Function at 0x1004345
Capabilities:
Modify service
Query or enumerate registry value
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8cc
mov eax, dword [0x1006074]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push edi
push 4
push esi
mov edi, ecx
push esi
mov dword [ebp - 0x874], edi
mov dword [ebp - 0x858], esi
mov dword [ebp - 0x864], esi
mov dword [ebp - 0x85c], esi
mov dword [ebp - 0x84c], esi
mov dword [ebp - 0x868], esi
mov dword [ebp - 0x860], esi
mov dword [ebp - 0x87c], esi
mov dword [ebp - 0x86c], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x854], eax
cmp eax, esi
jne 0x10043cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jg 0x10043bf
mov dword [ebp - 0x848], eax
jmp 0x10049a2
and eax, 0xffff
or eax, 0x80070000
jmp 0x10043b4
or dword [ebp - 0x890], 0xffffffff
mov eax, 0x10016a4
push ebx
push dword [ebp - 0x854]
mov dword [ebp - 0x888], eax
mov dword [ebp - 0x88c], eax
lea eax, [ebp - 0x8a8]
mov ecx, edi
mov dword [ebp - 0x884], 3
mov dword [ebp - 0x880], eax
mov dword [ebp - 0x8a8], esi
mov dword [ebp - 0x8a4], esi
mov dword [ebp - 0x8a0], esi
mov dword [ebp - 0x89c], esi
mov dword [ebp - 0x898], esi
mov dword [ebp - 0x894], esi
call fcn.01003c9f
cmp eax, esi
mov dword [ebp - 0x848], eax
jl 0x1004944
lea eax, [edi + 4]
mov ebx, dword [eax]
xor ecx, ecx
push 4
pop edx
mov eax, ebx
mul edx
seto cl
mov dword [ebp - 0x85c], ebx
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x860], eax
cmp eax, esi
jne 0x1004474
mov dword [ebp - 0x848], 0x80070008
jmp 0x1004944
mov edi, ebx
shl edi, 2
push edi
push esi
push eax
call sub.msvcrt.dll_memset
xor ecx, ecx
push 4
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 0x10
mov dword [ebp - 0x868], eax
cmp eax, esi
je 0x1004465
push edi
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x850], esi
cmp ebx, esi
jbe 0x10045ff
mov edi, dword [ebp - 0x868]
mov eax, dword [ebp - 0x860]
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceConfig2W]
sub eax, edi
mov dword [ebp - 0x870], eax
mov ecx, dword [ebp - 0x874]
lea eax, [ebp - 0x86c]
push eax
push dword [ebp - 0x850]
add ecx, 4
call fcn.01004a9f
cmp eax, esi
mov dword [ebp - 0x848], eax
jl 0x1004768
push 7
push dword [ebp - 0x86c]
push dword [ebp - 0x854]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x84c], eax
cmp eax, esi
je 0x1004787
lea eax, [ebp - 0x87c]
push eax
push 0x24
lea eax, [ebp - 0x8cc]
push eax
push esi
push dword [ebp - 0x84c]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1004787
mov eax, dword [ebp - 0x8b0]
mov ecx, dword [ebp - 0x870]
mov dword [ecx + edi], eax
lea eax, [ebp - 0x878]
push eax
push esi
lea eax, [ebp - 0x44]
push eax
push 2
push dword [ebp - 0x84c]
call ebx
test eax, eax
jne 0x10045b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1004787
push dword [ebp - 0x878]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [edi], eax
cmp eax, esi
je 0x10047a3
lea ecx, [ebp - 0x878]
push ecx
push dword [ebp - 0x878]
push eax
push 2
push dword [ebp - 0x84c]
call ebx
test eax, eax
je 0x1004787
lea eax, [ebp - 0x890]
push eax
push 2
push dword [ebp - 0x84c]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x1004787
push dword [ebp - 0x84c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
inc dword [ebp - 0x850]
mov eax, dword [ebp - 0x850]
add edi, 4
mov dword [ebp - 0x84c], esi
cmp eax, dword [ebp - 0x85c]
jb 0x10044d7
push dword [ebp - 0x854]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x1001694
push 0x1001684
call fcn.010051f0
push esi
push 0x1001678
mov dword [ebp - 0x858], eax
call fcn.010051f0
cmp dword [ebp - 0x858], esi
jl 0x1004639
mov dword [ebp - 0x858], eax
push esi
push 0x1001664
call fcn.010051f0
cmp dword [ebp - 0x858], esi
jl 0x1004652
mov dword [ebp - 0x858], eax
push 0x100165c
push 0x100164c
call fcn.010051f0
cmp dword [ebp - 0x858], esi
jl 0x100466f
mov dword [ebp - 0x858], eax
push esi
push 0x1001638
call fcn.010051f0
cmp dword [ebp - 0x858], esi
jl 0x1004688
mov dword [ebp - 0x858], eax
lea eax, [ebp - 0x854]
push eax
push 0x20019
push esi
