Function at 0x49c210
Capabilities:
Start service

Disassembly:
push ebp
mov ecx, 0x4e802c
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x21c
call fcn.00490d90
mov dword [esp], 0x4014b0
call fcn.00401320
lea ecx, [ebp - 0x1f8]
mov dword [esp], str.bdservicehost.exe
call fcn.0049bdf0
lea ecx, [ebp - 0x1e0]
sub esp, 4
mov dword [esp], str.EPProtectedService.exe
call fcn.0049bdf0
lea ecx, [ebp - 0x1c8]
sub esp, 4
mov dword [esp], str.EPIntegrationService.exe
call fcn.0049bdf0
lea ecx, [ebp - 0x1b0]
sub esp, 4
mov dword [esp], str.EPSecurityService.exe
call fcn.0049bdf0
lea ecx, [ebp - 0x198]
sub esp, 4
mov dword [esp], str.EPUpdateService.exe
call fcn.0049bdf0
lea ecx, [ebp - 0x180]
sub esp, 4
mov dword [esp], str.bdredline.exe
call fcn.0049bdf0
lea ecx, [ebp - 0x168]
sub esp, 4
mov dword [esp], str.epconsole.exe
call fcn.0049bdf0
lea ecx, [ebp - 0x150]
sub esp, 4
mov dword [esp], str.BDFsTray.exe
call fcn.0049bdf0
lea ecx, [ebp - 0x138]
sub esp, 4
mov dword [esp], str.BDFileServer.exe
call fcn.0049bdf0
lea ecx, [ebp - 0x120]
sub esp, 4
mov dword [esp], str.bdemsrv.exe
call fcn.0049bdf0
lea ecx, [ebp - 0x108]
sub esp, 4
mov dword [esp], str.BDAvScanner.exe
call fcn.0049bdf0
lea ecx, [ebp - 0xf0]
sub esp, 4
mov dword [esp], str.Arrakis3.exe
call fcn.0049bdf0
lea ecx, [ebp - 0xd8]
sub esp, 4
mov dword [esp], str.bdlived2.exe
call fcn.0049bdf0
lea ecx, [ebp - 0xc0]
sub esp, 4
mov dword [esp], str.BDLogger.exe
call fcn.0049bdf0
lea ecx, [ebp - 0xa8]
sub esp, 4
mov dword [esp], str.bdlserv.exe
call fcn.0049bdf0
lea ecx, [ebp - 0x90]
sub esp, 4
mov dword [esp], str.bdregsvr2.exe
call fcn.0049bdf0
lea ecx, [ebp - 0x78]
sub esp, 4
mov dword [esp], str.BDScheduler.exe
call fcn.0049bdf0
lea ecx, [ebp - 0x60]
sub esp, 4
mov dword [esp], str.BDStatistics.exe
call fcn.0049bdf0
lea ecx, [ebp - 0x48]
sub esp, 4
mov dword [esp], str.npemclient3.exe
call fcn.0049bdf0
lea ecx, [ebp - 0x30]
sub esp, 4
mov dword [esp], str.ephost.exe
call fcn.0049bdf0
sub esp, 4
mov dword [0x4e8020], 0
mov dword [0x4e8024], 0
mov dword [esp], 0x1e0
mov dword [0x4e8028], 0
call fcn.0049ad50
mov ebx, eax
mov dword [ebp - 0x210], eax
mov dword [0x4e8020], eax
lea edi, [ebp - 0x1f8]
add eax, 0x1e0
mov dword [0x4e8028], eax
test ebx, ebx
je 0x49c0e7
mov ecx, dword [edi]
mov esi, dword [edi + 4]
lea eax, [ebx + 8]
mov dword [ebx], eax
add esi, esi
mov edx, ecx
mov dword [ebp - 0x20c], ecx
add edx, esi
je 0x49c0c0
test ecx, ecx
jne 0x49c0c0
mov dword [esp], 0x4a4064
call fcn.00494d90
lea esi, [esi]
sar esi, 1
cmp esi, 7
mov edx, esi
mov dword [ebp - 0x1fc], esi
ja 0x49c135
cmp edx, 1
je 0x49c180
test esi, esi
mov ecx, eax
jne 0x49c15b
xor eax, eax
mov dword [ebx + 4], edx
mov word [ecx + edx*2], ax
lea eax, [ebp - 0x18]
add edi, 0x18
add ebx, 0x18
cmp edi, eax
jne 0x49c091
mov dword [0x4e8024], ebx
lea esi, [esi]
mov edx, dword [eax - 0x18]
lea ebx, [eax - 0x18]
sub eax, 0x10
cmp edx, eax
je 0x49c115
mov dword [esp], edx
call fcn.0049ad10
lea edi, [ebp - 0x1f8]
mov eax, ebx
cmp ebx, edi
jne 0x49c100
mov dword [esp], 0x401460
call fcn.00401320
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x1fc]
mov dword [esp + 4], 0
mov ecx, ebx
mov dword [esp], eax
call fcn.0048c290
mov edx, dword [ebp - 0x1fc]
sub esp, 8
mov dword [ebx], eax
mov dword [ebx + 8], edx
mov dword [esp + 8], esi
mov esi, dword [ebp - 0x20c]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.00415080
mov edx, dword [ebp - 0x1fc]
mov ecx, dword [ebx]
jmp 0x49c0de
mov esi, dword [ebp - 0x20c]
movzx ecx, word [esi]
mov word [ebx + 8], cx
mov ecx, eax
jmp 0x49c0de
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x58
call fcn.0040b030
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
call fcn.0041be70
test al, al
je 0x49c474
mov dword [esp + 8], 0x24
mov dword [esp + 4], str.___Driver_initialized_in_the_system
mov dword [esp], 0x4a37a0
call fcn.00494480
mov dword [esp], 0x4a37a0
call fcn.00495760
mov eax, dword [ebp - 0x34]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.ADVAPI32.DLL_StartServiceW
sub esp, 0xc
test eax, eax
je 0x49c4d3
mov dword [esp + 8], 0x15
mov dword [esp + 4], str.___Driver_is_running
mov dword [esp], 0x4a37a0
call fcn.00494480
mov dword [esp], 0x4a37a0
call fcn.00495760
mov dword [esp + 4], 0x4014c0
mov dword [esp], 2
call sub.msvcrt.dll_signal
mov dword [esp + 8], 0x15
mov dword [esp + 4], str.___Moonblood_Started
mov dword [esp], 0x4a37a0
call fcn.00494480
mov dword [esp], 0x4a37a0
call fcn.00495760
lea esi, [esi]
movzx eax, byte [0x4a2004]
test al, al
je 0x49c4ad
mov edx, dword [0x4e8020]
mov ebx, dword [0x4e8024]
cmp edx, ebx
je 0x49c300
mov edi, edx
jmp 0x49c32a
add edi, 0x18
cmp ebx, edi
je 0x49c300
mov dword [esp], edi
call fcn.00401590
test eax, eax
je 0x49c323
xor ecx, ecx
mov dword [ebp + ecx - 0x30], 0
add ecx, 4
cmp ecx, 0x18
jb 0x49c338
mov dword [ebp - 0x2c], eax
mov eax, dword [str..TfSysMon]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileW
sub esp, 0x1c
cmp eax, 0xffffffff
mov esi, eax
je 0x49c323
lea eax, [ebp - 0x3c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x30]
mov dword [esp + 4], 0xb4a00404
mov dword [esp], esi
mov dword [esp + 8], eax
call sub.KERNEL32.dll_DeviceIoControl
sub esp, 0x20
test eax, eax
je 0x49c323
mov dword [esp], esi
call sub.KERNEL32.dll_CloseHandle
mov esi, dword [edi]
sub esp, 4
mov dword [esp], str.___Killed_process:
call sub.msvcrt.dll_wcslen
mov dword [esp + 4], str.___Killed_process:
mov dword [esp + 8], eax
mov dword [esp], 0x4a3a20
call fcn.00494810
test esi, esi
je 0x49c4b1
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp], 0x4a3a20
call fcn.00494810
mov eax, dword [0x4a3a20]
mov eax, dword [eax - 0xc]
mov ecx, dword [eax + 0x4a3a9c]
test ecx, ecx
je 0x49c510
mov eax, dword [ecx]
mov dword [esp], 0xa
call dword [eax + 0x28]
sub esp, 4
movzx eax, ax
mov ecx, 0x4a3a20
mov dword [esp], eax
call fcn.00476440
sub esp, 4
mov ecx, eax
call fcn.00476610
jmp 0x49c323
mov dword [esp + 8], 0x1f
mov dword [esp + 4], str.____Failed_to_initialize_driver
mov dword [esp], 0x4a3660
call fcn.00494480
mov dword [esp], 0x4a3660
call fcn.00495760
mov eax, 1
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
xor eax, eax
jmp 0x49c4a1
mov eax, dword [0x4a3a20]
mov ecx, dword [eax - 0xc]
add ecx, 0x4a3a20
mov eax, dword [ecx + 0x14]
or eax, 1
mov dword [esp], eax
call fcn.00493190
push ecx
jmp 0x49c430
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x420
je 0x49c295
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.ADVAPI32.DLL_CloseServiceHandle
push eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.ADVAPI32.DLL_CloseServiceHandle
push edx
mov dword [esp + 8], 0x1a
mov dword [esp + 4], str.____Failed_to_start_driver
jmp 0x49c484
call fcn.00494b80
lea esi, [esi]
lea edi, [edi]
jmp 0x49be90