Function at 0x100423e0
Capabilities:
Start service

Disassembly:
mov eax, 0x100626c4
call fcn.100608e8
sub esp, 0x6c
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esp
cmp byte [ebp + 8], bl
je 0x1004269c
mov dword [ebp - 0x24], 0x79a
cmp dword [ebp - 0x24], 0xb45
jle 0x10042478
mov esi, ebx
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov dword [ebp - 0x18], esi
mov ecx, edi
mov eax, ebx
sar esi, cl
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x28], ebx
mov ecx, eax
mov ebx, esi
mov esi, dword [ebp - 0x28]
sar ebx, cl
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x1007cdd8
cdq
push edx
push eax
call fcn.10005d27
inc esi
cmp esi, 0x14df
jl 0x10042430
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x1c], eax
push 0
pop ebx
cmp eax, 0x7cc6
jl 0x10042424
mov esi, dword [ebp - 0x20]
inc edi
cmp edi, 0x5591
jl 0x10042415
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x6d15
jl 0x10042413
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x24], 0x5c5
jge 0x100424c2
mov edx, str.sgojcluiz_dddlsrhs_mepiiw_myr
mov ecx, 0x1007cdd8
call fcn.100089dc
jmp 0x100424c2
lea eax, [ebp - 0x44]
mov dword [ebp - 4], ebx
push eax
push 0x50f6
push 0x7347
push 0x7c72
push 0x2d83
lea eax, [ebp + 0xc]
xor dl, dl
push eax
push ecx
call fcn.1004238d
mov dword [ebp - 0x20], 0x2a09
add esp, 0x1c
cmp dword [ebp - 0x20], 0x2cd2
jle 0x10042556
mov esi, ebx
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x24], ebx
mov eax, edi
cdq
idiv ecx
mov eax, esi
lea ecx, [ebp - 0x5c]
sub eax, edx
cdq
push edx
push eax
call fcn.10001a84
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10042523
mov eax, dword [eax]
push eax
call fcn.10048acd
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x5c]
call fcn.10006880
mov ecx, dword [ebp - 0x24]
inc ecx
mov dword [ebp - 0x24], ecx
cmp ecx, 0x756f
jl 0x10042505
inc edi
cmp edi, 0x5c06
jl 0x10042500
inc esi
cmp esi, 0x51e7
jl 0x100424fe
cmp dword [ebp - 0x20], 0x29cb
jge 0x1004256a
push str.vzdab_mkiqr_gpztabuk
call fcn.10048acd
pop ecx
mov dword [ebp - 4], ebx
mov eax, dword [0x108202d4]
test al, 1
jne 0x10042595
or eax, 1
mov dword [0x108202d4], eax
push 0x241d
mov byte [ebp - 4], 5
call fcn.10026ea1
pop ecx
mov byte [0x108202cb], al
mov byte [ebp - 4], bl
mov dword [ebp - 0x24], 0x49d
cmp dword [ebp - 0x24], 0x6fc
jle 0x10042600
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0x74]
push edx
push eax
call fcn.10001a84
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100425ca
mov eax, dword [eax]
push eax
call fcn.10048acd
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.10006880
inc edi
cmp edi, 0x53a8
jl 0x100425b2
inc esi
cmp esi, 0x36fb
jl 0x100425b0
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [0x108202d4]
test al, 2
jne 0x10042625
or eax, 2
mov dword [0x108202d4], eax
push 0x2765
mov byte [ebp - 4], 6
call fcn.10026ea1
pop ecx
mov byte [0x108202ca], al
cmp dword [ebp - 0x24], 0x3d1
jge 0x10042639
push str.ziqtqyrhn_ejugste_mkupm_gxpaalb_zmvg_pqkw_brrgjo_qaseeogry
call fcn.10048acd
pop ecx
mov dword [ebp - 4], ebx
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1004267c
call fcn.1004006f
push 0x34
pop ecx
xor edx, edx
div ecx
push 0x50f5
push 0x108202ca
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], edx
push eax
push 0x108202cb
lea eax, [ebp - 0x44]
mov dl, 1
push eax
push 0x2b3e
push ecx
call fcn.1004238d
add esp, 0x1c
dec esi
jne 0x10042643
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x44]
cmp ecx, eax
je 0x1004268f
push 0xffffffffffffffff
push ebx
push eax
call fcn.1001e38d
push ebx
push 1
lea ecx, [ebp - 0x44]
call fcn.1001d7f0
jmp 0x100426b2
push ecx
push 0x5197
push ecx
push ebx
lea ecx, [ebp - 0x11]
mov byte [ebp - 0x11], bl
call fcn.10041b76
add esp, 0x10
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret