Function at 0x401910
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
sub esp, 0x2c
push ebp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
mov dword [esp + 4], ebp
test ebp, ebp
jne 0x40193b
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xffffffff
pop ebp
add esp, 0x2c
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push edi
xor edi, edi
push esi
jmp 0x401950
push 0xf01ff
push str.rmtserver
push ebp
call ebx
mov esi, eax
test esi, esi
jne 0x40198c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jl 0x401950
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [esi - 2]
pop esi
pop edi
pop ebx
pop ebp
add esp, 0x2c
ret
lea eax, [esp + 0x14]
push eax
push 0x24
lea ecx, [esp + 0x20]
push ecx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x4019c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebp
call esi
pop esi
pop edi
pop ebx
mov eax, 0xfffffffd
pop ebp
add esp, 0x2c
ret
mov eax, dword [esp + 0x1c]
cmp eax, 1
je 0x4019eb
cmp eax, 3
je 0x4019eb
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebp
call esi
pop esi
pop edi
pop ebx
mov eax, 0xfffffffc
pop ebp
add esp, 0x2c
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
cmp dword [esp + 0x1c], 3
mov ebp, dword [esp + 0x2c]
mov edi, eax
jne 0x401a69
mov eax, 0xcccccccd
mul dword [esp + 0x30]
shr edx, 3
cmp edx, 0x3e8
jae 0x401a1b
mov edx, 0x3e8
jmp 0x401a28
cmp edx, 0x2710
jbe 0x401a28
mov edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x14]
push edx
push 0x24
lea eax, [esp + 0x20]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x401a9b
cmp dword [esp + 0x2c], ebp
jbe 0x401a58
call ebx
mov ebp, dword [esp + 0x2c]
mov edi, eax
jmp 0x401a62
call ebx
sub eax, edi
cmp eax, dword [esp + 0x30]
ja 0x401abe
cmp dword [esp + 0x1c], 3
je 0x401a00
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x401adb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
pop esi
pop edi
pop ebx
mov eax, 0xfffffff9
pop ebp
add esp, 0x2c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
pop esi
pop edi
pop ebx
mov eax, 0xfffffffb
pop ebp
add esp, 0x2c
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
pop esi
pop edi
pop ebx
mov eax, 0xfffffffa
pop ebp
add esp, 0x2c
ret
lea ecx, [esp + 0x14]
push ecx
push 0x24
lea edx, [esp + 0x20]
push edx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x401b17
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
pop esi
pop edi
pop ebx
mov eax, 0xfffffff8
pop ebp
add esp, 0x2c
ret
call ebx
cmp dword [esp + 0x1c], 2
mov ebp, dword [esp + 0x2c]
mov edi, eax
jne 0x401ba1
jmp 0x401b30
mov eax, 0xcccccccd
mul dword [esp + 0x30]
shr edx, 3
cmp edx, 0x3e8
jae 0x401b4b
mov edx, 0x3e8
jmp 0x401b58
cmp edx, 0x2710
jbe 0x401b58
mov edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x14]
push ecx
push 0x24
lea edx, [esp + 0x20]
push edx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x401b9b
cmp dword [esp + 0x2c], ebp
jbe 0x401b88
call ebx
mov ebp, dword [esp + 0x2c]
mov edi, eax
jmp 0x401b92
call ebx
sub eax, edi
cmp eax, dword [esp + 0x30]
ja 0x401ba1
cmp dword [esp + 0x1c], 2
je 0x401b30
jmp 0x401ba1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x1c], 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jne 0x401bc2
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
pop esi
pop edi
pop ebx
xor eax, eax
pop ebp
add esp, 0x2c
ret
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
pop esi
pop edi
pop ebx
mov eax, 0xfffffff7
pop ebp
add esp, 0x2c
ret