Function at 0x1001f8b9
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067b2e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xac
push esi
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001f96c
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa4], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
movzx eax, byte [eax]
test eax, eax
je 0x1001f95f
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
jmp 0x1001f940
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 1
jge 0x1001f95d
mov eax, dword [ebp - 0x1c]
push dword [eax]
mov ecx, dword [ebp - 0x7c]
call fcn.1000ed9f
mov dword [eax], 5
jmp 0x1001f935
jmp 0x1001f967
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
jmp 0x1001fd48
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x98], 0x1cea
cmp dword [ebp - 0x98], 0x117f
jge 0x1001faa2
lea eax, [ebp - 0x84]
push eax
mov ecx, 0x1065aaa0
call fcn.1000e663
and dword [ebp - 0x24], 0
jmp 0x1001f9ad
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x84]
jge 0x1001faa2
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x1065aaa0
call fcn.1000e663
mov eax, dword [ebp - 0x10]
cdq
push 0x19
pop ecx
idiv ecx
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x10]
cdq
push 0x19
pop ecx
idiv ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cdq
push 0xa
pop ecx
idiv ecx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x10]
cdq
push 0xa
pop ecx
idiv ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cdq
push 5
pop ecx
idiv ecx
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x10]
cdq
push 5
pop ecx
idiv ecx
mov dword [ebp - 0x10], edx
push fcn.10013226
push dword [ebp - 0x10]
push dword [ebp - 0xa0]
push dword [ebp - 0x8c]
push dword [ebp - 0x6c]
mov eax, dword [ebp - 0x24]
inc eax
push eax
mov ecx, 0x1065a9f8
call fcn.1000e973
mov edx, 0x10007cb4
mov ecx, eax
call fcn.10013431
mov ecx, eax
call fcn.1000e973
mov edx, 0x10007ce8
mov ecx, eax
call fcn.10013431
mov ecx, eax
call fcn.1000e973
mov edx, 0x10007cdc
mov ecx, eax
call fcn.10013431
mov ecx, eax
call fcn.1000e973
mov edx, 0x10007ccc
mov ecx, eax
call fcn.10013431
mov ecx, eax
call fcn.1000e973
mov edx, 0x10007cc0
mov ecx, eax
call fcn.10013431
mov ecx, eax
call fcn.1000e967
jmp 0x1001f9a6
mov dword [ebp - 0x4c], 0xfd814383
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0xfc0336ae
push 1
lea ecx, [ebp - 0xb0]
call fcn.1000ecc1
and dword [ebp - 4], 0
mov dword [ebp - 0x80], 0xfffffff9
mov dword [ebp - 0x14], 0
jmp 0x1001fae6
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1001faf9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x60], 0x8b10
jmp 0x1001fadf
mov dword [ebp - 0x14], 0
jmp 0x1001fb09
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1001fb25
push dword [ebp - 0x14]
lea ecx, [ebp - 0xb0]
call fcn.1000ed9f
mov dword [eax], 0x16709e14
jmp 0x1001fb02
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x60]
mov dword [ebp - 0xb4], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x60], 0
je 0x1001fb65
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x60], 0
je 0x1001fb65
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x60], 0
je 0x1001fb65
mov dword [ebp - 0x64], 1
jmp 0x1001fb69
and dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x1001fb87
mov eax, 0x809b
test eax, eax
je 0x1001fb87
mov dword [ebp - 0x30], 1
jmp 0x1001fb8b
and dword [ebp - 0x30], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x60]
cmp dword [ebp - 0x30], eax
jne 0x1001fba3
mov dword [ebp - 0x3c], 1
jmp 0x1001fba7
and dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x60]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x4c], eax
jle 0x1001fbcb
mov dword [ebp - 0x44], 1
jmp 0x1001fbcf
and dword [ebp - 0x44], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x44]
sub ecx, dword [ebp + eax - 0x60]
jne 0x1001fbea
cmp dword [ebp - 0x2c], 0
jne 0x1001fbea
and dword [ebp - 0x34], 0
jmp 0x1001fbf1
mov dword [ebp - 0x34], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x60]
cmp dword [ebp - 0x34], eax
je 0x1001fc09
mov dword [ebp - 0x38], 1
jmp 0x1001fc0d
and dword [ebp - 0x38], 0
cmp dword [ebp - 0x38], 0x5440
jg 0x1001fc1f
mov dword [ebp - 0x40], 1
jmp 0x1001fc23
and dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x40]
imul esi, eax, 0x4752
push 0
lea ecx, [ebp - 0xb0]
call fcn.1000ed9f
cmp esi, dword [eax]
jle 0x1001fc52
mov eax, 0x4f16
test eax, eax
je 0x1001fc52
mov dword [ebp - 0x70], 1
jmp 0x1001fc56
and dword [ebp - 0x70], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x60]
mov dword [ebp - 0x48], eax
push 0
lea ecx, [ebp - 0xb0]
call fcn.1000ed9f
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
cmp dword [ebp - 0x48], 0
je 0x1001fc88
xor eax, eax
je 0x1001fc88
mov dword [ebp - 0x50], 1
jmp 0x1001fc8c
and dword [ebp - 0x50], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x60]
cmp eax, dword [ebp - 0x50]
jge 0x1001fca7
cmp dword [ebp - 0x20], 0
jne 0x1001fca7
and dword [ebp - 0x78], 0
jmp 0x1001fcae
mov dword [ebp - 0x78], 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xb8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x60]
sub eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x20]
test eax, eax
je 0x1001fce4
mov byte [ebp - 0x15], 0
movzx eax, byte [ebp - 0x15]
test eax, eax
je 0x1001fce2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x1001fcf7
mov dword [ebp - 0x88], 0x38140a97
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x88], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.1000ed74
push 0x555e
push 0x5fa8
push 0x1c15
push 0x79f1
push 0
push dword [ebp - 0x90]
push 0x754b
push 0x523b
push 0x5113
push 0x43b1
push 0xe8e
push 0x17bd
call fcn.100171b5
add esp, 0x30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret