Function at 0x4017a0
Capabilities:
Get process heap flags
Install driver
Unload driver

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x178
mov edi, dword [ecx]
mov esi, dword [ecx + 8]
mov ebx, dword [ecx + 0xc]
test edi, edi
js 0x4018d0
mov edx, edi
movzx eax, byte [0x403018]
lea esi, [ebp - 0x144]
and edx, 0xfffffffb
cmp edx, 1
je 0x401850
test al, 1
jne 0x401ad8
mov dword [ebp - 0x144], 0x30
mov dword [ebp - 0x140], 4
mov dword [ebp - 0x13c], 5
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 0
mov dword [esp + 4], esi
mov eax, dword [0x405008]
mov dword [esp], eax
call sym._SetServiceStatus_8
sub esp, 8
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
test al, 8
jne 0x4019f0
mov dword [ebp - 0x144], 0x30
mov dword [ebp - 0x140], 3
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 0
mov dword [esp + 4], esi
mov eax, dword [0x405008]
mov dword [esp], eax
call sym._SetServiceStatus_8
mov eax, dword [section..bss]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetEvent]
sub esp, 4
jmp 0x401840
mov eax, 0x57
test esi, esi
je 0x401842
mov ebx, edi
and ebx, 0x7fffffff
cmp word [esi], 0
je 0x401e18
mov eax, esi
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4018f8
sub eax, esi
add eax, 0x6a
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ecx, eax
test eax, eax
je 0x401e28
xor eax, eax
lea esi, cs:[esi]
nop
movzx edx, word [eax + str.RegistryMachineSystemCurrentControlSetServices_]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x401940
cmp word [ecx], 0
mov edx, ecx
je 0x401969
lea esi, cs:[esi]
add edx, 2
cmp word [edx], 0
jne 0x401960
xor eax, eax
lea esi, cs:[esi]
movzx edi, word [esi + eax]
mov word [edx + eax], di
add eax, 2
test di, di
jne 0x401970
lea edi, [ebp - 0x14c]
mov dword [esp + 4], ecx
mov dword [esp], edi
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
sub esp, 8
cmp ebx, 1
je 0x401bc8
cmp ebx, 0x80
je 0x401cb0
test ebx, ebx
jne 0x401ca0
mov dword [esp], edi
call sym._ZwLoadDriver_4
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ntoskrnl.exe_RtlNtStatusToDosError]
sub esp, 4
mov dword [ebp - 0x15c], eax
mov dword [esp], edi
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov eax, dword [ebp - 0x15c]
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
test ebx, ebx
je 0x401fae
mov eax, ebx
shr eax, 0x10
je 0x401e50
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov ecx, eax
sub esp, 8
mov eax, str._invalid_
test ecx, ecx
jne 0x401c10
cmp word [ebx], 0
je 0x40208a
mov edx, ecx
lea ecx, [ecx + 1]
cmp word [ebx + edx*2 + 2], 0
jne 0x401a30
mov edi, 0x224c
mov dword [ebp - 0x15c], ebx
lea eax, [ebp - 0x142]
mov word [ebp - 0x144], di
movzx edi, word [str._r_]
jmp 0x401a94
cmp cx, 9
je 0x401dc0
cmp cx, 0xa
jne 0x401e68
mov esi, 0x6e5c
add eax, 2
mov word [eax - 2], si
sub edx, 1
jb 0x401fcd
lea ecx, [ebp - 0x22]
cmp ecx, eax
jb 0x401be4
add dword [ebp - 0x15c], 2
mov esi, dword [ebp - 0x15c]
movzx ecx, word [esi - 2]
cmp cx, 0xd
je 0x401dd8
jbe 0x401a60
cmp cx, 0x22
je 0x401de8
cmp cx, 0x5c
jne 0x401f18
mov ecx, 0x5c5c
add eax, 2
mov word [eax - 2], cx
jmp 0x401a80
test ebx, ebx
je 0x401fb8
mov eax, ebx
shr eax, 0x10
je 0x401e38
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov ecx, eax
