Function at 0x100deb3
Capabilities:
Terminate process

Disassembly:
test byte [ebp - 0x3c], 1
jne 0x101cc72
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call fcn.0100eb97
mov dword [0x104a084], eax
cmp dword [0x104a078], 0
jne 0x101ccc3
push eax
call dword [sym.imp.msvcrt.dll_exit]
nop
nop
nop
nop
nop
mov edi, edi
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x104a3ac], ebx
je 0x100bc8a
mov al, byte [0x104a3b0]
cmp al, 4
jb 0x100bd25
mov eax, dword [0x104a398]
mov ecx, dword [0x104a39c]
mov edx, 0x200
mov esi, 0x80000000
and eax, edx
and ecx, esi
or eax, ecx
jne 0x101d77a
push ebx
push 0x10089e9
push 0x100c2a4
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerExW]
mov ecx, dword [0x104b7e4]
mov dword [ecx + 0x70], eax
mov eax, dword [0x104b7e4]
cmp dword [eax + 0x70], ebx
je 0x101d7b8
mov ecx, dword [0x104b7e4]
push 2
call fcn.01009e64
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov edi, eax
cmp edi, ebx
jl 0x100bd1f
mov eax, dword [0x104b7e4]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebx
push ebx
push 0x100000
add eax, 0xb4
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x101d7c2
cmp edi, ebx
jl 0x100bd44
mov ecx, dword [0x104b7e4]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x34]
cmp eax, ebx
jl 0x100bd3c
mov ecx, dword [0x104b7e4]
call fcn.01009a38
pop edi
pop esi
pop ebx
ret 8
cmp al, bl
je 0x100bc69
jmp 0x100bc8a
cmp eax, ebx
jge 0x100bcb2
jmp 0x100bd1f
push eax
call fcn.0100bfcd
jmp 0x100bd1f
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x100bd1f
call fcn.0100c8c7
push 0x58
push 0x100e070
call fcn.01002a98
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x104a128
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x101cc23
xor esi, esi
inc esi
mov eax, dword [0x104a0a4]
cmp eax, esi
je 0x101cc41
mov eax, dword [0x104a0a4]
test eax, eax
jne 0x100e0a7
mov dword [0x104a0a4], esi
push 0x100e06c
push 0x100e060
call fcn.0100de8a
pop ecx
pop ecx
test eax, eax
jne 0x101cce7
mov eax, dword [0x104a0a4]
cmp eax, esi
jne 0x100df64
push 0x100e05c
push 0x100dfb0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x104a0a4], 2
test ebx, ebx
jne 0x100df70
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x104baa8], 0
jne 0x101cc4e
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
jbe 0x100e098
cmp al, 0x22
je 0x101cc7b
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
jne 0x101cc8b
inc esi
jmp 0x100df84
test al, al
je 0x100e0b2
cmp dword [ebp - 0x1c], 0
je 0x100e0b2
jmp 0x100df91
mov dword [0x104bbb8], esi
jmp 0x100df40
mov al, byte [esi]
test al, al
je 0x100bc14
cmp al, 0x20
ja 0x100bc14
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100e0b2
cmp eax, esi
jne 0x101cc31
xor esi, esi
inc esi
mov ebx, esi
jmp 0x100df07
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100def2
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100df40
push 0x104baa8
call fcn.01030b51
pop ecx
test eax, eax
je 0x100df7d
push 0
push 2
push 0
call dword [0x104baa8]
jmp 0x100df7d
movzx eax, word [ebp - 0x38]
jmp 0x100bc21
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
jmp 0x100df99
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100dfac
cmp dword [0x104bbb8], 0
jne 0x101ccd2
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x104a084]
jmp 0x101ccf3
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01002add
ret
mov eax, dword [0x104a3a0]
mov edi, dword [0x104a3a4]
mov ecx, eax
and ecx, edx
mov edx, edi
and edx, esi
cmp ecx, eax
jne 0x100bc8a
cmp edx, edi
jne 0x100bc8a
push 0x101d7d0
push dword [0x104a134]
push dword [0x104a130]
call fcn.0100a01e
jmp 0x100bc8a
call fcn.0100f56e
jmp 0x100bd32
call fcn.0100f56e
mov edi, eax
jmp 0x100bd00