Function at 0x1003d2b
Capabilities:
Modify service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x18]
push edi
or edi, 0xffffffff
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], ebx
cmp dword [ebp + 0x14], ebx
jbe 0x10041b6
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
mov dword [ebp - 0x20], 1
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
shl edi, 2
lea ebx, [edi + eax]
push 0x1001ae0
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1003ea2
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 0x20], eax
jae 0x1003ea2
cmp dword [ebp - 0x28], 0xffffffff
jne 0x1003dd2
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x30]
lea edi, [edi + eax + 4]
push 0x1001ad8
push dword [edi]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1003df1
or dword [ebp - 0x28], 0x10
jmp 0x1003e8f
push 0x1001acc
push dword [edi]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1003e09
or dword [ebp - 0x28], 0x20
jmp 0x1003e8f
push 0x1001ab8
push dword [edi]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1003e21
or dword [ebp - 0x28], 0x100
jmp 0x1003e8f
push 0x1001aa8
push dword [edi]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1003e36
or dword [ebp - 0x28], 1
jmp 0x1003e8f
push 0x1001a98
push dword [edi]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1003e4b
or dword [ebp - 0x28], 2
jmp 0x1003e8f
push 0x1001a90
push dword [edi]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1003e60
or dword [ebp - 0x28], 8
jmp 0x1003e8f
push 0x1001a84
push dword [edi]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1003e75
or dword [ebp - 0x28], 4
jmp 0x1003e8f
push 0x1001a78
push dword [edi]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x10041e1
or dword [ebp - 0x28], 0x2f309a20
cmp dword [ebp - 0x28], 0
jne 0x1004196
or dword [ebp - 0x28], 0xffffffff
jmp 0x1004196
push 0x1001a68
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1003f8c
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 0x20], eax
jae 0x1003f8c
mov eax, dword [ebp - 0x30]
lea edi, [edi + eax + 4]
push 0x1001a5c
push dword [edi]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1003edf
and dword [ebp - 0x34], eax
jmp 0x1004196
push 0x1001a4c
push dword [edi]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1003efa
mov dword [ebp - 0x34], 1
jmp 0x1004196
push 0x1001a40
push dword [edi]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1003f15
mov dword [ebp - 0x34], 2
jmp 0x1004196
push 0x1001a30
push dword [edi]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1003f30
mov dword [ebp - 0x34], 3
jmp 0x1004196
push 0x1001a1c
push dword [edi]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1003f4b
mov dword [ebp - 0x34], 4
jmp 0x1004196
push 0x1001a00
push dword [edi]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1003f6d
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x3c], 1
jmp 0x1004196
push 0x1001a78
push dword [edi]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x10041f5
mov dword [ebp - 0x34], 0xd0034911
jmp 0x1004196
push 0x10019f0
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1004039
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 0x20], eax
jae 0x1004039
mov eax, dword [ebp - 0x30]
lea edi, [edi + eax + 4]
push 0x10019e0
push dword [edi]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1003fcd
mov dword [ebp - 0x40], 1
jmp 0x1004196
push 0x10019d0
push dword [edi]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1003fe8
mov dword [ebp - 0x40], 2
jmp 0x1004196
push 0x10019c0
push dword [edi]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1003fff
and dword [ebp - 0x40], eax
jmp 0x1004196
push 0x10019ac
push dword [edi]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x100401a
mov dword [ebp - 0x40], 3
jmp 0x1004196
push 0x1001a78
push dword [edi]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x10041fc
mov dword [ebp - 0x40], 0xd74550
jmp 0x1004196
push 0x1001998
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x100405f
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 0x14]
jae 0x100405f
mov eax, dword [ebp - 0x30]
mov eax, dword [edi + eax + 4]
mov dword [ebp - 0x50], eax
jmp 0x1004196
push 0x1001988
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1004085
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 0x14]
jae 0x1004085
mov eax, dword [ebp - 0x30]
mov eax, dword [edi + eax + 4]
mov dword [ebp - 0x58], eax
jmp 0x1004196
push 0x100197c
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x10040bf
