Function at 0x42a270
Capabilities:
Query service status
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4692e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x8940
call fcn.0045f540
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov dword [eax], 0
mov dword [ecx], 0
mov dword [ebp - 0x10], esp
xor eax, eax
push eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x54]
push edx
mov ecx, 0x188
lea edi, [ebp - 0xcd0]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
push 0x7a80
lea eax, [ebp - 0x8950]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42a34f
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x42a34f
mov ebx, dword [0x4912e8]
test dword [0x4910e8], ebx
je 0x42a30b
push str.NamePipeServiceInstanceThread:_Read_from_Pipe_Success
call fcn.0040a4a0
mov ebx, dword [0x4912e8]
add esp, 4
mov ecx, dword [ebp - 0x54]
mov edx, ecx
shr ecx, 2
lea esi, [ebp - 0x8950]
lea edi, [ebp - 0xcd0]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xcd0], 0x8001
jne 0x42a340
cmp dword [ebp - 0xccc], 0x620
je 0x42a370
test dword [0x4910e8], ebx
je 0x42a370
push str.NamePipeServiceInstanceThread:_Pipe_read_msg_contents_error__something_wrong
jmp 0x42a362
mov ebx, dword [0x4912e8]
test dword [0x4910e8], ebx
je 0x42a370
push str.NamePipeServiceInstanceThread:_Read_from_Pipe_Failed
call fcn.0040a4a0
mov ebx, dword [0x4912e8]
add esp, 4
mov esi, dword [ebp - 0xcc8]
lea eax, [esi - 9]
cmp eax, 0x37
mov dword [ebp - 0x44], esi
ja case.0x42a38c.10
movzx eax, byte [eax + 0x42bb54]
jmp dword [eax*4 + 0x42bae8]
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42a3bd
test dword [0x4910e8], ebx
je 0x42ba9b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_FEATUREUPDATE._ulSessionId___d__out_of_range
call fcn.0040a4a0
add esp, 8
jmp 0x42ba9b
mov ecx, 0x492a60
call fcn.00431a90
mov ecx, dword [0x4910e8]
test dword [0x4912e8], ecx
je 0x42ba9b
push str.finish_feature_update
call fcn.0040a4a0
add esp, 4
jmp 0x42ba9b
mov eax, dword [0x492098]
xor edi, edi
cmp eax, 7
ja 0x42a4b5
mov esi, dword [ebp - 0xcc0]
cmp esi, 0x14
jae 0x42a4c0
cmp dword [0x49139c], edi
je 0x42a41d
mov dword [0x49139c], edi
mov edi, 1
push 0
push esi
call fcn.00429930
add esp, 8
cmp eax, 0xffffffff
je 0x42a502
push esi
lea eax, [eax + eax*8]
shl eax, 5
push str..pipeExtEventPipe
lea edx, [eax + 0x49fcbc]
push str._s_s_d
push edx
mov dword [eax + 0x49fdc0], 1
mov dword [eax + 0x49fcb8], esi
call fcn.0045f139
mov eax, dword [0x492164]
mov ecx, dword [0x49209c]
add esp, 0x10
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], edi
mov edx, dword [0x4910e8]
test dword [0x4912e8], edx
je 0x42ba9b
push str.Send_RegOption_to_Client
call fcn.0040a4a0
add esp, 4
jmp 0x42ba9b
mov esi, dword [ebp - 0xcc4]
cmp esi, 0x14
jb 0x42a4df
test dword [0x4910e8], ebx
je 0x42ba9b
push esi
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_SETUP._ulSessionId___d__out_of_range
call fcn.0040a4a0
add esp, 8
jmp 0x42ba9b
cmp dword [0x49139c], edi
je 0x42a4f2
mov dword [0x49139c], edi
mov edi, 1
push 0
push esi
call fcn.00429930
add esp, 8
cmp eax, 0xffffffff
jne 0x42a52d
test dword [0x4910e8], ebx
je 0x42bad6
push esi
push str.NamePipeServiceInstance:__d_not_enough_session_slot_to_assign_this_setup_session
call fcn.0040a4a0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [eax + eax*8]
shl eax, 5
push esi
push str..pipeExtEventPipe
mov dword [eax + 0x49fdc0], 1
mov dword [eax + 0x49fcb8], esi
lea eax, [eax + 0x49fcbc]
push str._s_s_d
push eax
call fcn.0045f139
mov ecx, dword [ebp - 0xcb8]
mov edx, dword [0x49209c]
mov eax, dword [ebp - 0xcbc]
mov ebx, dword [ebp - 0xcc0]
or edx, ecx
mov ecx, dword [0x492160]
mov dword [0x49209c], edx
mov edx, dword [ebp - 0xcb4]
and edx, 0x8000
add esp, 0x10
cmp ecx, 1
mov esi, eax
mov dword [0x4920d0], edx
jne 0x42a5a7
mov dword [0x49e99c], ebx
mov dword [0x49e9a0], eax
push eax
mov ecx, 0x492a60
call fcn.0042da80
push esi
mov ecx, 0x492a60
mov dword [eax + 0x15c], 1
call fcn.0042da80
mov dword [eax + 0x44], ebx
mov ecx, dword [0x492160]
mov eax, dword [0x492164]
mov edx, dword [0x49e99c]
mov dword [ebp - 0x34], ecx
mov ecx, dword [0x4920c4]
mov dword [ebp - 0x40], eax
mov eax, dword [0x49e9a0]
push ecx
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edi
call fcn.0040f3a0
add esp, 4
jmp 0x42a491
mov edi, dword [ebp - 0xcc0]
cmp edi, 0x14
mov dword [ebp - 0x14], edi
jb 0x42a645
test dword [0x4910e8], ebx
je 0x42ba9b
push edi
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_READY._ulSessionId___d__out_of_range
call fcn.0040a4a0
add esp, 8
jmp 0x42ba9b
push 1
push edi
call fcn.00429930
add esp, 8
cmp eax, 0xffffffff
je 0x42a8ec
lea edi, [eax + eax*8]
shl edi, 5
mov eax, dword [edi + 0x49fdc0]
mov ecx, 3
cmp eax, ecx
je 0x42a687
cmp eax, 5
je 0x42a687
cmp esi, 0xb
jne 0x42a687
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
mov ebx, dword [0x4912e8]
cmp dword [edi + 0x49fdc0], ecx
jne 0x42a6a7
cmp dword [0x49fcb4], 1
jne 0x42a6a7
mov edx, dword [ebp + 0xc]
mov dword [edx], 1
mov ebx, dword [0x4912e8]
cmp esi, 0x1e
jne 0x42a6c2
mov dword [edi + 0x49fdc0], 2
mov dword [0x49fcb4], 1
jmp 0x42a6db
cmp dword [edi + 0x49fdc0], 5
je 0x42a6db
mov dword [edi + 0x49fdc0], ecx
mov dword [0x49fcb4], 0
cmp dword [edi + 0x49fdc0], 2
jne 0x42a728
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
mov eax, dword [0x4920b8]
test eax, eax
je 0x42a722
xor esi, esi
jmp 0x42a700
mov ecx, dword [0x4920b8]
push esi
call fcn.00402090
mov ecx, dword [0x4920b8]
push esi
mov dword [ebp + esi*4 - 0x34], eax
call fcn.00402030
inc esi
cmp esi, 5
jb 0x42a700
mov ebx, dword [0x4912e8]
cmp dword [edi + 0x49fcb8], 0xffffffff
jne 0x42a75a
mov eax, dword [ebp - 0x14]
push eax
push str..pipeExtEventPipe
lea ecx, [edi + 0x49fcbc]
push str._s_s_d
push ecx
mov dword [edi + 0x49fcb8], eax
call fcn.0045f139
mov ebx, dword [0x4912e8]
add esp, 0x10
test dword [0x4910e8], ebx
je 0x42a779
mov edx, dword [ebp - 0x14]
push edx
push str.NamePipeServiceInstance._Got_EXTEVENT_REQTYPE_SESSION_READY_from_session__d
call fcn.0040a4a0
mov ebx, dword [0x4912e8]
add esp, 8
mov eax, dword [0x49fcb0]
cmp eax, dword [ebp - 0x14]
mov edi, eax
je 0x42a7b7
test dword [0x4910e8], ebx
je 0x42a79f
mov ecx, dword [ebp - 0x14]
push ecx
push eax
push str.NamePipeServiceInstance._Active_session_has_changed_from__d_to__d
call fcn.0040a4a0
add esp, 0xc
cmp dword [ebp - 0x44], 0xb
mov edx, dword [ebp - 0x14]
mov dword [0x49fcb0], edx
jne 0x42a7b7
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
mov ecx, dword [0x4920d8]
test ecx, ecx
je 0x42ba9b
cmp dword [ebp - 0x44], 0xb
jne 0x42ba9b
call fcn.00417870
cmp dword [0x492098], 6
je 0x42ba9b
push 1
push edi
call fcn.00429930
mov ecx, dword [ebp - 0x14]
add esp, 8
cmp edi, ecx
je 0x42ba9b
cmp edi, 0xffffffff
je 0x42ba9b
cmp eax, 0xffffffff
jne 0x42a836
mov ecx, dword [0x4910e8]
test dword [0x4912e8], ecx
je 0x42bad6
push edi
push str.NamePipeServiceInstance:_BUG__d_notin_list
call fcn.0040a4a0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [eax + eax*8]
shl edx, 5
cmp dword [edx + 0x49fdc0], 5
jne 0x42ba9b
xor eax, eax
push 1
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov eax, dword [0x492164]
push 0
lea ecx, [ebp - 0x6b0]
lea esi, [edx + 0x49fcbc]
push ecx
push esi
mov dword [ebp - 0x6a8], 0x1b
mov dword [ebp - 0x6a0], eax
call fcn.004095e0
add esp, 0x10
test eax, eax
jne 0x42ba9b
mov edx, dword [0x4910e8]
test dword [0x4912e8], edx
je 0x42ba9b
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_CLIENTSETUNLOCKEVENT_on_pipe__s_.
