ebp - 0x10], eax
jae 0x100365fa
push dword [ebp - 0x10]
lea ecx, [ebp - 0x84]
call fcn.10019621
movsx esi, byte [eax]
mov eax, dword [ebp - 0x10]
inc eax
push eax
lea ecx, [ebp - 0x84]
call fcn.10019621
movsx eax, byte [eax]
cmp esi, eax
jle 0x100365f5
push dword [0x10007b2c]
mov eax, dword [ebp - 0x10]
inc eax
push eax
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0x84]
call fcn.100196b2
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 2
push dword [ebp - 0x10]
push 0
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x84]
call fcn.100196b2
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 3
push dword [ebp - 0x50]
mov edx, dword [ebp - 0x3c]
lea ecx, [ebp - 0xc0]
call fcn.10027630
pop ecx
mov dword [ebp - 0x58], eax
push dword [ebp - 0x58]
lea ecx, [ebp - 0x9c]
call fcn.10019582
lea ecx, [ebp - 0xc0]
call fcn.100195a7
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xf0]
call fcn.100195a7
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd8]
call fcn.100195a7
jmp 0x100365fa
jmp 0x10036511
lea edx, [ebp - 0x84]
lea ecx, [ebp - 0x9c]
call fcn.1004acc0
movzx eax, al
test eax, eax
je 0x10036647
mov eax, dword [ebp - 0x44]
dec eax
push eax
push 0
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x9c]
call fcn.100196b2
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x9c]
call fcn.10019582
lea ecx, [ebp - 0x108]
call fcn.100195a7
push fcn.1001ea64
lea edx, [ebp - 0x9c]
mov ecx, 0x10663c78
call fcn.1001e8c7
mov ecx, eax
call fcn.10019c5d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x9c]
call fcn.100195a7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.100195a7
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x100366ae
mov byte [ebp - 0x13], 0
movzx eax, byte [ebp - 0x13]
test eax, eax
je 0x100366ac
push 0x37a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
jmp 0x100366f9
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
jmp 0x100366dc
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 3
jge 0x100366f9
mov eax, dword [ebp - 0x18]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.1001a1d1
mov dword [eax], 1
jmp 0x100366d1
jmp 0x10036857
lea eax, [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x10036722
push 0x573
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x10036857
push 4
lea ecx, [ebp - 0xa8]
call fcn.1001a0d2
mov dword [ebp - 4], 4
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x20], 0
jmp 0x1003674d
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10036769
push dword [ebp - 0x20]
lea ecx, [ebp - 0xa8]
call fcn.1001a1d1
mov dword [eax], 0xbbca
jmp 0x10036746
mov dword [ebp - 0x1c], 3
jmp 0x10036779
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x10036830
mov dword [ebp - 0x24], 0
jmp 0x10036793
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x100367a6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x6c], 0x65ab3e90
jmp 0x1003678c
mov byte [ebp - 0x12], 0
movzx eax, byte [ebp - 0x12]
test eax, eax
je 0x100367ca
push 0
push 0x13af
push 0
push 0x4aa
push 0
push 0x49
call dword [sym.imp.USER32.dll_DrawTextExW]
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x6c], 0
jmp 0x100367ec
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x6c]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x6c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x6c], 3
jg 0x1003682b
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10036829
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x2640
push 0x1862
push 0x83b
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x100367d9
jmp 0x10036772
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa8]
call fcn.1001a156
push 0
push 0x13af
push 0
push 0x4aa
push 0
push 0x49
call dword [sym.imp.USER32.dll_DrawTextExW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret