Function at 0x100d280
Capabilities:
Query service status
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1cd4
call fcn.0100f990
mov eax, dword [0x1013050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
lea ecx, [esi + 6]
mov dword [ebp - 0x1cb8], edi
mov dword [ebp - 0x1cb4], esi
xor ebx, ebx
mov dword [ebp - 0x1ca8], ecx
push 0xf0000
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x1cb0], eax
test eax, eax
je 0x100d856
mov eax, dword [0x100458c]
mov dword [ebp - 0x458], eax
mov eax, dword [0x1004590]
mov dword [ebp - 0x454], eax
mov eax, dword [0x1004594]
mov dword [ebp - 0x450], eax
mov eax, dword [0x1004598]
mov dword [ebp - 0x44c], eax
mov eax, dword [0x100459c]
mov dword [ebp - 0x448], eax
mov ax, word [0x10045a0]
push 0x3fc
mov word [ebp - 0x444], ax
lea eax, [ebp - 0x442]
push 0
push eax
call sub.MSVCR100.dll_memset
add esi, 0x316
push 0x5c
push esi
call dword [sym.imp.MSVCR100.dll_wcsrchr]
add esp, 0x14
test eax, eax
je 0x100d344
lea esi, [eax + 2]
push esi
push 0x209
lea eax, [ebp - 0x458]
push eax
call fcn.01006f60
test eax, eax
jne 0x100d822
push 0x80000010
lea eax, [ebp - 0x458]
push eax
push dword [ebp - 0x1cb0]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x100d39c
push 0x80000010
push 0x1001430
push dword [ebp - 0x1cb0]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
je 0x100d7f8
mov eax, dword [0x10012f8]
mov dword [ebp - 0x1ca4], eax
mov eax, dword [0x1004648]
mov dword [ebp - 0x86c], eax
mov ax, word [0x100464c]
push 0x40c
mov word [ebp - 0x868], ax
lea eax, [ebp - 0x866]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
push 0x209
lea eax, [ebp - 0x86c]
push eax
call fcn.01006f60
test eax, eax
jne 0x100d81b
push dword [edi + 0x654]
lea eax, [ebp - 0x44]
push dword [edi + 0x114c]
push 0x1003014
push 0x20
push eax
call fcn.01007050
add esp, 0x14
test eax, eax
jne 0x100d814
mov ecx, 0xe
mov esi, 0x10046c0
lea edi, [ebp - 0x106c]
rep movsd dword es:[edi], dword [esi]
push 0x7c6
push eax
lea eax, [ebp - 0x1032]
push eax
movsw word es:[edi], word [esi]
call sub.MSVCR100.dll_memset
mov edi, dword [ebp - 0x1cb8]
add esp, 0xc
lea eax, [ebp - 0x1cac]
push eax
lea eax, [edi + 0x1d7fc]
push eax
mov dword [ebp - 0x1cac], 0
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
jne 0x100d80d
push dword [ebp - 0x1cac]
lea eax, [ebp - 0x106c]
push 0x400
push eax
call fcn.01006f60
mov esi, eax
lea eax, [ebp - 0x1cac]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
test esi, esi
jne 0x100d806
mov eax, dword [edi + 0x1d7f4]
and eax, 0xffffffde
push eax
mov eax, dword [ebp - 0x1cb4]
movzx eax, word [eax + 4]
push eax
push dword [edi + 0x1d80c]
lea eax, [edi + 0x1d810]
push dword [edi + 0x698]
push eax
push 0x100477c
lea eax, [ebp - 0x1c7c]
push 0x208
push eax
call fcn.01007050
add esp, 0x20
test eax, eax
jne 0x100d806
lea eax, [ebp - 0x1c7c]
push eax
push 0x400
lea eax, [ebp - 0x106c]
push eax
call fcn.01006f60
test eax, eax
jne 0x100d806
lea eax, [ebp - 0x1ca4]
mov dword [ebp - 0x1cd4], eax
mov dword [ebp - 0x1cd0], eax
lea eax, [ebp - 0x86c]
mov dword [ebp - 0x1ccc], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x1cc4], eax
lea eax, [ebp - 0x106c]
push eax
mov dword [ebp - 0x1cc0], eax
lea eax, [ebp - 0x44]
push eax
push 0x10045a4
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x1ca4]
push eax
push eax