sub esp, 8
mov eax, str._invalid_
test ecx, ecx
jne 0x401c69
cmp word [ebx], 0
je 0x4020a8
lea esi, cs:[esi]
mov edx, ecx
lea ecx, [ecx + 1]
cmp word [ebx + edx*2 + 2], 0
jne 0x401b20
mov eax, 0x224c
mov dword [ebp - 0x15c], ebx
mov word [ebp - 0x144], ax
lea eax, [ebp - 0x142]
jmp 0x401b84
cmp cx, 9
je 0x401da8
cmp cx, 0xa
jne 0x401ec0
mov esi, 0x6e5c
add eax, 2
mov word [eax - 2], si
sub edx, 1
jb 0x401fc2
lea ecx, [ebp - 0x22]
cmp ecx, eax
jb 0x401c3d
add dword [ebp - 0x15c], 2
mov ebx, dword [ebp - 0x15c]
movzx ecx, word [ebx - 2]
cmp cx, 0xd
je 0x401d90
jbe 0x401b50
cmp cx, 0x22
je 0x401e00
cmp cx, 0x5c
jne 0x401f30
mov ecx, 0x5c5c
add eax, 2
mov word [eax - 2], cx
jmp 0x401b70
mov dword [esp], edi
call sym._ZwUnloadDriver_4
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ntoskrnl.exe_RtlNtStatusToDosError]
sub esp, 4
jmp 0x4019ca
mov byte [eax], 0x22
test edx, edx
je 0x401fd0
mov byte [eax + 3], 0x2e
mov edx, 0x2e2e
mov word [eax + 1], dx
lea edx, [eax + 4]
lea esi, [ebp - 0x144]
mov byte [edx], 0
mov dword [esp], esi
call sym.___wine_dbg_strdup
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.shutting_down__s_n
mov dword [esp + 8], str.service_handler
mov dword [esp + 4], 0x403018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x401858
mov byte [eax], 0x22
test edx, edx
je 0x401fc5
mov byte [eax + 3], 0x2e
mov edx, 0x2e2e
mov word [eax + 1], dx
lea edx, [eax + 4]
lea esi, [ebp - 0x144]
mov byte [edx], 0
mov dword [esp], esi
call sym.___wine_dbg_strdup
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.got_service_ctrl__lx_for__s_n
mov dword [esp + 8], str.service_handler
mov dword [esp + 4], 0x403018
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x4017e6
test byte [0x403018], 1
jne 0x401cbf
xor eax, eax
jmp 0x4019ca
mov dword [esp], esi
call sym._wine_enumerate_root_devices
xor eax, eax
jmp 0x4019ca
mov eax, esi
shr eax, 0x10
je 0x40200f
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, str._invalid_
sub esp, 8
test eax, eax
jne 0x401f7b
cmp word [esi], 0
je 0x4020d7
lea esi, [esi]
mov edx, eax
lea eax, [eax + 1]
cmp word [esi + edx*2 + 2], 0
jne 0x401cf8
mov ecx, 0x224c
mov dword [ebp - 0x15c], ebx
mov word [ebp - 0x144], cx
lea ecx, [ebp - 0x142]
jmp 0x401d54
cmp ax, 9
je 0x401ffe
cmp ax, 0xa
jne 0x402039
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
sub edx, 1
jb 0x4020c6
lea eax, [ebp - 0x22]
cmp eax, ecx
jb 0x401f47
movzx eax, word [esi]
add esi, 2
cmp ax, 0xd
je 0x401feb
jbe 0x401d20
cmp ax, 0x22
je 0x401fd8
cmp ax, 0x5c
jne 0x402026
mov eax, 0x5c5c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x401d40
movzx ebx, word [str._r_]
add eax, 2
mov word [eax - 2], bx
jmp 0x401b70
mov ebx, 0x745c
add eax, 2
mov word [eax - 2], bx
jmp 0x401b70
mov ebx, 0x745c
add eax, 2
mov word [eax - 2], bx
jmp 0x401a80
mov word [eax], di
add eax, 2
jmp 0x401a80
movzx ebx, word [0x40416c]
add eax, 2
mov word [eax - 2], bx
jmp 0x401a80
movzx ebx, word [0x40416c]
add eax, 2
mov word [eax - 2], bx
jmp 0x401b70
mov eax, 0x6a
jmp 0x401906
mov eax, 0xc0000017
jmp 0x401842
mov dword [esp + 4], ebx
mov dword [esp], str._04x
call sym._wine_dbg_sprintf.constprop.0
jmp 0x401c69
mov dword [esp + 4], ebx
