Function at 0x1004bca2
Capabilities:
Modify service
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10071ff1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa0
mov dword [esp + 0x58], 1
push ebx
mov dword [esp + 0x80], 0xcae7bf19
mov ebx, edx
mov dword [esp + 0x1c], 0x242e
cmp dword [esp + 0x1c], 0xd33
push esi
push edi
mov dword [esp + 0x68], ecx
jge 0x1004bd8e
lea eax, [esp + 0x98]
push eax
push 0x10007848
call fcn.10058e8b
mov edi, dword [esp + 0xa4]
mov esi, dword [esp + 0xa0]
pop ecx
pop ecx
test edi, edi
jg 0x1004bd2f
jl 0x1004bd22
cmp esi, 2
ja 0x1004bd2f
push 0x10007850
call fcn.10059c06
pop ecx
jmp 0x1004bd8e
push 0
push 2
push edi
push esi
call fcn.10070580
or eax, edx
push edi
push esi
push edi
push esi
je 0x1004bd5e
call fcn.1005d460
push 0
push 2
push edx
push eax
call fcn.100704d0
mov esi, eax
mov ecx, edx
add esi, 1
adc ecx, 0
jmp 0x1004bd7d
call fcn.1005d460
xor edi, edi
push edi
push 4
push edx
push eax
call fcn.100704d0
mov esi, eax
mov ecx, edx
add esi, 1
adc ecx, edi
sub eax, 1
sbb edx, edi
push ecx
push esi
push edx
push eax
push 0x100080a8
call fcn.100597a7
add esp, 0x14
push 2
lea ecx, [esp + 0x90]
call fcn.1001a0d2
and dword [esp + 0xb4], 0
push 3
pop esi
push 0xffffffffffffffff
mov dword [esp + 0x20], esi
mov dword [esp + 0x20], 0xa
pop edi
jmp 0x1004bea4
mov dword [esp + 0x14], 0xaa9ac70c
mov dword [esp + 0x14], 0xe
jmp 0x1004be96
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], 0xd0890515
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x20], 0
jmp 0x1004be09
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0xa0], 4
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x1004bdf6
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], 0
jne 0x1004be7a
mov eax, dword [esp + 0x1c]
mov edx, 0x99ea5d85
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
inc eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
sub edx, eax
add edx, dword [esp + 0x18]
imul edx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0xfecafe8
setg al
mov dword [esp + 0xa0], eax
test eax, eax
je 0x1004be7d
xor eax, eax
inc eax
mov edx, dword [esp + 0x1c]
xor ecx, ecx
add edx, eax
mov eax, dword [esp + 0x1c]
cmp edx, eax
setle cl
mov dword [esp + 0x20], ecx
dec dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jne 0x1004bdd0
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe6
jge 0x1004bdbb
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x1004bec6
push 0x2405
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [esp + 0x78], 0xfe3d2f55
lea ecx, [esp + 0x44]
mov dword [esp + 0x60], edi
push 4
call fcn.1001a0d2
xor edx, edx
mov dword [esp + 0x20], 0xfffffff7
mov dword [esp + 0x18], edx
jmp 0x1004bf00
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x44]
mov dword [eax + ecx*4], 0xbbca
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1004beed
mov dword [esp + 0x20], esi
cmp dword [esp + 0x20], edx
jl 0x1004bf8f
mov dword [esp + 0x18], edx
jmp 0x1004bf27
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x6c], 0x65ab3e90
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1004bf17
mov byte [esp + 0x13], dl
cmp byte [esp + 0x13], 0
je 0x1004bf4f
push edx
push 0x13af
push edx
push 0x4aa
push edx
push 0x49
call dword [sym.imp.USER32.dll_DrawTextExW]
xor edx, edx
mov dword [esp + 0x74], edx
jmp 0x1004bf83
mov byte [esp + 0x13], dl
cmp byte [esp + 0x13], 0
je 0x1004bf7f
push edx
push edx
push edx
push edx
push edx
push edx
push edx
push 0x2640
push 0x1862
push 0x83b
push edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
xor edx, edx
inc dword [esp + 0x74]
cmp dword [esp + 0x74], esi
jle 0x1004bf55
dec dword [esp + 0x20]
jns 0x1004bf11
cmp dword [esp + 0x44], 0
je 0x1004bfb0
push dword [esp + 0x44]
call fcn.10059948
xor esi, esi
pop ecx
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
jmp 0x1004bfb2
xor esi, esi
mov dword [esp + 0x5c], 0xfffffff7
lea ecx, [esp + 0x50]
mov dword [esp + 0x14], 0x87013dce
push 1
call fcn.1001a0d2
mov dword [esp + 0x24], 0x39d6b9c2
mov dword [esp + 0x18], esi
jmp 0x1004bfee
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x50]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x1004bfdb
cmp dword [esp + 0x14], esi
je 0x1004bfff
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x50]
mov dword [eax], edx
