Function at 0x5b86951a
Capabilities:
Start service

Disassembly:
push 0x28
mov eax, 0x5b88d0ed
call fcn.5b887920
mov edi, edx
mov eax, ecx
mov dword [ebp - 0x1c], eax
and dword [ebp - 0x20], 0
and dword [ebp - 0x14], 0
and dword [ebp - 0x18], 0
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x5b869613
cmp ebx, 0x10
ja 0x5b869613
test bl, 4
je 0x5b869613
mov edx, 0x3801
call fcn.5b871db4
test eax, eax
jns 0x5b86959c
mov esi, 0x80070032
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b8697f3
test byte [eax + 0x1c], 1
je 0x5b8697f3
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x22
mov edx, 0x5b81727c
pop ecx
call fcn.5b81ae33
jmp 0x5b8697f3
lea eax, [ebp - 0x14]
xor edx, edx
push eax
inc edx
call fcn.5b869e9d
mov esi, eax
test esi, esi
jns 0x5b8695d6
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b8697f3
test byte [eax + 0x1c], 1
je 0x5b8697f3
push esi
lfence
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x23
jmp 0x5b86958c
cmp dword [ebp - 0x14], 0
jne 0x5b869609
mov esi, 0x80070005
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b8697f3
test byte [eax + 0x1c], 1
je 0x5b8697f3
push esi
lfence
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x24
jmp 0x5b86958c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], 1
push 0x10
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x5b869653
call fcn.5b86f6c1
mov esi, eax
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b8697f3
test byte [eax + 0x1c], 1
je 0x5b8697f3
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x25
jmp 0x5b86958c
and dword [ebp - 4], 0
xor esi, esi
and dword [ebp - 0x24], esi
xor edi, edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 1
test ebx, ebx
jne 0x5b86970d
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b869695
test byte [eax + 0x1c], 4
je 0x5b869695
push dword [eax + 0x14]
mov edx, 0x5b81727c
push dword [eax + 0x10]
push 0x26
pop ecx
call fcn.5b81ae17
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x5b817234
push eax
push 0
lea ecx, [ebp - 0x2c]
call fcn.5b860846
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x2c]
push edi
sub esi, edi
sar esi, 2
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebx, eax
test edi, edi
je 0x5b8696d5
mov edx, dword [ebp - 0x24]
mov ecx, edi
sub edx, edi
and edx, 0xfffffffc
call fcn.5b82c63d
xor esi, esi
mov edi, dword [ebp - 0x14]
test esi, esi
jns 0x5b8697bb
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b8697ec
test byte [eax + 0x1c], 1
je 0x5b8697ec
push esi
lfence
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x29
jmp 0x5b8697e1
cmp dword [ebp - 0x18], 0
je 0x5b869753
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b869738
test byte [eax + 0x1c], 4
je 0x5b869738
push dword [eax + 0x14]
mov edx, 0x5b81727c
push dword [eax + 0x10]
push 0x27
pop ecx
call fcn.5b81ae17
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x5b817244
push eax
push 0
lea ecx, [ebp - 0x2c]
call fcn.5b860846
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x2c]
cmp ebx, 0x10
jne 0x5b8696b0
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b869781
test byte [eax + 0x1c], 4
je 0x5b869781
push dword [eax + 0x14]
mov edx, 0x5b81727c
push dword [eax + 0x10]
push 0x28
pop ecx
call fcn.5b81ae17
mov eax, 0x5b817264
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], esi
je 0x5b869798
mov dword [esi], eax
add esi, 4
jmp 0x5b8696b0
lea eax, [ebp - 0x1c]
push eax
push esi
jmp 0x5b8696a2
test ebx, ebx
jne 0x5b8697ec
call fcn.5b86f6c1
mov esi, eax
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b8697ec
test byte [eax + 0x1c], 1
je 0x5b8697ec
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2a
mov edx, 0x5b81727c
pop ecx
call fcn.5b81ae33
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
call fcn.5b887840
ret 4