Function at 0x10025060
Capabilities:
Check for software breakpoints
Create service
Delete service
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
mov eax, dword [0x1003e620]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xd0], eax
mov eax, esi
imul eax, eax, 0xba0
push edi
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xcc], eax
cmp esi, eax
ja 0x100256af
mov edi, dword [ebp - 0xb4]
lea ecx, [ecx]
cmp esi, 0xa2f8
ja 0x10025216
je 0x100251d2
cmp esi, 0x3678
ja 0x10025140
je 0x10025131
mov eax, esi
sub eax, 0x38
je 0x100250f3
sub eax, 0x6a
je 0x10025643
sub eax, 0x2b
jne 0x10025692
push ebx
call fcn.1002711b
add esp, 4
jmp 0x10025692
xor eax, eax
mov byte [ebp - 0x9e], 1
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
jmp 0x10025692
mov dword [ebp - 0xec], 0x18
jmp 0x10025692
cmp esi, 0x6cb8
je 0x1002519c
cmp esi, 0x9d92
jne 0x10025692
test ebx, ebx
je 0x100256c6
cmp dword [ebp - 0xd0], 0
je 0x10025598
mov eax, dword [edi + 8]
push 0
push eax
push 0x2c
call fcn.100211e0
add esp, 0xc
test al, al
je 0x10025707
mov ecx, dword [edi + 8]
push 0
push 0
push ecx
push 0
push 0
push 0x4a
call fcn.10024cf0
add esp, 0x18
jmp 0x10025692
push 0
push 0
push 0xdf
call fcn.10005c60
add esp, 0xc
mov dword [ebp - 0xbc], eax
xor eax, eax
mov dword [ebp - 0xb8], edx
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xac], eax
jmp 0x10025692
mov eax, dword [ebp - 0xf4]
lea edx, [ebp - 0xa4]
push edx
push eax
lea ecx, [ebp - 0xec]
push ecx
lea edx, [ebp - 0xc4]
push edx
mov dword [ebp - 0xd4], 0
call sub.ADVAPI32.dll_LsaOpenPolicy
cmp dword [ebp - 0xa4], 0
jne 0x10025692
mov byte [ebp - 0x9e], 0
jmp 0x10025692
cmp esi, 0x1d772
ja 0x10025612
je 0x1002555f
cmp esi, 0xd938
je 0x10025254
cmp esi, 0x13a82
jne 0x10025692
push 0
lea eax, [edi + 0x18]
push 0xa4
push eax
call fcn.1001eaa0
add esp, 0xc
jmp 0x10025692
cmp byte [ebp - 0x9e], 0
je 0x10025295
mov edx, dword [ebp - 0xd4]
mov eax, dword [ebp - 0xa4]
lea ecx, [ebp - 0xac]
push ecx
push 1
push edx
push eax
call sub.ADVAPI32.dll_LsaQueryTrustedDomainInfo
mov eax, dword [ebp - 0xac]
test eax, eax
je 0x10025289
push eax
call sub.ADVAPI32.dll_LsaFreeMemory
mov ecx, dword [ebp - 0xa4]
push ecx
call sub.ADVAPI32.dll_LsaClose
mov eax, dword [ebp - 0xbc]
sub eax, dword [0x10040168]
mov edx, dword [ebp - 0xb8]
sbb edx, dword [0x1004016c]
mov dword [ebp - 0xf8], edx
js 0x10025692
jg 0x100252c6
cmp eax, 0xe10
jb 0x10025692
mov eax, dword [ebp - 0xbc]
sub eax, dword [0x10040160]
mov ecx, dword [ebp - 0xb8]
sbb ecx, dword [0x10040164]
mov dword [ebp - 0xf8], ecx
js 0x10025692
jg 0x100252f7
cmp eax, 0x12c
jb 0x10025692
xor edi, edi
lea ebx, [edi + 0xa]
lea esp, [esp]
cmp edi, 0xb4
ja case.0x10025313.1
movzx edx, byte [edi + 0x10025774]
jmp dword [edx*4 + 0x10025748]
push 4
lea eax, [ebp - 8]
push 0x10039cd4
push eax
mov word [ebp - 9], 0x76
call fcn.10026900
add esp, 0xc
mov byte [ebp - 0x1c], 0
jmp case.0x10025313.1
call dword [0x1004018c]
cmp al, 1
jne case.0x10025313.1
mov esi, 0xe9
nop
cmp esi, 0x91a0
ja 0x100253e3
je 0x100253d8
cmp esi, 0xe9
je 0x100253bd
cmp esi, 0x3126
je 0x10025388
cmp esi, 0x6163
jne 0x10025426
mov ecx, 0x74
mov word [ebp - 0x24], cx
jmp 0x10025426
mov edx, dword [str.f:dd_vctoolscrt_bld_self_x86crt_srcxmutex.cpp]
mov ax, word [0x10039c74]
push 2
mov dword [ebp - 0x32], edx
lea edx, [ebp - 0x38]
xor ecx, ecx
push 0x10039c66
push edx
mov word [ebp - 0x2e], ax
mov word [ebp - 0x2c], cx
call fcn.100289f5
add esp, 0xc
mov dword [ebp - 0x28], 0x6e0075
jmp 0x10025426
mov eax, dword [0x10039bd0]
mov cx, word [0x10039bd4]
xor edx, edx
mov dword [ebp - 0x38], eax
mov word [ebp - 0x34], cx
mov word [ebp - 0x32], dx
jmp 0x10025426
mov eax, 0x58
mov word [ebp - 0x22], ax
jmp 0x10025426
cmp esi, 0xc1dd
je 0x1002540d
cmp esi, 0xf21a
jne 0x10025426
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ebp - 0xb8]
mov dword [0x10040168], ecx
mov dword [0x1004016c], edx
jmp 0x10025426
push 0x32
lea ecx, [ebp - 0x9c]
push ecx
lea edx, [ebp - 0x38]
xor eax, eax
push edx
mov word [ebp - 0x20], ax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
add esi, 0x303d
cmp esi, 0x1216e
jbe 0x10025350
jmp 0x1002553e
push 1
lea eax, [ebp - 0x1c]
push 0x10039b9e
push eax
call fcn.10027280
mov cx, word [0x10039b79]
mov dl, byte [0x10039b7b]
add esp, 0xc
mov word [ebp - 0x1b], cx
mov byte [ebp - 0x19], dl
jmp case.0x10025313.1
mov dword [ebp - 0x18], 0x70736944
mov byte [ebp - 0x14], 0x6c
jmp case.0x10025313.1
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0xb8]
mov dword [0x10040160], eax
mov dword [0x10040164], ecx
jmp case.0x10025313.1
mov edx, 0x65
mov dword [ebp - 0x10], 0x6d614e
mov word [ebp - 0xd], dx
jmp case.0x10025313.1
mov dword [ebp - 0xf0], 0
jmp case.0x10025313.1
mov cl, byte [0x10039b72]
mov ax, word [0x10039b70]
mov edx, 0x72
mov byte [ebp - 0xa], cl
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], dx
jmp case.0x10025313.1
mov eax, 0x7961
mov word [ebp - 0x13], ax
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x9d], 1
jmp case.0x10025313.1
push 0
mov eax, dword [ebp - 0xf0]
push 0
push 0
push 0
push 0
push 0
push 1
push 3
push 0x10
push 0xf01ff
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x10]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
jne 0x10025527
mov byte [ebp - 0x9d], al
jmp 0x1002553e
cmp byte [ebp - 0x9d], 0
je 0x1002553e
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0xa8]
add edi, 0x14
dec ebx
jne 0x10025300
mov edi, dword [ebp - 0xb4]
mov ebx, dword [ebp - 0xc8]
jmp 0x10025692
cmp dword [edi + 0xc], 0
je 0x100255da
mov esi, 0x39
lea ebx, [ebx]
mov eax, esi
sub eax, 0x39
je 0x100255af
dec eax
jne 0x100255d4
mov ecx, dword [ebp - 0xb4]
add ecx, 0x18
push 0x1c
push ecx
mov dword [ebp - 0xb0], 7
call fcn.1000a240
add esp, 8
mov eax, dword [ebp - 0xb0]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10027670
mov esp, ebp
pop ebp
ret
fstp dword gs:[edi]
push ecx
cld
push str.Completion_queue_should_be_empty
push 0x1003455f
push 0
push 0x1003455f
push 0x1003455c
push 2
call fcn.100021f0
add esp, 0x18
inc esi
cmp esi, 0x3b
jb 0x10025570
mov esi, dword [ebp - 0xb4]
add esi, 0x18
push 0x1c
push esi
call fcn.1000a240
push 0xdf
push 0
push esi
call fcn.100016e0
mov esi, dword [ebp - 0xa8]
mov edi, dword [ebp - 0xb4]
mov ebx, dword [ebp - 0xc8]
add esp, 0x14
jmp 0x10025692
cmp esi, 0x27462
je 0x1002565b
cmp esi, 0x31152
jne 0x10025692
sbb al, 0x42
sbb edx, 0xccb867
add byte [eax], al
lea esp, [esp]
cmp eax, 0xcc
je 0x10025598
inc eax
cmp eax, 0xcd
jb 0x10025630
mov edi, dword [ebp - 0xd0]
mov dword [ebp - 0xb4], edi
mov dword [ebp - 0xb0], 0
jmp 0x10025692
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x10025679
mov ecx, dword [edi]
push ecx
push ebx
call eax
add esp, 8
mov dword [ebp - 0xb0], eax
test eax, eax
jne 0x10025598
push 0xdf
lea edx, [edi + 0x38]
push 0
push edx
call fcn.100016e0
push edi
call fcn.100271f9
add esp, 0x10
mov eax, dword [ebp + 8]
imul eax, eax, 0xf8
add esi, eax
mov dword [ebp - 0xa8], esi
cmp esi, dword [ebp - 0xcc]
jbe 0x100250b0
mov eax, dword [ebp - 0xcc]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10027670
mov esp, ebp
pop ebp
ret
push str.set_AllowDrop
push 0x1003455f
push 0
push 0x1003455f
push 0x1003455c
push 2
call fcn.100021f0
add esp, 0x18
pop edi
mov dword [ebp - 0xb0], 2
mov eax, dword [ebp - 0xb0]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10027670
mov esp, ebp
pop ebp
ret
push str._Z23convert_ushort4_sat_rtnDv4_h
push 0x1003455f
push 0
push 0x1003455f
push 0x1003455c
push 2
call fcn.100021f0
mov ecx, dword [ebp - 4]
add esp, 0x18
pop edi
mov dword [ebp - 0xb0], 7
mov eax, dword [ebp - 0xb0]
pop esi
xor ecx, ebp
pop ebx
call fcn.10027670
mov esp, ebp
pop ebp
ret