Function at 0x10002c50
Capabilities:
Acquire debug privileges
Impersonate user

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x1001a170]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
cmp eax, edi
je 0x10002e95
push 0x10015674
push eax
call fcn.10003f3a
add esp, 8
cmp eax, edi
jne 0x10002ca5
push str.AutoRestart_User_Password
push ebx
call fcn.100010a0
add esp, 8
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003ea8
mov esp, ebp
pop ebp
ret
push esi
xor esi, esi
cmp eax, edi
je 0x10002ccb
movzx ecx, si
push 0x10015674
push edi
mov dword [ebp + ecx*4 - 0x154], eax
inc esi
call fcn.10003f3a
add esp, 8
cmp si, 0x10
jb 0x10002ca8
cmp si, 2
je 0x10002cf0
push str.SetSql_User_Password
push ebx
call fcn.100010a0
add esp, 8
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003ea8
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x108], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0xff
lea edx, [ebp - 0x103]
push edi
push edx
mov esi, eax
mov dword [ebp - 0x10c], edi
mov byte [ebp - 0x104], 0
call fcn.10003ec0
lea eax, [ebp - 0x10c]
push eax
call fcn.10001e50
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x10002d45
push str.Fail_to_Get_Service_List
push ebx
call fcn.100010a0
add esp, 8
jmp 0x10002e83
mov edx, dword [ebp - 0x10c]
push 0x100
lea ecx, [ebp - 0x104]
push ecx
push esi
push edx
push edi
call fcn.10002be0
add esp, 0x14
test al, al
jne 0x10002d79
push str.Fail_to_Get_ServiceName_By_Pid
push ebx
call fcn.100010a0
add esp, 8
jmp 0x10002e73
lea eax, [ebp - 0x104]
push eax
push str.Service_Name___s
push ebx
call fcn.100010a0
add esp, 0xc
call fcn.10001230
test al, al
jne 0x10002e0a
call fcn.100012d0
test al, al
jne 0x10002e0a
mov edx, dword [ebp - 0x150]
mov eax, dword [ebp - 0x154]
lea ecx, [ebp - 0x108]
push ecx
push 0
push 3
push edx
push 0x1001562c
push eax
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
test eax, eax
jne 0x10002de2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LogonUserA___d
push ebx
call fcn.100010a0
add esp, 0xc
jmp 0x10002e73
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x10002e0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ImpersonateLoggedOnUser___d
push ebx
call fcn.100010a0
add esp, 0xc
jmp 0x10002e73
push 1
push str.SeDebugPrivilege
call fcn.10001370
add esp, 8
cmp byte [ebp + 0x10], 0
je 0x10002e45
lea edx, [ebp - 0x104]
push str.Network_Service
push edx
call fcn.10001dd0
add esp, 8
test al, al
je 0x10002e3e
push str.Set_Service_To_Network_Successfully
jmp 0x10002e64
push str.Set_Service_To_Network_Failure
jmp 0x10002e64
lea eax, [ebp - 0x104]
push eax
call fcn.10001d50
add esp, 4
test al, al
je 0x10002e5f
push str.Set_Service_To_SYSTEM_Successfully
jmp 0x10002e64
push str.Set_Service_To_SYSTEM_Failure
push ebx
call fcn.100010a0
add esp, 8
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x108]
test eax, eax
je 0x10002e94
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10003ea8
mov esp, ebp
pop ebp
ret