Function at 0x10043e6
Capabilities:
Modify service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x14], esi
mov byte [ebp - 1], 1
mov byte [ebp - 2], 0
mov dword [ebp - 0xc], esi
cmp dword [ebp + 0x14], esi
jbe 0x100468b
mov dword [ebp - 8], 1
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
shl esi, 2
lea edi, [esi + ebx]
push 0x1001c00
push dword [edi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1004489
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 8], eax
jae 0x1004489
lea esi, [esi + ebx + 4]
push 0x1001bec
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1004471
or dword [ebp - 0x1c], 0xffffffff
jmp 0x100447d
push dword [esi]
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 1
jmp 0x1004611
push 0x1001bdc
push dword [edi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10044b0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x14]
jae 0x10044b0
mov eax, dword [esi + ebx + 4]
mov dword [ebp - 0x2c], eax
jmp 0x1004611
push 0x1001bc8
push dword [edi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10044d7
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x14]
jae 0x10044d7
mov eax, dword [esi + ebx + 4]
mov dword [ebp - 0x30], eax
jmp 0x1004611
push 0x1001bb4
push dword [edi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x100464d
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 8], eax
jae 0x100464d
lea esi, [esi + ebx + 4]
mov eax, dword [esi]
jmp 0x100450d
cmp cx, 0x2f
jne 0x100450b
inc dword [ebp - 0x10]
inc eax
inc eax
movzx ecx, word [eax]
test cx, cx
jne 0x1004502
mov eax, dword [ebp - 0x10]
add eax, 2
shr eax, 1
shl eax, 3
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1004637
mov esi, dword [esi]
and dword [ebp - 0x10], 0
mov eax, esi
mov ebx, esi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1004541
sub eax, ecx
sar eax, 1
lea edi, [esi + eax*2]
push 0x2f
pop eax
mov word [edi], ax
jmp 0x1004602
cmp word [esi], 0x2f
jne 0x1004600
xor eax, eax
mov word [esi], ax
cmp byte [ebp - 1], al
je 0x10045de
push 0x1001ba4
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1004596
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
or dword [ebp - 0x18], 0x10
mov dword [eax + ecx*8], 1
jmp 0x10045f3
push 0x1001b94
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10045bb
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [eax + ecx*8], 2
mov byte [ebp - 2], 1
jmp 0x10045f3
push 0x1001b8c
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
mov edx, dword [ebp - 0x10]
neg eax
sbb eax, eax
pop ecx
and eax, 0xfffffffd
pop ecx
mov ecx, dword [ebp - 0x14]
add eax, 3
mov dword [ecx + edx*8], eax
jmp 0x10045f3
push ebx
call dword [sym.imp.msvcrt.dll__wtol]
mov edx, dword [ebp - 0x10]
inc dword [ebp - 0x10]
pop ecx
mov ecx, dword [ebp - 0x14]
mov dword [ecx + edx*8 + 4], eax
cmp byte [ebp - 1], 0
lea ebx, [esi + 2]
sete al
mov byte [ebp - 1], al
inc esi
inc esi
cmp esi, edi
jbe 0x100455d
mov dword [ebp - 0x24], 1
inc dword [ebp - 0xc]
inc dword [ebp - 8]
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
inc dword [ebp - 8]
cmp eax, dword [ebp + 0x14]
jb 0x100442d
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x28], eax
je 0x1004660
push 0
push 0x6e
jmp 0x1004651
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001b48
call fcn.010030bb
jmp 0x1004709
push 0
push 0x6a
call fcn.01002c72
call fcn.0100308e
jmp 0x1004709
cmp byte [ebp - 2], 0
je 0x1004689
lea eax, [ebp - 3]
push eax
push 0
push 1
push 0x13
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
test eax, eax
jge 0x1004689
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
push 0x1001af0
jmp 0x1004643
xor esi, esi
push dword [ebp - 0x18]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp eax, esi
jne 0x10046b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001530
jmp 0x1004643
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x44]
push ecx
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x10046ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
cmp eax, esi
jne 0x10046f9
push 0x1001504
call fcn.010030a2
jmp 0x1004706
push dword [ebp - 0x20]
push 0x1001504
call fcn.010030bb
mov eax, dword [ebp - 0x20]
pop edi
pop esi
pop ebx
leave
ret 0x14