Function at 0x10006d3f
Capabilities:
Query service status

Disassembly:
mov eax, 0x100652be
call fcn.10064c08
sub esp, 0x28
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x14], cl
je 0x10006f27
xor ebx, ebx
test cl, cl
je 0x10006d96
push 0x52de
push 0x3f5f
push 0x84c
push 1
push ebx
push 0x67c7
lea edx, [ebp + 0x17]
mov byte [ebp + 0x17], bl
mov cl, 1
call fcn.100057e3
add esp, 0x18
jmp 0x10006fcb
mov eax, dword [ebp + 0x1c]
mov esi, 0x10081dd8
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], eax
mov dword [edi], 3
cmp dword [edi], ebx
jl 0x10006e93
push 1
push 1
push 1
mov edx, 0x1838
mov ecx, 0x2ac9
call fcn.100040f5
mov dword [ebp - 0x20], 0x58f0
add esp, 0xc
cmp dword [ebp - 0x20], 0x597d
jle 0x10006e31
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov eax, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], ebx
mov ecx, eax
mov ebx, edi
mov edi, dword [ebp - 0x28]
sar ebx, cl
mov eax, ebx
mov ecx, esi
or eax, edi
cdq
push edx
push eax
call fcn.1000c947
inc edi
cmp edi, 0x22bf
jl 0x10006df0
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x18], eax
push 0
pop ebx
cmp eax, 0x2135
jl 0x10006de4
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x4061
jl 0x10006ddf
mov edi, dword [ebp - 0x24]
push ebx
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [edi]
mov eax, dword [eax]
cmp dword [eax + ecx*4], ebx
jne 0x10006e93
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x20], 0x55e9
jge 0x10006e55
mov edx, str.txo_zewaqq_hvep_bnocqsrpr_xveeza_lwbxqgsht_llsrgi_upd_ekmpgroir_ajp_xuwwaahw_eqbkccdfp_mpynkeryg
mov ecx, esi
call fcn.1000fdbf
or dword [ebp - 4], 0xffffffff
dec dword [edi]
jmp 0x10006daa
mov dword [ebp - 0x1c], 0x46fc
cmp dword [ebp - 0x1c], 0x471a
jle 0x10006ee8
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov eax, ebx
mov dword [ebp - 0x24], 0x6b98
mov ebx, dword [ebp - 0x20]
mov dword [ebp + 0x14], eax
xor eax, edi
mov ecx, esi
cdq
push edx
push eax
call fcn.1000c947
mov eax, dword [ebp + 0x14]
add eax, ebx
dec dword [ebp - 0x24]
mov dword [ebp + 0x14], eax
jne 0x10006eb7
inc ebx
push 0
mov dword [ebp - 0x20], ebx
cmp ebx, 0x7356
pop ebx
jl 0x10006ea8
inc edi
cmp edi, 0x6746
jl 0x10006ea5
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x4595
jge 0x10006d91
mov edx, str.ycgp_mrustyy_zajeqpc_aepqfste
mov ecx, esi
call fcn.1000fdbf
jmp 0x10006d91
cmp byte [ebp + 0xc], 0
je 0x10006f45
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10006fcb
xor cl, cl
call fcn.10004f6f
jmp 0x10006fcb
mov dword [ebp - 0x24], 0x4357
cmp dword [ebp - 0x24], 0x4436
jle 0x10006f99
xor ebx, ebx
push ebx
push ebx
push 0x57
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, ebx
mov esi, 0x10081dd8
mov dword [ebp + 0x14], ebx
lea eax, [ebx + edi]
mov ecx, esi
cdq
push edx
push eax
call fcn.1000c947
inc ebx
cmp ebx, 0x3c21
jl 0x10006f6d
inc edi
push 0
pop ebx
cmp edi, 0x41f4
jl 0x10006f6a
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x10006f9e
mov esi, 0x10081dd8
mov dword [ebp - 4], 4
cmp dword [ebp - 0x24], 0x4233
jge 0x10006fba
mov edx, str.ndsdfwg_utbx_nqbb_uix_cne_hng_tlnhqmt_ehc_oibx_wqaaawp
mov ecx, esi
call fcn.1000fdbf
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
mov dword [eax + ecx*4], 0xd004dde9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret