Function at 0x101ee3e
Capabilities:
Modify service
Query service status
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
push 0x80000002
push edi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, edi
mov dword [ebp - 0x10], eax
je 0x101f058
push 0x36
push 0x1007d90
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
cmp ebx, edi
mov dword [ebp - 8], ebx
je 0x101f03b
lea eax, [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x101f01e
cmp dword [ebp - 0x28], 4
mov esi, 0x1007480
jne 0x101ef12
push 0x3fe
push esi
call fcn.0100c9d4
push dword [ebp + 8]
push 0x1007d64
call fcn.0100cb2d
xor eax, eax
inc eax
cmp dword [ebp + 8], edi
pop ecx
pop ecx
mov dword [ebp - 4], eax
je 0x101efb4
lea ecx, [ebp - 0x2c]
push ecx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x101eef6
push 0x41b
push esi
call fcn.0100c9d4
push 0x1007d40
call fcn.0100cb2d
pop ecx
jmp 0x101ef1b
push 0x41f
push esi
call fcn.0100c9d4
call dword [fcn.010010e4]
push eax
push 0x1007d18
jmp 0x101f073
cmp dword [ebp + 8], edi
jne 0x101efb4
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push ebx
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
mov ebx, dword [fcn.010010e4]
je 0x101ef53
push 0x437
push esi
call fcn.0100c9d4
push 0x1007cdc
call fcn.0100cb2d
jmp 0x101ef6c
push 0x43b
push esi
call fcn.0100c9d4
call ebx
push eax
push 0x1007c90
call fcn.0100cb4a
pop ecx
pop ecx
push edi
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x101ef9a
push 0x441
push esi
call fcn.0100c9d4
push 0x1007c6c
call fcn.0100cb2d
mov dword [ebp - 4], 1
jmp 0x101efb3
push 0x446
push esi
call fcn.0100c9d4
call ebx
push eax
push 0x1007c44
call fcn.0100cb4a
pop ecx
pop ecx
push dword [ebp - 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call ebx
push dword [ebp - 0x10]
call ebx
cmp dword [ebp - 4], edi
je 0x101f07a
push 0x1f4
call dword [0x1001100]
mov ecx, dword [ebp - 0xc]
call fcn.0101e8ed
mov ebx, eax
cmp ebx, edi
jge 0x101eff9
push 0x459
push esi
call fcn.0100c9d4
push ebx
push 0x1007c10
jmp 0x101f073
mov ecx, dword [ebp - 0xc]
call fcn.0101eb06
mov ebx, eax
cmp ebx, edi
jge 0x101f01a
push 0x462
push esi
call fcn.0100c9d4
push ebx
push 0x1007be0
jmp 0x101f073
xor eax, eax
jmp 0x101f097
push 0x404
push 0x1007480
call fcn.0100c9d4
call dword [fcn.010010e4]
push eax
push 0x1007ba4
jmp 0x101f073
push 0x40a
push 0x1007480
call fcn.0100c9d4
call dword [fcn.010010e4]
push eax
push 0x1007b6c
jmp 0x101f073
push 0x410
push 0x1007480
call fcn.0100c9d4
call dword [fcn.010010e4]
push eax
push 0x1007b34
call fcn.0100cb4a
pop ecx
pop ecx
cmp dword [ebp - 8], edi
jne 0x101f086
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x10], edi
jne 0x101f092
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 0x8000ffff
pop edi
pop esi
pop ebx
leave
ret 4