Function at 0x432fd7
Capabilities:
Create service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x10b0
call fcn.004419d0
mov eax, dword [0x4424f4]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, ecx
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x10a8], ecx
mov ebx, edx
xor ecx, ecx
mov dword [ebp - 0x10a0], ebx
mov dword [ebp - 0x1098], eax
mov esi, ecx
mov dword [ebp - 0x109c], ecx
push edi
cmp eax, 0xffffffff
je 0x4330bd
test ebx, ebx
je 0x4330bd
lea eax, [ebp - 0x108c]
mov dword [ebp - 0x108c], ecx
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupGetLineTextW]
test eax, eax
je 0x433091
mov eax, dword [ebp - 0x108c]
xor ecx, ecx
inc eax
push 2
pop edx
mov dword [ebp - 0x108c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00440dea
mov edi, eax
mov dword [ebp - 0x10b0], edi
pop ecx
test edi, edi
je 0x4330bd
xor eax, eax
push eax
push dword [ebp - 0x108c]
push edi
push eax
push eax
push eax
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupGetLineTextW]
test eax, eax
jne 0x4330d0
push edi
call fcn.00440db7
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x4330a2
push 0x57
pop esi
test esi, esi
jle 0x4330ad
movzx esi, si
or esi, 0x80070000
push esi
push 0x408d40
push 4
call fcn.0041e83a
add esp, 0xc
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441130
leave
ret 0xc
push 0x4059f8
push edi
jmp 0x4334ef
push edi
push 0x408d80
push 4
call fcn.0041e83a
add esp, 0xc
xor eax, eax
push ebx
push eax
push edi
push dword [ebp - 0x1098]
call dword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x4334e7
push edi
push dword [ebp - 0x1098]
mov dword [ebp - 0x1088], 1
call dword [sym.imp.SETUPAPI.dll_SetupGetLineCountW]
mov edi, eax
mov ecx, edi
mov dword [ebp - 0x10ac], edi
call fcn.0041dc25
cmp edi, 1
jb 0x4334e7
mov edi, dword [ebp - 0x1088]
mov ecx, edi
call fcn.0041dd92
xor eax, eax
inc edi
push eax
push 0x105
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x1088], edi
push eax
push 1
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x4334cf
xor eax, eax
push eax
push 0x105
lea eax, [ebp - 0xc6c]
push eax
push 2
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x4334cf
xor eax, eax
push eax
push 0x105
lea eax, [ebp - 0xa5c]
push eax
push 3
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x4334cf
xor eax, eax
push eax
push 0x105
lea eax, [ebp - 0x63c]
push eax
push 4
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x4334cf
xor eax, eax
push eax
push 0x105
lea eax, [ebp - 0x84c]
push eax
push 5
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x4334cf
xor eax, eax
push eax
push 0x105
lea eax, [ebp - 0x42c]
push eax
push 6
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x4334cf
xor esi, esi
lea eax, [ebp - 0x1084]
push eax
lea edx, [ebp - 0x1090]
mov dword [ebp - 0x1090], esi
lea ecx, [ebp - 0x42c]
mov dword [ebp - 0x1084], esi
mov edi, esi
call fcn.00432a91
mov dword [ebp - 0x1080], esi
cmp dword [ebp - 0x1084], esi
jle 0x433301
mov esi, dword [ebp - 0x1090]
mov ecx, dword [esi]
xor eax, eax
mov dword [ebp - 0x1094], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x109c]
jne 0x433254
sub ecx, edx
sar ecx, 1
test ecx, ecx
jle 0x4332b0
mov edx, 0x208
cmp edi, edx
jge 0x4332f2
mov ecx, dword [ebp - 0x1094]
mov eax, dword [esi]
mov ax, word [eax + ecx*2]
mov word [ebp + edi*2 - 0x107c], ax
inc edi
inc ecx
mov dword [ebp - 0x1094], ecx
mov ecx, dword [esi]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x109c]
jne 0x433295
sub ecx, edx
sar ecx, 1
cmp dword [ebp - 0x1094], ecx
jl 0x43326b
mov edx, 0x208
cmp edi, edx
jge 0x4332f2
lea eax, [edi + edi]
inc edi
cmp eax, 0x410
jae 0x433512
xor ecx, ecx
add esi, 4
mov word [ebp + eax - 0x107c], cx
mov eax, dword [ebp - 0x1080]
inc eax
mov dword [ebp - 0x1080], eax
cmp eax, dword [ebp - 0x1084]
jl 0x433247
cmp edi, edx
jl 0x4332ff
mov esi, 0x80004005
mov dword [ebp - 0x1080], esi
jmp 0x43331f
xor esi, esi
add edi, edi
mov dword [ebp - 0x1080], esi
cmp edi, 0x410
jae 0x433512
xor eax, eax
mov word [ebp + edi - 0x107c], ax
xor eax, eax
mov edi, eax
cmp dword [ebp - 0x1084], eax
jle 0x433359
mov ebx, dword [ebp - 0x1090]
xor esi, esi
cmp dword [ebx + edi*4], esi
je 0x433344
push dword [ebx + edi*4]
call fcn.00440db7
pop ecx
mov dword [ebx + edi*4], esi
inc edi
cmp edi, dword [ebp - 0x1084]
jl 0x433333
mov esi, dword [ebp - 0x1080]
mov ebx, dword [ebp - 0x10a0]
mov eax, dword [ebp - 0x1090]
test eax, eax
je 0x43336a
push eax
call fcn.00440db7
pop ecx
test esi, esi
js 0x4334c9
push 0x10
lea eax, [ebp - 0x10a4]
push eax
lea eax, [ebp - 0x63c]
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
mov dword [ebp - 0x1080], eax
cmp dword [ebp + 0x10], 0xffffffff
jne 0x4333b3
push 0x10
lea eax, [ebp - 0x10a4]
push eax
lea eax, [ebp - 0x84c]
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
mov dword [ebp + 0x10], eax
push 0xf003f
xor eax, eax
xor edi, edi
push eax
push eax
inc edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x43345e
xor ecx, ecx
lea eax, [ebp - 0x107c]
push ecx
push 0x408c30
push eax
push ecx
push ecx
lea eax, [ebp - 0xa5c]
push eax
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 0xc6c]
push dword [ebp - 0x1080]
push 0xf003f
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
je 0x43342b
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x408ab0
lea eax, [ebp - 0x21c]
push eax
push 0x408c64
push 4
jmp 0x43344b
xor eax, eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x43343c
push 0x57
pop eax
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x408c80
push 2
call fcn.0041e83a
add esp, 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
jmp 0x433486
xor esi, esi
mov edi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x43346f
push 0x57
pop eax
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x408b10
push 2
call fcn.0041e83a
add esp, 0x10
test edi, edi
jne 0x4334b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x43349b
push 0x57
pop esi
test esi, esi
jle 0x4334aa
movzx esi, si
or esi, 0x80070000
test edi, edi
jne 0x4334b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4334c9
mov ecx, dword [ebp - 0x10a8]
lea eax, [ebp - 0x21c]
push eax
mov edx, 0x104
call fcn.0040c040
mov edi, dword [ebp - 0x1088]
push ebx
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupFindNextLine]
test eax, eax
je 0x4334e7
cmp edi, dword [ebp - 0x10ac]
jbe 0x433139
push 0x4059f8
xor eax, eax
push eax
call dword [sym.imp.msvcrt.dll_wcstok]
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x4330db
push dword [ebp - 0x10b0]
call fcn.00440db7
pop ecx
jmp 0x4330bd
call fcn.00441278
int3