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 0x20], eax
jae 0x10040bf
mov eax, dword [ebp - 0x30]
push 0x1001974
push dword [edi + eax + 4]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1004196
lea eax, [ebp - 0x70]
mov dword [ebp - 0x48], eax
jmp 0x1004196
push 0x1001964
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x100412f
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 0x20], eax
jae 0x100412f
mov eax, dword [ebp - 0x30]
mov eax, dword [edi + eax + 4]
mov dword [ebp - 0x68], eax
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x10040e3
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
lea edi, [eax + 2]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 0x5c], ebx
test ebx, ebx
je 0x1004203
push dword [ebp - 0x68]
push edi
push ebx
call fcn.01002c37
jmp 0x1004127
cmp word [ebx], 0x2f
jne 0x1004125
xor eax, eax
mov word [ebx], ax
inc ebx
inc ebx
cmp word [ebx], 0
jne 0x100411a
jmp 0x1004196
push 0x1001958
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1004152
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 0x14]
jae 0x1004152
mov eax, dword [ebp - 0x30]
mov eax, dword [edi + eax + 4]
mov dword [ebp - 0x60], eax
jmp 0x1004196
push 0x1001944
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x1004175
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 0x14]
jae 0x1004175
mov eax, dword [ebp - 0x30]
mov eax, dword [edi + eax + 4]
mov dword [ebp - 0x64], eax
jmp 0x1004196
push 0x1001928
push dword [ebx]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x10041eb
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 0x14]
jae 0x10041eb
mov eax, dword [ebp - 0x30]
mov eax, dword [edi + eax + 4]
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x24]
inc dword [ebp - 0x20]
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x20]
cmp eax, dword [ebp + 0x14]
jb 0x1003d9d
mov esi, dword [ebp - 0x6c]
or edi, 0xffffffff
xor ebx, ebx
xor eax, eax
cmp dword [ebp - 0x34], edi
setne al
inc eax
inc eax
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [esi], eax
cmp eax, ebx
jne 0x1004219
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001530
jmp 0x100420f
push 0x1001ae0
call fcn.010031a6
call fcn.01003066
jmp 0x1004358
push 0x1001a68
jmp 0x10041e6
push 0x10019f0
jmp 0x10041e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10018e8
call fcn.010030bb
jmp 0x1004358
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x34], edi
je 0x1004295
lea ecx, [ebp - 0x44]
push ecx
push 4
lea ecx, [ebp - 0x38]
push ecx
push 3
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfig2W]
test eax, eax
jne 0x100425e
call ebx
mov dword [ebp - 0x2c], eax
cmp eax, 0x7c
jne 0x1004251
cmp dword [ebp - 0x3c], 1
je 0x1004251
and dword [ebp - 0x2c], 0
jmp 0x1004295
push dword [ebp - 0x2c]
push 0x1001888
jmp 0x1004350
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x38]
je 0x1004295
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x38]
push eax
push 3
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x100428a
call ebx
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x100428a
push eax
jmp 0x100434b
xor eax, eax
cmp dword [ebp - 0x3c], eax
sete al
mov dword [ebp - 0x38], eax
push dword [ebp - 0x4c]
push dword [ebp - 0x64]
push dword [ebp - 0x60]
push dword [ebp - 0x5c]
push dword [ebp - 0x48]
push dword [ebp - 0x58]
push dword [ebp - 0x50]
push dword [ebp - 0x40]
push dword [ebp - 0x34]
push dword [ebp - 0x28]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x10042c8
call ebx
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x1004319
push 0x100185c
call fcn.010030a2
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x10042fb
push 0xa
lea ecx, [ebp - 0x1c]
push ecx
push dword [eax]
call dword [sym.imp.msvcrt.dll__itow]
lea eax, [ebp - 0x1c]
add esp, 0xc
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
push 0x29
call fcn.01002c72
cmp dword [ebp - 0x28], edi
je 0x1004355
test dword [ebp - 0x28], 0x100
je 0x1004355
lea eax, [ebp - 0x54]
push eax
push 0x84
call fcn.01002c72
jmp 0x1004355
push dword [ebp - 0x2c]
push 0x100185c
call fcn.010030bb
cmp dword [ebp - 0x34], edi
je 0x1004355
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x38]
je 0x1004355
lea eax, [ebp - 0x38]
push eax
push 3
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1004355
call ebx
mov dword [ebp - 0x2c], eax
push eax
push 0x1001800
call fcn.010030bb
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010079a6
leave
ret 0x14