mov dword [esp], str._04x
call sym._wine_dbg_sprintf.constprop.0
jmp 0x401c10
mov esi, ecx
mov byte [eax], 0x5c
add eax, 5
shr si, 0xc
movzx esi, si
movzx ebx, byte [esi + str.0123456789abcdefdevice_handler]
mov esi, ecx
shr si, 8
and esi, 0xf
mov byte [eax - 4], bl
movzx ebx, byte [esi + str.0123456789abcdefdevice_handler]
mov esi, ecx
and ecx, 0xf
shr si, 4
movzx ecx, byte [ecx + str.0123456789abcdefdevice_handler]
and esi, 0xf
mov byte [eax - 3], bl
movzx ebx, byte [esi + str.0123456789abcdefdevice_handler]
mov byte [eax - 1], cl
mov byte [eax - 2], bl
jmp 0x401a80
mov esi, ecx
mov byte [eax], 0x5c
add eax, 5
shr si, 0xc
movzx esi, si
movzx ebx, byte [esi + str.0123456789abcdefdevice_handler]
mov esi, ecx
shr si, 8
and esi, 0xf
mov byte [eax - 4], bl
movzx ebx, byte [esi + str.0123456789abcdefdevice_handler]
mov esi, ecx
and ecx, 0xf
shr si, 4
movzx ecx, byte [ecx + str.0123456789abcdefdevice_handler]
and esi, 0xf
mov byte [eax - 3], bl
movzx ebx, byte [esi + str.0123456789abcdefdevice_handler]
mov byte [eax - 1], cl
mov byte [eax - 2], bl
jmp 0x401b70
lea esi, [ecx - 0x20]
cmp si, 0x5e
ja 0x401e68
mov byte [eax], cl
add eax, 1
jmp 0x401a80
lea esi, [ecx - 0x20]
cmp si, 0x5e
ja 0x401ec0
mov byte [eax], cl
add eax, 1
jmp 0x401b70
mov byte [ecx], 0x22
mov ebx, dword [ebp - 0x15c]
test edx, edx
je 0x4020cf
mov byte [ecx + 3], 0x2e
mov eax, 0x2e2e
mov word [ecx + 1], ax
lea eax, [ecx + 4]
mov byte [eax], 0
lea eax, [ebp - 0x144]
mov dword [esp], eax
call sym.___wine_dbg_strdup
mov edx, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.got_driver_ctrl__lx_for__s_n
mov dword [esp + 8], 0x4040bc
mov dword [esp + 4], 0x403018
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
xor eax, eax
jmp 0x4019ca
mov eax, str._null_
jmp 0x401c10
mov eax, str._null_
jmp 0x401c69
mov byte [eax], 0x22
lea edx, [eax + 1]
jmp 0x401c58
mov byte [eax], 0x22
lea edx, [eax + 1]
jmp 0x401bff
movzx eax, word [0x40416c]
add ecx, 2
mov word [ecx - 2], ax
jmp 0x401d40
movzx eax, word [str._r_]
add ecx, 2
mov word [ecx - 2], ax
jmp 0x401d40
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x401d40
mov dword [esp + 4], esi
mov dword [esp], str._04x
call sym._wine_dbg_sprintf.constprop.0
mov edx, eax
jmp 0x401f7b
lea ebx, [eax - 0x20]
cmp bx, 0x5e
ja 0x402039
mov byte [ecx], al
add ecx, 1
jmp 0x401d40
mov ebx, eax
mov byte [ecx], 0x5c
add ecx, 5
shr bx, 0xc
movzx ebx, bx
movzx ebx, byte [ebx + str.0123456789abcdefdevice_handler]
mov byte [ecx - 4], bl
mov ebx, eax
shr bx, 8
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefdevice_handler]
mov byte [ecx - 3], bl
mov ebx, eax
and eax, 0xf
shr bx, 4
movzx eax, byte [eax + str.0123456789abcdefdevice_handler]
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefdevice_handler]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x401d40
mov eax, 0x224c
mov byte [ebp - 0x142], 0x22
lea edx, [ebp - 0x141]
mov word [ebp - 0x144], ax
jmp 0x401bff
mov eax, 0x224c
mov byte [ebp - 0x142], 0x22
lea edx, [ebp - 0x141]
mov word [ebp - 0x144], ax
jmp 0x401c58
mov byte [ecx], 0x22
mov ebx, dword [ebp - 0x15c]
lea eax, [ecx + 1]
jmp 0x401f68
mov word [ebp - 0x144], 0x224c
lea eax, [ebp - 0x141]
mov byte [ebp - 0x142], 0x22
jmp 0x401f68