call fcn.0040a4a0
add esp, 8
jmp 0x42ba9b
mov edi, dword [ebp - 0xcc0]
cmp edi, 0x14
jb 0x42a8dc
test dword [0x4910e8], ebx
je 0x42ba9b
push edi
push esi
push str.NamePipeServiceInstance._WARNING_reqtype_d._ulSessionId___d__out_of_range
call fcn.0040a4a0
add esp, 0xc
jmp 0x42a954
push 1
push edi
call fcn.00429930
add esp, 8
cmp eax, 0xffffffff
jne 0x42a917
test dword [0x4910e8], ebx
je 0x42bad6
push edi
push str.NamePipeServiceInstance:_BUG__d_notin_list
call fcn.0040a4a0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [eax + eax*8]
shl eax, 5
mov dword [eax + 0x49fdc0], 4
cmp dword [0x49fcb0], edi
jne 0x42a95a
mov ecx, dword [0x4920d8]
test ecx, ecx
mov dword [0x49fcb0], 0xffffffff
mov dword [0x49fcb4], 1
je 0x42a95a
push 0
call fcn.004178b0
mov ebx, dword [0x4912e8]
test dword [0x4910e8], ebx
je 0x42ba9b
mov ecx, dword [ebp - 0x44]
push edi
push ecx
push str.NamePipeServiceInstance._reqtype_d_called_from_session__d
jmp 0x42ba93
mov esi, dword [ebp - 0xcc0]
cmp esi, 0x14
mov dword [ebp - 0x14], esi
jb 0x42a99a
test dword [0x4910e8], ebx
je 0x42ba9b
push esi
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_READYBUTLOCKED._ulSessionId___d__out_of_range
jmp 0x42aa5a
push 1
push esi
call fcn.00429930
add esp, 8
cmp eax, 0xffffffff
je 0x42ac05
lea eax, [eax + eax*8]
shl eax, 5
mov ecx, dword [eax + 0x49fdc0]
cmp ecx, 5
lea eax, [eax + 0x49fdc0]
je 0x42a9cb
mov dword [eax], 3
cmp dword [0x49fcb0], esi
jne 0x42aa68
mov ecx, dword [0x4920d8]
test ecx, ecx
mov dword [0x49fcb4], 1
je 0x42aa68
push 0
call fcn.004178b0
call fcn.00409750
mov esi, eax
cmp dword [0x492098], 6
jne 0x42aa62
test esi, esi
je 0x42aa62
mov edx, dword [0x492164]
xor eax, eax
push 1
push eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x6b0]
push eax
push esi
mov dword [ebp - 0x6a8], 0xd
mov dword [ebp - 0x6a0], edx
call fcn.004095e0
add esp, 0x10
test eax, eax
jne 0x42aa62
mov ebx, dword [0x4912e8]
test dword [0x4910e8], ebx
je 0x42ba9b
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_SCREENSAVERSTOP_on_pipe__s_.
