Function at 0x4300df
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
sub esp, 0x9c
mov eax, dword [0x670f1c]
xor eax, esp
mov dword [esp + 0x98], eax
mov edx, dword [0x4fb1e4]
mov eax, dword [0x4fb1dc]
push esi
mov esi, ecx
mov ecx, dword [0x4fb1e0]
push 0x52
mov dword [esp + 0x44], edx
mov dword [esp + 0x3c], eax
mov eax, dword [0x4fb1e8]
mov dword [esp + 0x40], ecx
mov cx, word [0x4fb1ec]
lea edx, [esp + 0x4e]
push 0
push edx
mov dword [esp + 0x50], eax
mov word [esp + 0x54], cx
call fcn.004c16f0
add esp, 0xc
cmp dword [esi + 0xc4], 2
jne 0x430316
cmp dword [esi + 0xb8], 5
jne 0x430316
cmp dword [esi + 0xbc], 1
jne 0x430316
push ebx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x10], ebx
jne 0x43017a
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
xor al, al
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.004bfdfd
add esp, 0x9c
ret
push 0xf01ff
lea eax, [esp + 0x40]
push eax
push ebx
mov byte [esp + 0x17], 1
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x4301b6
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
xor al, al
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.004bfdfd
add esp, 0x9c
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
lea ecx, [esp + 0x18]
push ecx
push 0x24
lea edx, [esp + 0x24]
push edx
push 0
push esi
call edi
test eax, eax
je 0x43022a
mov eax, dword [esp + 0x20]
cmp eax, 4
je 0x4301ef
cmp eax, 2
je 0x430215
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x430215
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop edi
pop ebx
mov al, 1
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.004bfdfd
add esp, 0x9c
ret
lea eax, [esp + 0x18]
push eax
push 0x24
lea ecx, [esp + 0x24]
push ecx
push 0
push esi
call edi
test eax, eax
jne 0x430250
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
pop edi
pop ebx
xor al, al
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.004bfdfd
add esp, 0x9c
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
cmp dword [esp + 0x24], 2
mov edx, dword [esp + 0x34]
mov edi, eax
mov dword [esp + 0x14], edx
jne 0x4302e1
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0xcccccccd
mul dword [esp + 0x38]
shr edx, 3
cmp edx, 0x3e8
jae 0x43028b
mov edx, 0x3e8
jmp 0x430298
cmp edx, 0x2710
jbe 0x430298
mov edx, 0x2710
push edx
call ebx
lea eax, [esp + 0x1c]
push eax
push 0x24
lea ecx, [esp + 0x28]
push ecx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4302dd
mov edx, dword [esp + 0x14]
cmp dword [esp + 0x34], edx
jbe 0x4302cc
call ebp
mov edi, eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], eax
jmp 0x4302d6
call ebp
sub eax, edi
cmp eax, dword [esp + 0x38]
ja 0x4302dd
cmp dword [esp + 0x24], 2
je 0x430270
mov ebx, dword [esp + 0x18]
cmp dword [esp + 0x24], 4
pop ebp
je 0x4302ee
mov byte [esp + 0xf], 0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov al, byte [esp + 0xf]
pop edi
pop ebx
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.004bfdfd
add esp, 0x9c
ret
mov ecx, dword [esp + 0x9c]
pop esi
xor ecx, esp
mov al, 1
call fcn.004bfdfd
add esp, 0x9c
ret