Function at 0x40126a
Capabilities:
Contain obfuscated stackstrings
Listen for remote procedure calls

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x60
test byte [0x40406c], 8
mov dword [ebp - 0x41], 0x6361636e
mov dword [ebp - 0x3d], 0x706e5f6e
mov byte [ebp - 0x39], 0
mov dword [ebp - 0x38], 0x7069705c
mov dword [ebp - 0x34], 0x69775c65
mov dword [ebp - 0x30], 0x705f656e
mov dword [ebp - 0x2c], 0x7067756c
mov dword [ebp - 0x28], 0x79616c
jne 0x401350
lea eax, [ebp - 0x38]
xor edx, edx
mov dword [esp + 8], eax
lea eax, [ebp - 0x41]
xor ecx, ecx
mov dword [esp + 0xc], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym._RpcServerUseProtseqEpA_16
sub esp, 0x10
test eax, eax
je 0x4012f8
test byte [0x40406c], 2
jne 0x4013e8
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 8
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x404094]
mov dword [esp], eax
call sym._RpcServerRegisterIf_12
sub esp, 0xc
test eax, eax
je 0x401380
test byte [0x40406c], 2
je 0x4012e6
mov edx, str.RpcServerRegisterIf___failed__error__u_n
mov ecx, str.ServiceMain
mov dword [esp + 0x10], eax
mov ebx, 0x40406c
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x4012e6
mov dword [esp], 3
mov eax, str.ServiceMain
mov ebx, str.starting_service_n
mov dword [esp + 8], eax
mov eax, 0x40406c
mov dword [esp + 0xc], ebx
mov dword [esp + 4], eax
call sym._wine_dbg_log.constprop.0
jmp 0x4012b4
mov dword [esp], 1
mov eax, 1
mov dword [esp + 8], eax
mov eax, 0x4d2
mov dword [esp + 4], eax
call sym._RpcServerListen_12
sub esp, 0xc
test eax, eax
je 0x401420
test byte [0x40406c], 2
je 0x4012e6
mov dword [esp + 0x10], eax
mov eax, str.RpcServerListen___failed__error__u_n
mov dword [esp + 0xc], eax
mov eax, str.ServiceMain
mov dword [esp + 8], eax
mov eax, 0x40406c
mov dword [esp + 4], eax
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x4012e6
mov dword [esp + 0x10], eax
mov eax, str.RpcServerUseProtseqEp___failed__error__u_n
mov dword [esp + 0xc], eax
mov eax, str.ServiceMain
mov dword [esp + 8], eax
mov eax, 0x40406c
mov dword [esp + 4], eax
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp], 0
xor eax, eax
mov edx, 1
mov dword [esp + 0xc], eax
xor eax, eax
mov ebx, sym._service_handler_16
mov dword [esp + 4], edx
mov dword [esp + 8], eax
call dword [sym.imp.kernel32.dll_CreateEventW]
xor ecx, ecx
mov dword [section..bss], eax
sub esp, 0x10
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], str.PlugPlay
call sym._RegisterServiceCtrlHandlerExW_12
mov dword [0x407004], eax
sub esp, 0xc
test eax, eax
je 0x4012e6
mov dword [esp], eax
lea ebx, [ebp - 0x24]
mov dword [esp + 4], ebx
mov dword [ebp - 0x24], 0x30
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x2710
call sym._SetServiceStatus_8
mov eax, 0xffffffff
sub esp, 8
mov dword [esp + 4], eax
mov eax, dword [section..bss]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
mov dword [esp], 0
call sym._RpcMgmtStopServerListening_4
mov eax, 1
sub esp, 4
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x404094]
mov dword [esp], eax
call sym._RpcServerUnregisterIf_12
sub esp, 0xc
call sym._RpcMgmtWaitServerListen_0
mov eax, dword [0x407004]
mov dword [esp + 4], ebx
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 0
mov dword [esp], eax
call sym._SetServiceStatus_8
sub esp, 8
test byte [0x40406c], 8
je 0x4012e6
mov edx, str.ServiceMain
mov ecx, 0x40406c
mov dword [esp + 8], edx
mov eax, str.service_stopped_n
mov dword [esp + 0xc], eax
mov dword [esp + 4], ecx
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x4012e6