call fcn.0040a4a0
add esp, 8
mov ebx, dword [0x4912e8]
test dword [0x4910e8], ebx
je 0x42ba9b
mov ecx, dword [ebp - 0x14]
push ecx
push str.NamePipeServiceInstance._EXTEVENT_REQTYPE_CLT_READYBUTLOCKED_called_from_session__d
call fcn.0040a4a0
add esp, 8
jmp 0x42ba9b
mov eax, dword [ebp - 0xcc0]
cmp eax, 0x14
mov esi, eax
jb 0x42aaaf
test dword [0x4910e8], ebx
je 0x42aadf
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_LOGGEDOFF._ulSessionId___d__out_of_range
call fcn.0040a4a0
add esp, 8
jmp 0x42aad9
mov ecx, dword [0x49fcb0]
cmp ecx, eax
je 0x42aad0
test dword [0x4910e8], ebx
je 0x42aad0
push eax
push ecx
push str.NamePipeServiceInstance._WARNING._EXTEVENT_REQTYPE_CLT_LOGGEDOFF_m_SessionClients.ulActiveSessionId___d____ulSessionId___d_
call fcn.0040a4a0
add esp, 0xc
push esi
call fcn.00429980
add esp, 4
mov ebx, dword [0x4912e8]
test dword [0x4910e8], ebx
je 0x42ba9b
push esi
push str.NamePipeServiceInstance._EXTEVENT_REQTYPE_CLT_LOGGEDOFF_called_from_session__d
call fcn.0040a4a0
add esp, 8
jmp 0x42ba9b
mov eax, dword [ebp - 0xcc0]
cmp eax, 0x14
mov esi, eax
jb 0x42ab29
test dword [0x4910e8], ebx
je 0x42ab7d
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_IN_RESUME._ulSessionId___d__out_of_range
call fcn.0040a4a0
mov ebx, dword [0x4912e8]
add esp, 8
jmp 0x42ab7d
mov ecx, dword [0x49fcb0]
cmp ecx, eax
je 0x42ab50
test dword [0x4910e8], ebx
je 0x42ab50
push eax
push ecx
push str.NamePipeServiceInstance._WARNING._EXTEVENT_REQTYPE_CLT_IN_RESUME_m_SessionClients.ulActiveSessionId___d____ulSessionId___d_
call fcn.0040a4a0
mov ebx, dword [0x4912e8]
add esp, 0xc
push 1
push esi
call fcn.00429930
add esp, 8
cmp eax, 0xffffffff
je 0x42ac05
lea eax, [eax + eax*8]
shl eax, 5
cmp dword [eax + 0x49fcb8], 0xffffffff
je 0x42ab7d
mov dword [eax + 0x49fdc0], 5
test dword [0x4910e8], ebx
je 0x42ba9b
push esi
push str.NamePipeServiceInstance._EXTEVENT_REQTYPE_CLT_IN_RESUME_called_from_session__d
call fcn.0040a4a0
add esp, 8
jmp 0x42ba9b
mov eax, dword [ebp - 0xcc0]
cmp eax, 0x14
mov esi, eax
jb 0x42abce
test dword [0x4910e8], ebx
je 0x42ac52
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_OUTOF_RESUME._ulSessionId___d__out_of_range
call fcn.0040a4a0
mov ebx, dword [0x4912e8]
add esp, 8
jmp 0x42ac52
mov ecx, dword [0x49fcb0]
cmp ecx, eax
je 0x42abf5
test dword [0x4910e8], ebx
je 0x42abf5
push eax
push ecx
push str.NamePipeServiceInstance._WARNING._EXTEVENT_REQTYPE_CLT_OUTOF_RESUME_m_SessionClients.ulActiveSessionId___d____ulSessionId___d_
call fcn.0040a4a0
mov ebx, dword [0x4912e8]
add esp, 0xc
push 1
push esi
call fcn.00429930
add esp, 8
cmp eax, 0xffffffff
jne 0x42ac30
test dword [0x4910e8], ebx
je 0x42bad6
push esi
push str.NamePipeServiceInstance:_BUG__d_notin_list
call fcn.0040a4a0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [eax + eax*8]
shl eax, 5
cmp dword [eax + 0x49fcb8], 0xffffffff
je 0x42ac52
cmp dword [eax + 0x49fdc0], 5
jne 0x42ac52
mov dword [eax + 0x49fdc0], 3
test dword [0x4910e8], ebx
je 0x42ba9b
push esi
push str.NamePipeServiceInstance._EXTEVENT_REQTYPE_CLT_OUTOF_RESUME_called_from_session__d
call fcn.0040a4a0
add esp, 8
jmp 0x42ba9b
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42ac9b
test dword [0x4910e8], ebx
je 0x42ba9b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_SAFEESCAPEREGISTRATIONQUERY._ulSessionId___d__out_of_range
call fcn.0040a4a0
add esp, 8
jmp 0x42ba9b
mov ecx, 0x492a60
call fcn.00430210
mov ecx, dword [0x4912e8]
mov edx, dword [0x492164]
mov dword [ebp - 0x34], eax
mov eax, dword [0x4910e8]
test eax, ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x38], 0x24
je 0x42ba9b
push str.Finish_Safe_Escape_Registration_Status_Query_n
call fcn.0040a4a0
add esp, 4
jmp 0x42ba9b
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42ad15
test dword [0x4910e8], ebx
je 0x42ba9b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_SAFEESCAPEREGISTRATIONUPDATE._ulSessionId___d__out_of_range
call fcn.0040a4a0
add esp, 8
jmp 0x42ba9b
test dword [0x4910e8], ebx
mov ecx, dword [0x492164]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x38], 0x25
je 0x42ba9b
push str.Finish_Safe_Escape_Registration_Status_Update_n
call fcn.0040a4a0
add esp, 4
jmp 0x42ba9b
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42ad7b
test dword [0x4910e8], ebx
je 0x42ba9b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_SAVEPROFILEATSHUTDOWN_FINISHES._ulSessionId___d__out_of_range
call fcn.0040a4a0
add esp, 8
jmp 0x42ba9b
mov ecx, 0x49ee28
call fcn.00415810
mov eax, dword [0x4910e8]
test dword [0x4912e8], eax
mov edx, dword [0x492164]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x38], 0x27
je 0x42ba9b
push str.Finish_EXTEVENT_REQTYPE_CLT_SAVEPROFILEATSHUTDOWN_FINISHES_n
call fcn.0040a4a0
add esp, 4
jmp 0x42ba9b
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42adf0
test dword [0x4910e8], ebx
je 0x42ba9b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_STOPSCREENSAVEREVENT._ulSessionId___d__out_of_range
call fcn.0040a4a0
add esp, 8
jmp 0x42ba9b
mov eax, dword [0x4920cc]
test eax, eax
je 0x42ae6f
call fcn.00409750
mov esi, eax
cmp dword [0x49fcb0], 0xffffffff
je 0x42ae6f
test esi, esi
je 0x42ae6f
xor eax, eax
push 1
push eax
lea edx, [ebp - 0x6b0]
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov ecx, dword [0x492164]
push edx
push esi
mov dword [ebp - 0x6a8], 0x29
mov dword [ebp - 0x6a0], ecx
call fcn.004095e0
mov ebx, dword [0x4912e8]
add esp, 0x10
test eax, eax
jne 0x42ae6f
test dword [0x4910e8], ebx
je 0x42ba9b
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_SCREENSAVERSTOP_on_pipe__s_.
call fcn.0040a4a0
mov ebx, dword [0x4912e8]
add esp, 8
test dword [0x4910e8], ebx
je 0x42ba9b
push str.Finish_EXTEVENT_REQTYPE_CLT_STOPSCREENSAVEREVENT_n
call fcn.0040a4a0
add esp, 4
jmp 0x42ba9b
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42aeb7
test dword [0x4910e8], ebx
je 0x42ba9b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_STARTSCREENSAVEREVENT._ulSessionId___d__out_of_range
call fcn.0040a4a0
add esp, 8
jmp 0x42ba9b
mov eax, dword [0x4920cc]
test eax, eax
je 0x42af36
call fcn.00409750
mov esi, eax
cmp dword [0x49fcb0], 0xffffffff
je 0x42af36
test esi, esi
je 0x42af36
xor eax, eax
push 1
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov eax, dword [0x492164]
push 0
lea ecx, [ebp - 0x6b0]
push ecx
push esi
mov dword [ebp - 0x6a8], 0x2b
mov dword [ebp - 0x6a0], eax
call fcn.004095e0
mov ebx, dword [0x4912e8]
add esp, 0x10
test eax, eax
jne 0x42af36
test dword [0x4910e8], ebx
je 0x42ba9b
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_SCREENSAVERSTART_on_pipe__s_.
call fcn.0040a4a0
mov ebx, dword [0x4912e8]
add esp, 8
test dword [0x4910e8], ebx
je 0x42ba9b
push str.Finish_EXTEVENT_REQTYPE_CLT_STARTSCREENSAVEREVENT_n
call fcn.0040a4a0
add esp, 4
jmp 0x42ba9b
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42af7e
test dword [0x4910e8], ebx
je 0x42ba9b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_WRITEEVENTLOGMSG._ulSessionId___d__out_of_range
call fcn.0040a4a0
add esp, 8
jmp 0x42ba9b
mov ecx, dword [0x492298]
test ecx, ecx
mov eax, dword [ebp - 0xcbc]
mov dword [ebp + 0xc], eax
je 0x42ba9b
mov edx, dword [ebp - 0xcc0]
push 0
push 0
push 0
push eax
push edx
mov dword [ebp - 4], 0
call fcn.00410b60
cmp dword [ebp + 0xc], 0x8000006e
mov dword [ebp - 4], 0xffffffff
jne 0x42ba9b
push 0xc
call fcn.004238a0
add esp, 4
jmp 0x42ba9b
test dword [0x4910e8], ebx
je 0x42b007
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_REGISTERCOMOBJECT_is_called
call fcn.0040a4a0
add esp, 4
mov ecx, dword [0x49fcb0]
push 1
push ecx
call fcn.00429930
add esp, 8
cmp eax, 0xffffffff
je 0x42ba9b
mov edx, dword [0x48644c]
lea ebx, [eax + eax*8]
shl ebx, 5
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0xcc0]
mov dword [ebp + 0x10], ebx
lea ebx, [ebx + 0x49fdc4]
push ecx
mov ecx, ebx
mov dword [ebp - 0x18], 1
mov dword [ebp + 0xc], edx
call fcn.00429cc0
mov edx, dword [ebp + 0xc]
cmp edx, dword [0x48644c]
jne 0x42ba9b
push 0x30
call fcn.0045f1c6
mov edx, eax
add esp, 4
xor eax, eax
test edx, edx
je 0x42b07e
mov ecx, 0xc
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, edx
lea edi, [eax + 8]
mov ecx, 0xa
lea esi, [ebp - 0xcc0]
rep movsd dword es:[edi], dword [esi]
mov dword [eax], 0
mov dword [eax + 4], 0
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x42b0ac
mov dword [eax + 4], ecx
mov ecx, dword [ebx + 8]
mov dword [ecx], eax
jmp 0x42b0af
mov dword [ebx + 4], eax
mov edx, dword [ebx + 0xc]
mov dword [ebx + 8], eax
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
inc edx
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov dword [ebx + 0xc], edx
push 1
mov dword [ebp - 0x6a8], 0x2d
mov ecx, 0xa
lea esi, [ebp - 0xcc0]
lea edi, [ebp - 0x6a0]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x10]
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x6b0]
push eax
lea esi, [esi + 0x49fcbc]
push esi
call fcn.004095e0
add esp, 0x10
test eax, eax
jne 0x42b800
mov ecx, dword [0x4910e8]
test dword [0x4912e8], ecx
je 0x42b132
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_CLT_REGISTERCOMOBJECT_on_pipe__s_.
call fcn.0040a4a0
add esp, 8
mov dword [ebp - 0x18], 1
jmp 0x42ba6c
test dword [0x4910e8], ebx
je 0x42b153
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_UNREGISTERCOMOBJECT_is_called
call fcn.0040a4a0
add esp, 4
mov eax, dword [0x49fcb0]
push 1
push eax
call fcn.00429930
add esp, 8
cmp eax, 0xffffffff
je 0x42ba9b
lea ebx, [eax + eax*8]
xor edi, edi
shl ebx, 5
lea esi, [ebx + 0x49fdc4]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x50], vtable.Eeu::LinkedListIterator_struct_tagComCallbacks_.0
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], edi
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0xcc0]
push edx
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.0042a0f0
test al, al
je 0x42b256
cmp esi, dword [ebp - 0x4c]
jne 0x42b1c5
mov eax, dword [ebp - 0x48]
cmp eax, edi
je 0x42b1c5
push edi
push edi
push eax
mov ecx, esi
call fcn.0042a160
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
push 1
mov dword [ebp - 0x6a8], 0x36
mov ecx, 0xa
lea esi, [ebp - 0xcc0]
lea edi, [ebp - 0x6a0]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x6b0]
push ecx
lea esi, [ebx + 0x49fcbc]
push esi
call fcn.004095e0
add esp, 0x10
test eax, eax
jne 0x42b240
mov edx, dword [0x4910e8]
test dword [0x4912e8], edx
je 0x42b237
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_CLT_UNREGISTERCOMOBJECT_on_pipe__s_.
