Function at 0x1001aa4
Capabilities:
Terminate process

Disassembly:
xor eax, eax
push eax
push 8
push eax
push 2
push 3
push eax
push eax
xor edi, edi
push 0xffffffffffffffff
inc edi
push eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
jmp 0x1002e18
push 0
lea eax, [ebp - 8]
push eax
call fcn.0100502a
jmp 0x1002e2c
cmp dword [ebp - 8], 8
jl 0x1002eae
lea eax, [ebp - 0xc]
push eax
push 0x10012c0
push 3
push 0
push 0x10012d0
call dword [sym.imp.ole32.dll_CoCreateInstance]
jmp 0x1002e8b
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push edi
push edi
push eax
call dword [ecx + 0xc]
jmp 0x1002e9a
call fcn.010019ad
mov esi, eax
call fcn.01005ec4
jmp 0x1002ed2
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor esi, esi
push edi
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
call fcn.01001f52
jmp 0x1002d6a
push 7
pop ecx
push esi
xor eax, eax
push 0x1005e1a
mov edi, 0x102e038
rep stosd dword es:[edi], eax
push 0x10011ec
mov dword [0x102e038], 0x30
mov dword [0x102e03c], 2
mov dword [0x102e044], esi
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerExW]
jmp 0x1002dc3
cmp dword [0x102e224], esi
je 0x1001acb
push esi
push esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
jmp 0x1002e02
test eax, eax
jl 0x1002d77
push esi
push dword [ebp - 4]
call fcn.01008c2b
push 1
push 0x102e270
mov ecx, 0x102e280
call fcn.01006e41
cmp eax, esi
mov ebx, 0x4000000
jge 0x1002da2
push 0x100321c
push 1
push eax
push ebx
call fcn.01007e2b
add esp, 0x10
cmp dword [0x102e270], esi
je 0x1001b07
push 0x10031a0
push esi
push esi
push ebx
call fcn.01007e2b
add esp, 0x10
jmp 0x1001b07
mov dword [0x102e008], eax
cmp eax, esi
jne 0x1001b0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, esi
jle 0x1002de6
and eax, 0xffff
or eax, 0x80070000
cmp eax, esi
jge 0x1002dfb
push 0x1003130
push 1
push eax
push ebx
call fcn.01007e2b
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, eax
test esi, esi
jge 0x1001266
push 0x1003114
push 1
jmp 0x1002ec3
mov esi, eax
test esi, esi
jge 0x1001286
push 0x10030f0
jmp 0x1002ec2
mov esi, eax
xor eax, eax
cmp esi, eax
jge 0x1002e3e
push 0x10030d4
jmp 0x1002ec2
cmp dword [ebp - 8], 9
jl 0x1001296
push eax
push eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
test eax, eax
jne 0x1001296
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1002e70
and eax, 0xffff
or eax, 0x80070000
test eax, eax
jge 0x1001296
push 0x1003090
push edi
push eax
push ebx
call fcn.01007e2b
add esp, 0x10
jmp 0x1001296
test eax, eax
jge 0x10012e0
push 0x1003040
jmp 0x1002ea3
test eax, eax
jge 0x1002eae
push 0x1002ff8
push edi
push eax
push ebx
call fcn.01007e2b
add esp, 0x10
call fcn.01002b71
mov esi, eax
test esi, esi
jge 0x1001997
push 0x1002fcc
push edi
push esi
push ebx
call fcn.01007e2b
add esp, 0x10
jmp 0x100199e
xor edi, edi
cmp dword [ebp - 4], edi
je 0x1002ee1
push dword [ebp - 4]
call fcn.01001c35
mov eax, dword [ebp - 0xc]
cmp eax, edi
je 0x1002eee
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x10], edi
je 0x1002ef9
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [0x102e008], edi
je 0x1002f6d
push 7
mov edx, 0x102e038
pop ecx
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov edi, esi
push edx
push dword [0x102e008]
mov esi, 0xffff
and edi, esi
mov dword [0x102e038], 0x30
mov dword [0x102e03c], 1
mov dword [0x102e044], edi
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x1002f66
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1002f56
and eax, esi
or eax, 0x80070000
test eax, eax
jge 0x1002dfb
push 0x1002f80
jmp 0x1002def
and dword [0x102e008], 0
call fcn.01007a94
pop edi
pop esi
pop ebx
leave
ret 8