push 0x10015e0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004768
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x870]
push eax
push esi
push 0x10015b4
push dword [ebp - 0x854]
mov dword [ebp - 0x850], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100475c
cmp dword [ebp - 0x870], 7
jne 0x100475c
cmp dword [ebp - 0x850], 2
jbe 0x100475c
mov word [ebp - 0x46], ax
mov word [ebp - 0x48], ax
lea edi, [ebp - 0x844]
cmp word [ebp - 0x844], si
je 0x100475c
push esi
push edi
call fcn.010051f0
cmp dword [ebp - 0x858], esi
jl 0x1004720
mov dword [ebp - 0x858], eax
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1004725
sub eax, edx
sar eax, 1
add eax, eax
push 0xfffffffffffffffe
pop ecx
sub ecx, eax
add dword [ebp - 0x850], ecx
mov eax, edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x1004745
sub eax, ecx
sar eax, 1
lea edi, [edi + eax*2 + 2]
cmp word [edi], si
jne 0x100470b
push dword [ebp - 0x854]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x854], eax
cmp eax, esi
jne 0x10047af
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1004930
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x100479b
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x848], eax
jmp 0x1004768
mov dword [ebp - 0x848], 0x80070008
jmp 0x1004768
xor eax, eax
mov dword [ebp - 0x850], eax
cmp dword [ebp - 0x85c], esi
jbe 0x10048fc
mov ecx, dword [ebp - 0x868]
lea edi, [ecx + eax*4]
cmp dword [edi], esi
je 0x10048e3
lea ecx, [ebp - 0x86c]
push ecx
mov ecx, dword [ebp - 0x874]
push eax
add ecx, 4
call fcn.01004a9f
cmp eax, esi
mov dword [ebp - 0x864], eax
jl 0x10048e3
push 0x17
push dword [ebp - 0x86c]
push dword [ebp - 0x854]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x84c], eax
cmp eax, esi
jne 0x1004835
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x100482a
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x864], eax
jmp 0x10048e3
mov eax, dword [edi]
cmp dword [eax + 0xc], 3
jne 0x1004852
mov eax, dword [eax + 0x10]
cmp eax, esi
je 0x1004852
cmp dword [eax], esi
jne 0x1004852
cmp dword [eax + 8], esi
jne 0x1004852
cmp dword [eax + 0x10], esi
je 0x10048a3
xor ebx, ebx
lea eax, [ebp - 0x87c]
push eax
push 0x24
lea eax, [ebp - 0x8cc]
push eax
push esi
push dword [ebp - 0x84c]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x10048a3
mov eax, dword [ebp - 0x8b0]
mov ecx, dword [ebp - 0x860]
mov edx, dword [ebp - 0x850]
cmp eax, dword [ecx + edx*4]
jne 0x10048a3
cmp dword [ebp - 0x8c8], 1
je 0x10048a3
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xa
jb 0x1004854
push dword [edi]
push 2
push dword [ebp - 0x84c]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x10048d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x10048cb
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x864], eax
push dword [ebp - 0x84c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x84c], esi
mov eax, dword [ebp - 0x850]
inc eax
mov dword [ebp - 0x850], eax
cmp eax, dword [ebp - 0x85c]
jb 0x10047c3
push dword [ebp - 0x854]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x848], esi
mov dword [ebp - 0x854], esi
jl 0x1004930
mov eax, dword [ebp - 0x858]
cmp eax, esi
jl 0x100492a
mov eax, dword [ebp - 0x864]
cmp eax, esi
jge 0x1004930
mov dword [ebp - 0x848], eax
cmp dword [ebp - 0x84c], esi
je 0x1004958
push dword [ebp - 0x84c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x854], esi
je 0x1004958
push dword [ebp - 0x854]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [ebp - 0x868]
cmp ebx, esi
je 0x100498d
xor edi, edi
cmp dword [ebp - 0x85c], esi
jbe 0x1004986
mov eax, dword [ebx + edi*4]
cmp eax, esi
je 0x100497d
push eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [ebx + edi*4], esi
inc edi
cmp edi, dword [ebp - 0x85c]
jb 0x100496c
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ebx
cmp dword [ebp - 0x860], esi
je 0x10049a2
push dword [ebp - 0x860]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov ecx, dword [ebp - 0x874]
call fcn.01003838
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x848]
pop edi
xor ecx, ebp
pop esi
call fcn.010033bb
leave
ret