Function at 0x10001360
Capabilities:
Create process on windows
Query service status
Start service

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ec9e
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x1002b014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x20000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x40], edi
test edi, edi
je 0x100013d1
push 0x14
push str.Winmgmt
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x100013d8
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x1000159e
lea eax, [ebp - 0x34]
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x34], xmm0
movq qword [ebp - 0x24], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1000140d
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
xor al, al
jmp 0x1000159e
cmp dword [ebp - 0x30], 4
jne 0x10001426
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov al, 1
jmp 0x1000159e
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push dword [ebp - 0x30]
push str.sStatus.dwCurrentState:_08X
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__16]
add esp, 8
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
call fcn.1001d3f0
mov ecx, esp
push str.StartService___1
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
call fcn.1001d3f0
add esp, 4
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push ecx
mov ecx, esp
push str.QueryServiceStatus___1
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
call fcn.1001d3f0
add esp, 4
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x100014e4
xor edi, edi
cmp edi, 0x190
jge 0x100014e4
cmp dword [ebp - 0x30], 4
je 0x100015be
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
mov ecx, esp
push 0x10021c9c
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
call fcn.1001d3f0
add esp, 4
lea eax, [ebp - 0x34]
add edi, 0x64
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x100014a3
push 0
push 0
push str.config_Winmgmt_start_auto
push 0x100215cc
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ecx
mov ecx, esp
xor edi, edi
push str.QueryServiceStatus___2
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
call fcn.1001d3f0
add esp, 4
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x10001580
push ecx
mov ecx, esp
push str.StartService___2
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
call fcn.1001d3f0
add esp, 4
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
cmp edi, 0xa
jge 0x10001580
cmp dword [ebp - 0x30], 4
je 0x100015be
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
mov ecx, esp
push 0x10021c9c
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
call fcn.1001d3f0
add esp, 4
lea eax, [ebp - 0x34]
inc edi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x10001523
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x40]
call esi
mov byte [ebp - 0x35], 0
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov al, byte [ebp - 0x35]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001d656
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
push ecx
mov ecx, esp
push str.StartService_Completed_:_SERVICE_RUNNING
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
call fcn.1001d3f0
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x40]
call esi
mov byte [ebp - 0x35], 1
jmp 0x10001592