call fcn.0040a4a0
add esp, 8
mov dword [ebp - 0x18], 1
jmp 0x42b247
mov dword [ebp - 0x18], 2
mov eax, dword [0x492164]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 4], 0xffffffff
jmp 0x42ba9b
mov esi, dword [0x4910e8]
test ebx, esi
je 0x42b285
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_GETCOMCALLBACKS_is_called
call fcn.0040a4a0
mov ebx, dword [0x4912e8]
mov esi, dword [0x4910e8]
add esp, 4
mov edx, dword [ebp - 0xcc4]
cmp edx, 0x14
jb 0x42b2ab
test ebx, esi
je 0x42ba9b
push edx
push str.NamePipeInstance_warning_EXTEVENT_REQTYPE_CLT_GETCOMCALLBACKS_ulSessionId___u__out_of_range
call fcn.0040a4a0
add esp, 8
jmp 0x42ba9b
xor eax, eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
push 1
rep stosd dword es:[edi], eax
push edx
mov dword [ebp - 0x18], 2
call fcn.00429930
add esp, 8
cmp eax, 0xffffffff
jne 0x42b2fb
test ebx, esi
je 0x42bad6
mov ecx, dword [0x49fcb0]
push ecx
push str.NamePipeServiceInstance:_BUG_activesession__d_notin_list
call fcn.0040a4a0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea esi, [eax + eax*8]
shl esi, 5
mov ebx, dword [esi + 0x49fdc8]
lea eax, [esi + 0x49fdc4]
mov dword [ebp - 0x50], vtable.Eeu::LinkedListIterator_struct_tagComCallbacks_.0
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], ebx
test ebx, ebx
mov dword [ebp - 4], 3
je 0x42b3bd
lea esp, [esp]
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
lea edx, [ebp - 0x6a0]
rep stosd dword es:[edi], eax
push edx
lea ecx, [ebp - 0x50]
call fcn.00429bf0
test al, al
je 0x42b37c
push 1
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x6b0]
push ecx
lea edx, [esi + 0x49fcbc]
push edx
mov dword [ebp - 0x6a8], 0x2d
call fcn.004095e0
add esp, 0x10
test eax, eax
je 0x42b395
test ebx, ebx
je 0x42b3bd
mov ebx, dword [ebx]
test ebx, ebx
mov dword [ebp - 0x48], ebx
jne 0x42b330
mov dword [ebp - 4], 0xffffffff
jmp 0x42ba6c
mov eax, dword [0x4910e8]
test dword [0x4912e8], eax
je 0x42b3b6
lea ecx, [esi + 0x49fcbc]
push ecx
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_CLT_GETCOMCALLBACKS_on_pipe__s_.
call fcn.0040a4a0
add esp, 8
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0xffffffff
jmp 0x42ba6c
test dword [0x4910e8], ebx
je 0x42b3de
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_APPLYADCBYSELECTED.._is_called
call fcn.0040a4a0
add esp, 4
mov eax, dword [0x49fcb0]
push 1
push eax
call fcn.00429930
mov edx, eax
add esp, 8
cmp edx, 0xffffffff
je 0x42ba9b
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x6a8], 0x2f
mov ecx, 0xa
lea esi, [ebp - 0xcc0]
lea edi, [ebp - 0x6a0]
rep movsd dword es:[edi], dword [esi]
lea esi, [edx + edx*8]
push 1
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x6b0]
shl esi, 5
push edx
lea esi, [esi + 0x49fcbc]
push esi
call fcn.004095e0
add esp, 0x10
test eax, eax
jne 0x42b470
mov eax, dword [0x4910e8]
test dword [0x4912e8], eax
je 0x42b470
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_APPLYADCBYSELECTED_on_pipe__s_.
call fcn.0040a4a0
add esp, 8
mov ecx, dword [0x492164]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
jmp 0x42ba9b
test dword [0x4910e8], ebx
je 0x42b49a
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_APPLYADCBYSELECTED.._is_called
call fcn.0040a4a0
add esp, 4
mov edx, dword [0x49fcb0]
push 1
push edx
call fcn.00429930
mov edx, eax
add esp, 8
cmp edx, 0xffffffff
je 0x42ba9b
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x6a8], 0x3d
mov ecx, 0x27
lea esi, [ebp - 0xcc0]
lea edi, [ebp - 0x6a0]
rep movsd dword es:[edi], dword [esi]
push 1
lea esi, [edx + edx*8]
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x6b0]
shl esi, 5
push ecx
lea esi, [esi + 0x49fcbc]
push esi
call fcn.004095e0
add esp, 0x10
test eax, eax
jne 0x42b52e
mov edx, dword [0x4910e8]
test dword [0x4912e8], edx
je 0x42b52e
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_APPLYADCBYSELECTED_on_pipe__s_.