push dword [ebp - 0x1ca8]
mov dword [ebp - 0x1cc8], 0x10045a4
push 0x10047a0
push 2
push 0x10130b0
call fcn.01007a00
add esp, 0x28
lea eax, [ebp - 0x1cd4]
push eax
push 6
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
jne 0x100d627
call edi
cmp eax, 0x420
jne 0x100d5b9
push 0x64
call esi
lea eax, [ebp - 0x1cd4]
push eax
push 6
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x100d596
jmp 0x100d627
call edi
call edi
push 0
push 0x400
mov esi, eax
lea eax, [ebp - 0x186c]
push eax
push 0x400
push esi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x100d607
lea eax, [ebp - 0x186c]
push eax
push esi
push 0x1004818
push 0x1004338
push 1
push 0x10130b0
call fcn.01007a00
add esp, 0x18
jmp 0x100d621
push esi
push 0x1004818
push 0x1004354
push 1
push 0x10130b0
call fcn.01007a00
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x1ca0], 0
mov dword [ebp - 0x1c9c], 0
mov dword [ebp - 0x1c98], 0
mov dword [ebp - 0x1c94], 0
mov dword [ebp - 0x1c90], 0
mov dword [ebp - 0x1c8c], 0
mov dword [ebp - 0x1c88], 0
mov dword [ebp - 0x1c84], 0
mov dword [ebp - 0x1c80], 0
lea eax, [ebp - 0x1cbc]
push eax
push 0x24
lea eax, [ebp - 0x1ca0]
push eax
push 0
push ebx
mov dword [ebp - 0x1cbc], 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x100d726
mov ecx, dword [ebp - 0x1c9c]
mov eax, ecx
sub eax, 2
je 0x100d6c3
sub eax, 2
je 0x100d6c3
sub eax, 0xc
jne 0x100d7aa
push 0x64
mov dword [ebp - 0x1ca0], 0
mov dword [ebp - 0x1c9c], 0
mov dword [ebp - 0x1c98], 0
mov dword [ebp - 0x1c94], 0
mov dword [ebp - 0x1c90], 0
mov dword [ebp - 0x1c8c], 0
mov dword [ebp - 0x1c88], 0
mov dword [ebp - 0x1c84], 0
mov dword [ebp - 0x1c80], 0
call esi
jmp 0x100d681
call edi
mov esi, eax
test esi, esi
jle 0x100d73a
and esi, 0xffff
or esi, 0x80070000
call edi
push 0
push 0x400
mov edi, eax
lea eax, [ebp - 0x186c]
push eax
push 0x400
push edi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x100d786
lea eax, [ebp - 0x186c]
push eax
push edi
push 0x1004848
push 0x1004338
push 1
push 0x10130b0
call fcn.01007a00
add esp, 0x18
jmp 0x100d7a0
push edi
push 0x1004848
push 0x1004354
push 1
push 0x10130b0
call fcn.01007a00
add esp, 0x14
test esi, esi
jne 0x100d7dd
mov ecx, dword [ebp - 0x1c9c]
push dword [ebp - 0x1c8c]
push dword [ebp - 0x1c84]
push dword [ebp - 0x1c94]
push ecx
push dword [ebp - 0x1c90]
push dword [ebp - 0x1ca8]
push 0x1004888
push 2
push 0x10130b0
call fcn.01007a00
add esp, 0x24
test ebx, ebx
jne 0x100d82e
mov edi, dword [ebp - 0x1cb8]
mov ecx, dword [ebp - 0x1ca8]
mov esi, dword [ebp - 0x1cb4]
jmp 0x100d2b8
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push 0x10045f0
jmp 0x100d827
push 0x1004730
jmp 0x100d827
push 0x10046fc
jmp 0x100d827
push 0x1004680
jmp 0x100d827
push 0x1004650
jmp 0x100d827
push 0x10045c0
mov ecx, edi
call fcn.0100d8b0
push dword [ebp - 0x1cb0]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
test ebx, ebx
je 0x100d889
push ebx
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100f899
mov esp, ebp
pop ebp
ret 4
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov esi, eax
test esi, esi
jle 0x100d86f
and esi, 0xffff
or esi, 0x80070000
push 0x1004548
mov ecx, edi
call fcn.0100d8b0
test esi, esi
je 0x100d889
or dword [section..data], 0x20008000
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100f899
mov esp, ebp
pop ebp
ret 4