Function at 0x10028171
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007e392
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x104
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10028831
mov eax, dword [ebp + 8]
mov dword [ebp - 0x58], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x10], 0xdf37d45d
push 3
lea ecx, [ebp - 0xc0]
call fcn.1001673e
and dword [ebp - 4], 0
mov dword [ebp - 0x98], 0x5d1cb6a7
mov dword [ebp - 0x9c], 0xa0a9
push 4
lea ecx, [ebp - 0xe0]
call fcn.1001673e
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 0
jmp 0x100281f8
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10028214
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc0]
call fcn.100167dc
mov dword [eax], 0xfffffffb
jmp 0x100281f1
mov dword [ebp - 0x18], 0
jmp 0x10028224
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10028240
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe0]
call fcn.100167dc
mov dword [eax], 1
jmp 0x1002821d
mov eax, dword [ebp - 0x10]
sub eax, 0x36126460
cmp eax, 0x4fc2285f
je 0x1002825b
mov dword [ebp - 0x88], 1
jmp 0x10028262
and dword [ebp - 0x88], 0
mov eax, dword [ebp - 0x10]
inc eax
cmp eax, dword [ebp - 0x10]
jle 0x10028274
mov dword [ebp - 0x48], 1
jmp 0x10028278
and dword [ebp - 0x48], 0
cmp dword [ebp - 0x48], 0x45fe
je 0x1002828d
mov dword [ebp - 0x84], 1
jmp 0x10028294
and dword [ebp - 0x84], 0
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x84]
jge 0x100282ae
mov dword [ebp - 0x50], 1
jmp 0x100282b2
and dword [ebp - 0x50], 0
imul eax, dword [ebp - 0x50], 0xc2e7
test eax, eax
je 0x100282ee
mov dword [ebp - 0x10], 0
jmp 0x100282cd
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x17
jg 0x100282ec
mov byte [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
push 1
push 0x573
call fcn.10027d7e
add esp, 0xc
jmp 0x100282c6
jmp 0x10028329
push 1
call fcn.10027dc3
pop ecx
push 0xee0
push 0x645
lea eax, [ebp - 0xc0]
push eax
push 0x52a0
push 0x3be9
push 0x1de2
push 0x9eb
lea eax, [ebp - 0x10]
push eax
push 0
call fcn.1002b58f
add esp, 0x24
push 0x7bca
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xe0]
push eax
push 0x634d
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0xc0]
push eax
call fcn.10027dfb
add esp, 0x20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xe0]
call fcn.100167c0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0]
call fcn.100167c0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 4]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0xd4], 1
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0xcc], 1
mov dword [ebp - 0xc8], 1
lea ecx, [ebp - 0x3d]
call fcn.10008a93
push eax
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0x104]
call fcn.100167eb
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xec]
call fcn.1001679a
mov dword [ebp - 4], 2
push 1
lea ecx, [ebp - 0x94]
call fcn.1001673e
mov byte [ebp - 4], 3
mov dword [ebp - 0x28], 0
jmp 0x10028406
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1002841f
push dword [ebp - 0x28]
lea ecx, [ebp - 0x94]
call fcn.100167dc
and dword [eax], 0
jmp 0x100283ff
push 0
lea ecx, [ebp - 0x94]
call fcn.100167dc
mov dword [eax], 3
jmp 0x1002844f
push 0
lea ecx, [ebp - 0x94]
call fcn.100167dc
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x70]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x94]
call fcn.100167dc
cmp dword [eax], 0
jl 0x100284b8
push 0
lea ecx, [ebp - 0x94]
call fcn.100167dc
push dword [eax]
lea ecx, [ebp - 0xec]
call fcn.100167dc
cmp dword [eax], 0
je 0x10028493
mov byte [ebp - 0x1d], 0
lea eax, [ebp - 0x1d]
push eax
push 0
call fcn.1002b794
pop ecx
pop ecx
jmp 0x100284b3
mov byte [ebp - 0x22], 0
movzx eax, byte [ebp - 0x22]
test eax, eax
je 0x100284b3
push 1
push 0x22a6
push 0x7f15
call fcn.10027f3d
add esp, 0xc
jmp 0x10028434
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x94]
call fcn.100167c0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xec]
call fcn.100167c0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
push 8
pop ecx
imul ecx, ecx, 5
lea eax, [eax + ecx + 0x78]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
cmp dword [eax + 4], 0
jbe 0x1002882f
push 2
lea ecx, [ebp - 0x3c]
call fcn.1001673e
mov dword [ebp - 4], 4
mov dword [ebp - 0x4c], 0xfffffffe
mov dword [ebp - 0xa0], 0x7c62
push 3
lea ecx, [ebp - 0xf8]
call fcn.1001673e
mov byte [ebp - 4], 5
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x14], 0
jmp 0x1002853f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10028555
push dword [ebp - 0x14]
lea ecx, [ebp - 0x3c]
call fcn.100167dc
or dword [eax], 0xffffffff
jmp 0x10028538
mov dword [ebp - 0x14], 0
jmp 0x10028565
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1002857b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xac], 1
jmp 0x1002855e
push 1
push 0x6039
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4254
call fcn.10027fa4
add esp, 0x14
push 1
lea ecx, [ebp - 0x3c]
call fcn.100167dc
cmp dword [eax], 9
jl 0x100285b2
mov dword [ebp - 0x60], 1
jmp 0x100285b6
and dword [ebp - 0x60], 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.100167dc
cmp dword [eax], 0x61ec
jl 0x100285d1
mov dword [ebp - 0x80], 1
jmp 0x100285d5
and dword [ebp - 0x80], 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.100167dc
mov ecx, dword [ebp - 0x80]
cmp ecx, dword [eax]
je 0x100285f2
mov dword [ebp - 0xa4], 1
jmp 0x100285f9
and dword [ebp - 0xa4], 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.100167dc
push 1
lea ecx, [ebp - 0x3c]
call fcn.100167dc
mov esi, eax
push 1
lea ecx, [ebp - 0x3c]
call fcn.100167dc
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x10028628
mov dword [ebp - 0x78], 1
jmp 0x1002862c
and dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x78]
jl 0x1002863d
mov dword [ebp - 0x68], 1
jmp 0x10028641
and dword [ebp - 0x68], 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.100167dc
mov ecx, dword [ebp - 0x68]
add ecx, dword [eax]
cmp ecx, 0xfffffffe
ja 0x1002865e
mov dword [ebp - 0x44], 1
jmp 0x10028662
and dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov esi, dword [ebp - 0x4c]
push 1
lea ecx, [ebp - 0x3c]
call fcn.100167dc
imul esi, dword [eax]
dec esi
cmp esi, 0x8132
jl 0x1002868a
mov dword [ebp - 0x54], 1
jmp 0x1002868e
and dword [ebp - 0x54], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x54], eax
jl 0x100286a2
mov dword [ebp - 0x5c], 1
jmp 0x100286a6
and dword [ebp - 0x5c], 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.100167dc
mov eax, dword [eax]
imul eax, dword [ebp - 0x5c]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xac], eax
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xf8]
call fcn.100167c0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.100167c0
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x74]
add ecx, dword [eax]
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0xfc], 4
mov dword [ebp - 0x2c], 0
jmp 0x10028711
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xf
jg 0x100287f9
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x30], 0
jmp 0x10028732
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x10028748
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x110], 0x2fb5a5ef
jmp 0x1002872b
mov dword [ebp - 0x1c], 0
jmp 0x10028758
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffffc
jge 0x100287ae
mov dword [ebp - 0xa8], 0xfff7
cmp dword [ebp - 0xa8], 0
je 0x10028798
mov dword [ebp - 0xb4], 0x8a94
push 1
push 0x5207
lea eax, [ebp - 0xb4]
push eax
push 0x2ecd
call fcn.1002804b
add esp, 0x10
jmp 0x100287ac
mov byte [ebp - 0x1e], 0
movzx eax, byte [ebp - 0x1e]
test eax, eax
je 0x100287ac
push 1
call fcn.100280c1
pop ecx
jmp 0x10028751
mov dword [ebp - 0x1c], 2
jmp 0x100287be
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x100287f4
mov byte [ebp - 0x1f], 0
movzx eax, byte [ebp - 0x1f]
test eax, eax
je 0x100287de
push 0x7e90
push 0
call fcn.1002e5e1
pop ecx
pop ecx
mov byte [ebp - 0x21], 0
movzx eax, byte [ebp - 0x21]
test eax, eax
je 0x100287f2
push 1
call fcn.100280f8
pop ecx
jmp 0x100287b7
jmp 0x1002870a
mov eax, dword [ebp - 0x7c]
cmp dword [eax], 0
jbe 0x1002882f
push 0x631a
push 0x4237
push 0
call fcn.1002912a
add esp, 0xc
push 1
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0xb0]
call fcn.10028117
add esp, 0x10
jmp 0x100287f9
jmp 0x10028840
push 0
push 0x4c1
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret