Function at 0x10002980
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x244
mov eax, dword [0x10033d40]
xor eax, esp
mov dword [esp + 0x240], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
push esi
lea edx, [esp + 0x44]
push edi
sub edx, eax
xor edi, edi
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, di
jne 0x100029b0
push 0x10002c30
lea ecx, [esp + 0x4c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
cmp eax, edi
mov dword [0x10039d54], eax
je 0x10002bbf
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov esi, dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov eax, 2
lea edx, [esp + 0x2c]
mov dword [0x10039d50], eax
mov dword [esp + 0x30], eax
mov eax, dword [0x10039d54]
push edx
mov ebx, 0xbb8
push eax
mov dword [esp + 0x34], 0x10
mov dword [esp + 0x3c], 7
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], 1
mov dword [esp + 0x4c], ebx
call esi
mov edx, dword [0x10039d54]
lea ecx, [esp + 0x10]
mov eax, 4
push ecx
push edx
mov dword [esp + 0x18], 0x10
mov dword [0x10039d50], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], ebx
call esi
mov esi, dword [ebp + 8]
cmp esi, 1
jle 0x10002a95
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
lea edx, [esp + 0x48]
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, di
jne 0x10002a80
lea ecx, [esp + 0x48]
jmp 0x10002a9a
mov ecx, str.RenMinSP.dll
cmp esi, 2
mov eax, str.Interact
jg 0x10002aa9
mov eax, 0x1002c2dd
push eax
push ecx
push str.SvcHostDLL:_RealService_called__s__s
call fcn.100036f0
add esp, 0xc
call fcn.10002670
mov esi, eax
call fcn.100028f0
mov eax, dword [0x1003a538]
cmp eax, edi
jne 0x10002aff
push 0x30
call fcn.10007491
add esp, 4
cmp eax, edi
je 0x10002af8
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x18], edi
mov dword [eax + 0x20], edi
mov dword [eax + 0x24], edi
mov dword [eax + 0x14], edi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], edi
jmp 0x10002afa
xor eax, eax
mov dword [0x1003a538], eax
mov ebx, eax
call fcn.10002670
add eax, 0x58
cmp dword [eax + 0x18], 8
jb 0x10002b14
mov eax, dword [eax + 4]
jmp 0x10002b17
add eax, 4
push eax
push 1
push str.DriverProtect
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
jne 0x10002b34
call fcn.10001380
call section..text
mov esi, dword [0x1003a538]
cmp esi, edi
jne 0x10002b78
push 0x30
call fcn.10007491
add esp, 4
cmp eax, edi
je 0x10002b6e
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x18], edi
mov dword [eax + 0x20], edi
mov dword [eax + 0x24], edi
mov dword [eax + 0x14], edi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], edi
jmp 0x10002b70
xor eax, eax
mov esi, eax
mov dword [0x1003a538], esi
mov ebx, esi
call fcn.100010a0
mov ecx, ebx
call fcn.10001120
call fcn.100019e0
push ebx
call fcn.10001e10
mov ecx, ebx
call fcn.10001f40
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xea60
call esi
push 0x2710
call esi
mov eax, dword [0x10039d50]
cmp eax, 3
je 0x10002bbf
cmp eax, 1
jne 0x10002b39
mov ecx, dword [esp + 0x24c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10010273
mov esp, ebp
pop ebp
ret