Function at 0x10001160
Capabilities:
Continue service
Modify service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x10024010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x64], 0
push 0
movlpd qword [ebp - 0x70], xmm0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x78], eax
test eax, eax
jne 0x100011b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006816
mov esp, ebp
pop ebp
ret
push 0xf01ff
push str.WerSvc
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov esi, eax
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push esi
call edi
push dword [ebp - 0x24]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 0x74], ebx
test ebx, ebx
je 0x1000122c
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push ebx
push esi
call edi
test eax, eax
je 0x1000122c
cmp dword [ebx + 4], 2
je 0x1000122c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x1000122c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
xor edi, edi
jmp 0x1000132a
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0
push esi
call edi
push dword [ebp - 0x24]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 0x64], ebx
test ebx, ebx
je 0x100012fb
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push ebx
push 0
push esi
call edi
test eax, eax
je 0x100012fb
mov eax, dword [ebx + 4]
cmp eax, 4
je 0x10001324
cmp eax, 2
je 0x10001324
cmp eax, 5
je 0x10001324
cmp eax, 7
jne 0x100012b5
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
push eax
xorps xmm0, xmm0
push 3
push esi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x10001324
jmp 0x100012fb
cmp eax, 3
je 0x100012bf
cmp eax, 6
jne 0x100012fb
push 0x34
lea eax, [ebp - 0x58]
mov dword [ebp - 0x60], 2
push 0
push eax
mov dword [ebp - 0x5c], 0x10001150
call fcn.10008640
add esp, 0xc
lea eax, [ebp - 0x60]
push eax
push 0x41
push esi
call dword [sym.imp.ADVAPI32.dll_NotifyServiceStatusChangeW]
test eax, eax
jne 0x100012fb
push 1
push 0x1388
call dword [sym.imp.KERNEL32.dll_SleepEx]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x10001324
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
xor edi, edi
cmp ebx, 0x420
jne 0x1000132a
xorps xmm0, xmm0
movlpd qword [ebp - 0x70], xmm0
mov ebx, dword [ebp - 0x70]
mov edi, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x74]
mov ecx, dword [sym.imp.KERNEL32.dll_LocalFree]
test eax, eax
je 0x10001340
push eax
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x1000134a
push eax
call ecx
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x10001360
cmp esi, 0xffffffff
je 0x10001360
push esi
call eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x78]
cmp ecx, 0xffffffff
je 0x1000136b
push ecx
call eax
mov ecx, dword [ebp - 4]
mov edx, edi
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.10006816
mov esp, ebp
pop ebp
ret