Function at 0x100146c2
Capabilities:
Contain obfuscated stackstrings
Query service configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007eacc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
push ebx
push esi
push edi
mov dword [ebp - 0x154], ecx
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x13c], eax
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
jne 0x10014725
jmp 0x10014978
push 0x1000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x14c], eax
lea edx, [ebp - 0x10]
push edx
push 0x1000
mov eax, dword [ebp - 0x14c]
push eax
mov ecx, dword [ebp - 0x148]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jne 0x10014769
jmp 0x10014978
mov edx, dword [ebp - 0x14c]
mov eax, dword [edx + 0xc]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
push eax
mov ecx, dword [ebp - 0x14c]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
add eax, 0x1c7
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0x14c]
cmp dword [ecx + 4], 2
jne 0x100147b2
mov edx, dword [ebp + 8]
mov dword [edx + 0x2d0], 1
jmp 0x1001482b
mov eax, dword [ebp - 0x14c]
cmp dword [eax + 4], 4
jne 0x100147cd
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x2d0], 2
jmp 0x1001482b
mov edx, dword [ebp - 0x14c]
cmp dword [edx + 4], 0
jne 0x100147e8
mov eax, dword [ebp + 8]
mov dword [eax + 0x2d0], 3
jmp 0x1001482b
mov ecx, dword [ebp - 0x14c]
cmp dword [ecx + 4], 3
jne 0x10014803
mov edx, dword [ebp + 8]
mov dword [edx + 0x2d0], 4
jmp 0x1001482b
mov eax, dword [ebp - 0x14c]
cmp dword [eax + 4], 1
jne 0x1001481e
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x2d0], 5
jmp 0x1001482b
mov edx, dword [ebp + 8]
mov dword [edx + 0x2d0], 6
push str.LocalSystem
mov eax, dword [ebp - 0x14c]
mov ecx, dword [eax + 0x1c]
push ecx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x10014855
mov edx, dword [ebp + 8]
mov dword [edx + 0x2d4], 1
jmp 0x10014862
mov eax, dword [ebp + 8]
mov dword [eax + 0x2d4], 2
pushal
add eax, eax
add eax, eax
push ecx
push ecx
push edx
push eax
push ecx
push ebx
push ecx
push edx
push edx
and eax, eax
pop ebx
pop eax
pop edx
add eax, eax
pop ecx
pop eax
pop edx
pop ebx
pop eax
pop edx
popal
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x144]
call fcn.10011190
mov dword [ebp - 4], 0
mov byte [ebp - 0x34], 0x53
mov byte [ebp - 0x33], 0x59
mov byte [ebp - 0x32], 0x53
mov byte [ebp - 0x31], 0x54
mov byte [ebp - 0x30], 0x45
mov byte [ebp - 0x2f], 0x4d
mov byte [ebp - 0x2e], 0x5c
mov byte [ebp - 0x2d], 0x43
mov byte [ebp - 0x2c], 0x75
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x6e
mov byte [ebp - 0x27], 0x74
mov byte [ebp - 0x26], 0x43
mov byte [ebp - 0x25], 0x6f
mov byte [ebp - 0x24], 0x6e
mov byte [ebp - 0x23], 0x74
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x6f
mov byte [ebp - 0x20], 0x6c
mov byte [ebp - 0x1f], 0x53
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x5c
mov byte [ebp - 0x1b], 0x53
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], 0x72
mov byte [ebp - 0x18], 0x76
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0x13], 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x34]
push edx
push 0x1008c370
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x138]
push ecx
lea ecx, [ebp - 0x144]
call fcn.100112b6
mov edx, dword [ebp + 8]
add edx, 0xc3
push edx
push str.Description
lea ecx, [ebp - 0x144]
call fcn.100115fd
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.1001123e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4