mov eax, dword [esp + 0x14]
cmp edx, eax
setl cl
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], 0
jmp 0x1004c069
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x1004c065
push 0xe60
push 0x669
push 0x984
push 0x2620
push 0x41e
call dword [sym.imp.GDI32.dll_Ellipse]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0
jle 0x1004c03a
push dword [esp + 0x50]
call fcn.10059948
xor eax, eax
pop ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x14], 0xbdde0bcd
mov dword [esp + 0x24], 0xe8e1b881
push 0xfffffffffffffff6
pop esi
cmp dword [esp + 0x14], eax
je 0x1004c0f0
mov dword [esp + 0x1c], 0x318d5816
xor edx, edx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
add ecx, 0xe534
cmp ecx, eax
setne dl
sub edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setne cl
mov dword [esp + 0x1c], ecx
jmp 0x1004c11b
mov dword [esp + 0x14], esi
jmp 0x1004c114
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x1004c110
push 1
push 0x215f
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x2e
jl 0x1004c0f6
mov dword [esp + 0x18], 0
jmp 0x1004c13b
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x8c]
mov dword [eax + ecx*4], 0x64939e63
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1004c125
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 2
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], 0
cmp dword [esp + 0x20], 0xfffffff5
jle 0x1004c326
push 0xfffffffffffffff8
pop esi
push 1
lea ecx, [esp + 0x2c]
call fcn.1001a0d2
xor edx, edx
mov byte [esp + 0xb4], 1
mov dword [esp + 0x18], edx
jmp 0x1004c196
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x1004c183
cmp dword [esp + 0x20], edx
je 0x1004c2b2
mov dword [esp + 0x34], esi
lea ecx, [esp + 0x7c]
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
push 1
call fcn.1001a0d2
xor edx, edx
mov dword [esp + 0x18], edx
jmp 0x1004c1dd
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x7c]
mov dword [eax + ecx*4], 0xb0881dd
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x1004c1ca
mov dword [esp + 0x3c], edx
jmp 0x1004c281
mov dword [esp + 0x14], 0xd65121ac
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], edx
jl 0x1004c263
mov dword [esp + 0x24], 0xe96b779c
xor edx, edx
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x28]
cmp dword [eax + ecx*4], 0x31d26ec1
setg dl
mov dword [esp + 0x24], edx
xor edx, edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
cmp dword [eax], edx
je 0x1004c23c
mov eax, dword [esp + 0x3c]
cmp dword [esp + 0x1c], edx
je 0x1004c23c
xor eax, eax
inc eax
jmp 0x1004c23e
mov eax, edx
xor ecx, ecx
cmp eax, edi
mov eax, dword [esp + 0x14]
setne cl
sub eax, ecx
je 0x1004c251
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
dec dword [esp + 0x14]
jns 0x1004c1ff
mov byte [esp + 0x13], dl
cmp byte [esp + 0x13], 0
je 0x1004c27d
push 0x573
push edx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
inc dword [esp + 0x3c]
cmp dword [esp + 0x3c], edx
jle 0x1004c1ed
mov eax, dword [esp + 0x7c]
push eax
dec dword [eax]
call fcn.10059948
xor edx, edx
pop ecx
mov dword [esp + 0x7c], edx
mov dword [esp + 0x80], edx
mov dword [esp + 0x84], edx
mov dword [esp + 0x1c], edx
jmp 0x1004c2ed
mov byte [esp + 0x13], dl
cmp byte [esp + 0x13], dl
je 0x1004c2ca
push edx
push 0x151c
call dword [sym.imp.GDI32.dll_SetBkColor]
xor edx, edx
mov eax, dword [esp + 0x28]
cmp dword [eax], edx
je 0x1004c2ac
mov byte [esp + 0xb4], dl
push eax
jmp 0x1004c303
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
cmp dword [ecx + eax*4], edx
jne 0x1004c2f7
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jle 0x1004c2dc
mov ecx, dword [esp + 0x28]
mov byte [esp + 0xb4], dl
test ecx, ecx
je 0x1004c317
push ecx
call fcn.10059948
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], eax
pop ecx
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffff5
jg 0x1004c168
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x6c]
push eax
lea edx, [esp + 0x74]
lea ecx, [esp + 0x6c]
call fcn.1004b98b
add esp, 0x10
mov dword [esp + 0xb4], edi
cmp dword [esp + 0x8c], 0
je 0x1004c371
push dword [esp + 0x8c]
call fcn.10059948
pop ecx
mov eax, ebx
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0x68]
mov edi, edx
mov esi, eax
call fcn.1004b919
mov ecx, dword [esp + 0xac]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret