Function at 0x1001aa73
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
push 0
pop ebx
push 3
mov edi, ecx
mov dword [ebp - 0x40], edx
xor ecx, ecx
pop esi
inc ecx
push 2
mov dword [ebp - 8], ecx
mov dword [ebp - 8], 0xffffffef
pop edx
jmp 0x1001ab75
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jmp 0x1001aab8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa0], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1001aaa7
mov dword [ebp - 0xc], ebx
jmp 0x1001ab4e
mov dword [ebp - 4], ebx
jmp 0x1001aad4
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x70], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x1001aaca
mov dword [ebp - 4], ebx
jmp 0x1001aaed
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x60], 0x44accb24
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001aadf
mov dword [ebp - 0x64], ebx
jmp 0x1001ab1a
mov dword [ebp - 0x10], 0xfffffffc
mov dword [ebp - 0x10], ebx
jmp 0x1001ab12
mov eax, dword [ebp - 0x64]
cmp dword [ebp + eax*4 - 0xa0], ebx
jne 0x1001ab17
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x1001ab03
inc dword [ebp - 0x64]
cmp dword [ebp - 0x64], edx
jle 0x1001aaf7
mov dword [ebp - 0x58], ebx
cmp dword [ebp - 0x58], esi
jg 0x1001ab4b
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001ab3d
push ebx
push 0x1348
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], esi
jle 0x1001ab27
xor ecx, ecx
push 2
inc ecx
pop edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jle 0x1001aac5
mov dword [ebp - 0xc], ebx
jmp 0x1001ab6d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xa0], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x1001ab5c
inc dword [ebp - 8]
cmp dword [ebp - 8], 9
jge 0x1001aa9f
cmp dword [edi + 0x10], ebx
jne 0x1001ab8b
xor al, al
jmp 0x1001b1be
mov dword [ebp - 8], 0x13638ecf
mov eax, 0xdcda7209
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 4], ebx
jmp 0x1001abc2
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x3c], 0x342eb90d
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001abb4
mov dword [ebp - 4], ebx
jmp 0x1001abdd
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe0], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001abcc
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], ebx
jl 0x1001aca0
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], 0x2ff18c9a
mov dword [ebp - 4], ebx
jmp 0x1001ac8b
mov dword [ebp - 0xc], 0x1a9565e0
mov dword [ebp - 0xc], ebx
jmp 0x1001ac18
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x3c], ebx
jne 0x1001ac1d
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jle 0x1001ac0c
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], ebx
jl 0x1001ac88
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x3c], ebx
je 0x1001ac43
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x3c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x3c]
mov dword [ebp - 0xd8], 0xfffffff9
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x3c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x90], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001ac80
push 0x6d13
push ebx
call fcn.1001d2b6
pop ecx
pop ecx
dec dword [ebp - 0xc]
jns 0x1001ac25
xor ecx, ecx
inc ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jle 0x1001ac00
dec dword [ebp - 8]
jns 0x1001abee
push 2
pop edx
mov dword [ebp - 0x10], 0xfaf425f5
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 8], 0x1480146
mov dword [ebp - 4], ebx
jmp 0x1001accb
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x34], 0x57fd5464
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001acbd
mov dword [ebp - 4], ebx
jmp 0x1001ace3
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x78], 0x5457d670
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001acd5
mov dword [ebp - 0x34], ebx
jmp 0x1001ad5e
mov dword [ebp - 4], 0xfec1b16e
mov dword [ebp - 8], ebx
jmp 0x1001ad0a
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x84], 8
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x1001acf9
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x18], ebx
jne 0x1001ad1e
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x10], ebx
jne 0x1001ad2d
mov edx, ebx
cmp dword [ebp - 0x7c], ebx
je 0x1001ad2f
mov edx, ecx
mov eax, dword [ebp - 0x34]
inc edx
imul edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x80]
cmp edx, eax
mov eax, dword [ebp - 0x74]
setge cl
sub eax, ecx
je 0x1001ad53
cmp dword [ebp - 4], ebx
je 0x1001ad53
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x1001ad58
xor ecx, ecx
mov eax, ebx
inc ecx
mov dword [ebp - 8], eax
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffff6
je 0x1001aced
push 0x4744
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.1001cb13
mov dword [ebp - 4], 0x2364
add esp, 0xc
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x10], 0xfffffffa
mov dword [ebp - 8], 0xae9a07b3
mov dword [ebp - 0x18], 0xacd4a797
mov dword [ebp - 0x18], 0xb370cc32
mov dword [ebp - 8], ebx
jmp 0x1001adb6
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xbc], 0xc9fe9a5a
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x1001ada5
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 4]
jle 0x1001adf1
cmp dword [ebp - 0x10], ebx
je 0x1001adf1
xor edx, edx
inc edx
jmp 0x1001adf3
mov edx, ebx
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp eax, 0x2d67
setle cl
xor eax, eax
cmp edx, 0xffffffff
setg al
sub ecx, eax
dec ecx
mov dword [ebp - 0xb4], ecx
mov eax, dword [ebp - 0xc]
sub eax, ecx
mov dword [ebp - 0x18], eax
inc dword [ebp - 0xc]
cmp dword [edi + 0x14], 0x10
jb 0x1001ae26
mov esi, dword [edi]
jmp 0x1001ae28
mov esi, edi
cmp dword [edi + 0x14], 0x10
jb 0x1001ae32
mov ecx, dword [edi]
jmp 0x1001ae34
mov ecx, edi
mov eax, dword [edi + 0x10]
add eax, ecx
cmp esi, eax
je 0x1001b1bc
mov dword [ebp - 0xc], 0xfffffff6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xc], 0xffffffef
jmp 0x1001aeb6
mov dword [ebp - 4], ebx
jmp 0x1001ae6d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x108], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x1001ae5c
mov dword [ebp - 4], ebx
jmp 0x1001ae86
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x2c], 0xcb03629a
inc dword [ebp - 4]
cmp dword [ebp - 4], 1
jl 0x1001ae78
mov dword [ebp - 0x2c], 3
cmp dword [ebp - 0x2c], ebx
jl 0x1001aeb3
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001aeae
push ebx
push 0x44d4
call fcn.1001b203
pop ecx
pop ecx
dec dword [ebp - 0x2c]
jns 0x1001ae98
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x1c
jne 0x1001ae57
mov al, byte [esi]
cmp al, 0x30
jl 0x1001af7e
cmp al, 0x39
jg 0x1001af7e
or eax, 0xffffffff
mov dword [ebp - 0x28], 0xe0cf
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0xa79cc099
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.1001ca19
pop ecx
pop ecx
mov dword [ebp - 0x28], ebx
jmp 0x1001af62
mov dword [ebp - 0x1c], 4
mov eax, 0x7a429adb
mov dword [ebp - 0x1c], 0x5cc48b16
mov dword [ebp - 0x10], 0x5da2
push 3
pop ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 8], ebx
jmp 0x1001af43
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xc8], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x1001af36
dec dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc4]
cmp eax, 1
setl cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x19
jne 0x1001af05
mov edx, dword [ebp - 0x40]
movsx eax, byte [esi]
imul ecx, dword [edx], 0xa
add ecx, 0xffffffd0
add eax, ecx
inc esi
mov dword [edx], eax
jmp 0x1001ae28
push 5
pop edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], ebx
jmp 0x1001af9a
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe8], 0xffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001af89
push 4
mov dword [ebp - 4], ebx
pop esi
jmp 0x1001afb9
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xb0], 0x6a48
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001afa8
mov dword [ebp - 8], ebx
jmp 0x1001afd3
mov dword [ebp - 0x1c], 0xffffffff
inc dword [ebp - 0xac]
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jle 0x1001afc3
push 0x625e
mov dl, 1
lea ecx, [ebp - 0x40]
call fcn.1001a04f
mov dword [ebp - 4], 0x97f6af11
mov dword [ebp - 0x18], 0xffffffff
pop ecx
mov dword [ebp - 0x44], 0xffffffff
xor ecx, ecx
mov dword [ebp - 8], 0xfffffffd
inc ecx
mov dword [ebp - 4], ebx
jmp 0x1001b017
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x24], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x1001b00d
mov dword [ebp - 4], ebx
jmp 0x1001b032
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xf8], 0x93506f8a
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001b021
mov dword [ebp - 4], ebx
jmp 0x1001b1ad
mov dword [ebp - 0xc], 0x4fddd3f4
mov dword [ebp - 0x10], 0x3e8ce6fc
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], ebx
jl 0x1001b1a1
mov dword [ebp - 8], ebx
push 3
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ebx
pop ecx
jmp 0x1001b078
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xd4], 0xe957
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x1001b067
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x24]
dec eax
jne 0x1001b0aa
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x24]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x24]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x24]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
dec eax
neg eax
sbb eax, eax
inc eax
add eax, dword [ebp - 4]
cmp ecx, eax
sbb eax, eax
add eax, 0xffffa767
neg eax
sbb eax, eax
inc eax
sub eax, edi
je 0x1001b0ec
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x24], ebx
je 0x1001b0ec
lea eax, [ebp - 0x44]
push eax
push ebx
call fcn.1001d522
pop ecx
pop ecx
jmp 0x1001b10d
push 0x35f
lea eax, [ebp - 0x1d]
mov dword [ebp - 8], ebx
push ebx
mov byte [ebp - 0x1d], bl
push eax
call fcn.1001d2f2
add esp, 0xc
cmp dword [ebp - 8], ebx
jne 0x1001b198
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 1
setne al
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 8], eax
je 0x1001b134
cmp dword [ebp - 0x44], ebx
je 0x1001b13e
cmp dword [ebp - 0x18], ebx
je 0x1001b13e
xor esi, esi
inc esi
jmp 0x1001b140
mov esi, ebx
mov eax, dword [ebp - 0xc]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x24]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setle dl
cmp esi, 1
sbb ecx, ecx
xor eax, eax
add ecx, 0x7069e5fa
cmp ecx, 0xa002
setg al
add edx, eax
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0xf7f1c74f
sbb eax, eax
neg eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [ebp - 0xf4], ecx
dec dword [ebp - 0xc]
jns 0x1001b059
cmp dword [ebp - 0x10], ebx
jne 0x1001ab84
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1a
jle 0x1001b03f
jmp 0x1001ab84
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret