Function at 0x100d4ee
Capabilities:
Create service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
xor ebx, ebx
mov byte [ebp - 0x104], bl
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
mov byte [ebp - 0x208], bl
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
mov byte [ebp - 0x30c], bl
pop ecx
xor eax, eax
lea edi, [ebp - 0x30b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x1004200
push ebx
stosb byte es:[edi], al
call fcn.0100bef0
push 0x10043ec
push ebx
call fcn.0100bef0
add esp, 0x10
cmp dword [ebp + 8], ebx
je 0x100d561
push dword [ebp + 8]
jmp 0x100d577
push dword [ebp + 0x10]
lea eax, [ebp - 0x30c]
push eax
call fcn.0100d43e
lea eax, [ebp - 0x30c]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x104]
push eax
call esi
cmp dword [ebp + 0xc], ebx
je 0x100d590
push dword [ebp + 0xc]
jmp 0x100d597
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
call esi
lea eax, [ebp - 0x30c]
push eax
push 0x10043d4
push ebx
call fcn.0100bef0
lea eax, [ebp - 0x104]
push eax
push 0x10043c0
push ebx
call fcn.0100bef0
lea eax, [ebp - 0x208]
push eax
push 0x10043ac
push ebx
call fcn.0100bef0
push dword [ebp + 0x10]
push 0x1004398
push ebx
call fcn.0100bef0
add esp, 0x30
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0x10]
mov esi, 0xf01ff
push 1
push 3
push 1
push esi
lea ecx, [ebp - 0x208]
push ecx
lea ecx, [ebp - 0x104]
push ecx
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
jne 0x100d6b5
call edi
cmp eax, 0x431
jne 0x100d69e
lea eax, [ebp - 0x104]
push eax
push 0x1004378
push ebx
call fcn.0100bef0
push 0x1004344
push ebx
call fcn.0100bef0
add esp, 0x14
push esi
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp + 8], eax
cmp eax, ebx
lea eax, [ebp - 0x104]
push eax
jne 0x100d68e
push 0x1004324
push ebx
call fcn.0100bef0
add esp, 0xc
xor eax, eax
jmp 0x100d78a
push 0x100430c
push ebx
call fcn.0100bef0
add esp, 0xc
jmp 0x100d6b5
call fcn.0100bf99
push eax
call edi
push eax
push 0x10042e4
push ebx
call fcn.0100bef0
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
push 0x10042c0
push ebx
call fcn.0100bef0
add esp, 0xc
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
cmp eax, ebx
mov dword [ebp + 0x10], eax
je 0x100d6f3
lea eax, [ebp - 0x104]
push eax
push 0x10042a4
push ebx
call fcn.0100bef0
add esp, 0xc
jmp 0x100d73b
call edi
cmp eax, 0x420
jne 0x100d71a
lea eax, [ebp - 0x104]
push eax
push 0x1004280
push ebx
call fcn.0100bef0
add esp, 0xc
mov dword [ebp + 0x10], 1
jmp 0x100d73b
call fcn.0100bf99
push eax
call edi
push eax
lea eax, [ebp - 0x104]
push eax
push 0x1004254
push ebx
call fcn.0100bef0
add esp, 0x14
mov dword [ebp + 0x10], ebx
push dword [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp + 0xc]
call esi
cmp dword [ebp + 0x10], ebx
mov eax, 0x10032f0
jne 0x100d75a
mov eax, 0x10032e8
push eax
push 0x1004228
push ebx
call fcn.0100bef0
add esp, 0xc
cmp dword [ebp + 0x10], ebx
jne 0x100d787
push 0x100420c
push 0x229
push 0x10041ac
push 0x1004204
call fcn.0100bf40
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret 0xc