Function at 0x1000bf52
Capabilities:
Query service configuration
Query service status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x394
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push edi
mov edi, 0x400
xor ebx, ebx
push edi
push 0x40
mov dword [ebp - 8], ebx
call esi
push edi
push 0x40
mov dword [ebp - 0x10], eax
call esi
push edi
push 0x40
mov dword [ebp - 0x14], eax
call esi
push 0x800
push 0x40
mov dword [ebp - 0xc], eax
call esi
mov esi, 0x350
mov dword [ebp - 0x18], eax
push esi
lea eax, [ebp - 0x394]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x44]
push ebx
push 0x28
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x1000c17e
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
je 0x1000c131
lea ecx, [ebp - 0x40]
push 0xf01ff
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1000c131
lea ecx, [ebp - 8]
push ecx
push edi
push dword [ebp - 0x10]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov ebx, dword [sym.imp.MSVCRT.dll_strncpy]
test eax, eax
je 0x1000c03d
lea eax, [ebp - 0x40]
push 0x20
push eax
lea eax, [ebp - 0x37c]
push eax
call ebx
mov eax, dword [ebp - 0x10]
add esp, 0xc
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x394], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x38c], ecx
mov eax, dword [eax]
mov dword [ebp - 0x390], eax
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 0xc]
push 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfig2A]
test eax, eax
je 0x1000c06f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
test eax, eax
je 0x1000c06f
push 0x100
push eax
lea eax, [ebp - 0x31c]
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 8]
push eax
push edi
mov edi, dword [ebp - 0x14]
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x1000c0be
push 0x40
lea eax, [ebp - 0x35c]
push dword [edi + 0x20]
push eax
call ebx
push 0x104
lea eax, [ebp - 0x21c]
push dword [edi + 0xc]
push eax
call ebx
push 0x40
lea eax, [ebp - 0x118]
push dword [edi + 0x18]
push eax
call ebx
mov eax, dword [edi + 4]
add esp, 0x24
mov dword [ebp - 0x388], eax
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 8]
push eax
push 0x800
push edi
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfig2A]
test eax, eax
je 0x1000c117
mov eax, dword [edi]
mov dword [ebp - 0x384], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x380], eax
mov eax, dword [edi + 8]
test eax, eax
je 0x1000c101
push 0x40
push eax
lea eax, [ebp - 0x98]
push eax
call ebx
add esp, 0xc
mov edi, dword [edi + 4]
test edi, edi
je 0x1000c117
push 0x40
lea eax, [ebp - 0xd8]
push edi
push eax
call ebx
add esp, 0xc
push 0
lea eax, [ebp - 0x394]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1000c154
xor ebx, ebx
push ebx
lea eax, [ebp - 0x394]
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 0x394], 0x7b
mov dword [ebp - 0x58], 0x141
call dword [sym.imp.WS2_32.dll_send]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x1c]
call esi
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push dword [ebp - 0xc]
call esi
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x10]
call esi
pop edi
pop esi
pop ebx
leave
ret