Function at 0x6798c0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68cc4e
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x740184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x4c], edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push ebx
call fcn.006795e0
test al, al
jne 0x67990d
mov eax, 1
jmp 0x679a98
lea eax, [ebp - 0x41]
push eax
push 0x24
lea ecx, [ebp - 0x58]
call fcn.004d1400
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x58]
sub edx, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x48], 0
cmp ecx, dword [ebp - 0x54]
jne 0x6799b2
xor ecx, ecx
lea eax, [ebp - 0x48]
push eax
push edx
push ecx
push 0
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x679a4e
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x7a
jne 0x6799c9
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x48]
mov ecx, eax
call fcn.0045cd70
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x58]
sub edx, ecx
cmp ecx, dword [ebp - 0x54]
jne 0x6799bf
xor ecx, ecx
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x4c]
push edx
push ecx
push 0
push dword [eax + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x679a4e
call edi
mov esi, eax
test bl, bl
je 0x679ac9
lea ecx, [ebp - 0x58]
call fcn.00452a20
mov eax, esi
jmp 0x679a98
test edx, edx
je 0x679abf
jmp 0x679938
test edx, edx
je 0x679ac4
jmp 0x67997b
call edi
mov esi, eax
test bl, bl
jne 0x6799a3
push 1
push 3
lea ecx, [ebp - 0x108]
call fcn.00452f50
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x28]
add ecx, 0xb0
mov byte [ebp - 4], 4
push ecx
push eax
call fcn.0047d770
add esp, 8
push str.__Cannot_get_service_process_status.
push eax
lea eax, [ebp - 0xf8]
mov byte [ebp - 4], 5
push 0x68fd20
push eax
call fcn.00456150
add esp, 8
push eax
call fcn.00456620
add esp, 8
push eax
call fcn.00456150
add esp, 8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.0044da70
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x108]
call fcn.00452f30
mov byte [ebp - 4], 6
jmp 0x679b41
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
cmp ecx, eax
jne 0x679ab6
xor ecx, ecx
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ecx + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [ecx + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [ecx + 0x20]
lea ecx, [ebp - 0x58]
mov dword [esi + 0x20], eax
call fcn.00452a20
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048b49a
mov esp, ebp
pop ebp
ret 8
sub eax, ecx
jne 0x679a5a
call fcn.00453f30
call fcn.00453f30
call fcn.00453f30
push 1
push 3
lea ecx, [ebp - 0x108]
call fcn.00452f50
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x28]
add ecx, 0xb0
mov byte [ebp - 4], 1
push ecx
push eax
call fcn.0047d770
add esp, 8
push str.__Cannot_get_service_process_status.
push eax
lea eax, [ebp - 0xf8]
mov byte [ebp - 4], 2
push 0x68fd20
push eax
call fcn.00456150
add esp, 8
push eax
call fcn.00456620
add esp, 8
push eax
call fcn.00456150
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.0044da70
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x108]
call fcn.00452f30
mov byte [ebp - 4], 3
push esi
push eax
lea ecx, [ebp - 0x20]
call fcn.00450300
push 0x73d438
lea eax, [ebp - 0x20]
push eax
call fcn.004a18e8
int3