call fcn.0040a4a0
add esp, 8
mov eax, dword [0x492164]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x2c
jmp 0x42ba9b
test dword [0x4910e8], ebx
je 0x42b557
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_APPLYADCBY.._is_called
call fcn.0040a4a0
add esp, 4
mov ecx, dword [0x49fcb0]
push 1
push ecx
call fcn.00429930
mov edx, eax
add esp, 8
cmp edx, 0xffffffff
je 0x42ba9b
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x6a8], 0x38
mov ecx, 0x185
lea esi, [ebp - 0xcc4]
lea edi, [ebp - 0x6a4]
rep movsd dword es:[edi], dword [esi]
lea esi, [edx + edx*8]
push 1
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x6b0]
shl esi, 5
push eax
lea esi, [esi + 0x49fcbc]
push esi
call fcn.004095e0
add esp, 0x10
test eax, eax
jne 0x42ba6c
mov ecx, dword [0x4910e8]
test dword [0x4912e8], ecx
je 0x42b132
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_APPLYADCBYCONNECTED_on_pipe__s_.
call fcn.0040a4a0
add esp, 8
mov dword [ebp - 0x18], 1
jmp 0x42ba6c
test dword [0x4910e8], ebx
je 0x42b614
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_PRPCESSPENDINGHPD_is_called
call fcn.0040a4a0
add esp, 4
cmp dword [0x49fcb0], 0xffffffff
je 0x42ba9b
mov eax, dword [0x4920b8]
test eax, eax
je 0x42b6b1
mov ecx, dword [eax + 0x128]
test ecx, ecx
je 0x42b6b1
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov eax, dword [eax + 0x128]
lea edx, [ebp - 0x70]
push edx
mov ecx, eax
call fcn.004062f0
test eax, eax
je 0x42b6aa
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x24], edx
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x34], ecx
mov ecx, dword [0x492164]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
jmp 0x42ba9b
mov dword [ebp - 0x18], 1
mov ecx, dword [0x492164]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
jmp 0x42ba9b
test dword [0x4910e8], ebx
mov esi, dword [ebp - 0xcc4]
mov dword [ebp - 0x44], esi
je 0x42b6ea
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_KILLCLIENTPROCESS_is_called
call fcn.0040a4a0
mov ebx, dword [0x4912e8]
add esp, 4
cmp esi, 0x14
jb 0x42b714
cmp esi, 0xffffffff
je 0x42b71e
test dword [0x4910e8], ebx
je 0x42ba9b
push 0xffffffffffffffff
push str.NamePipeInstance_warning_EXTEVENT_REQTYPE_CLT_KILLCLIENTPROCESS_ulSessionId___u__out_of_range
call fcn.0040a4a0
add esp, 8
jmp 0x42ba9b
cmp esi, 0xffffffff
je 0x42b71e
mov dword [ebp + 0xc], esi
jmp 0x42b72a
mov dword [ebp + 0xc], 0
mov esi, 0x14
mov ebx, 0x49fcbc
mov dword [ebp + 0x10], 0x14
mov eax, dword [ebp + 0xc]
cmp eax, esi
ja 0x42b79a
mov ecx, dword [ebx - 4]
cmp ecx, eax
je 0x42b74b
inc eax
cmp eax, esi
jbe 0x42b740
jmp 0x42b79a
xor eax, eax
push 1
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x6b0]
push eax
push ebx
mov dword [ebp - 0x6a8], 0x35
call fcn.004095e0
add esp, 0x10
test eax, eax
jne 0x42b79a
mov ecx, dword [0x4910e8]
test dword [0x4912e8], ecx
je 0x42b79a
push ebx
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_CLT_KILLCLIENTPROCESS_on_pipe__s_.
call fcn.0040a4a0
add esp, 8
mov eax, dword [ebp + 0x10]
add ebx, 0x120
dec eax
mov dword [ebp + 0x10], eax
jne 0x42b736
cmp dword [ebp - 0x44], 0xffffffff
jne 0x42b7c2
mov edx, dword [0x4920b0]
push 0
push 0
push 0x12
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov eax, dword [0x492164]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x2c
jmp 0x42ba9b
test dword [0x4910e8], ebx
je 0x42b7f7
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_SVR_ISTMMHANDLEDBYADC_is_called
call fcn.0040a4a0
add esp, 4
mov ecx, dword [0x4920d0]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x18], 2
jmp 0x42ba6c
mov eax, dword [ebp - 0xcc0]
mov ecx, dword [ebp - 0xcbc]
mov edx, dword [ebp - 0xcb8]
mov dword [0x492084], eax
mov eax, dword [ebp - 0xcb4]
mov dword [0x492088], ecx
mov ecx, dword [ebp - 0xcb0]
mov dword [0x49207c], 1
mov dword [0x49208c], edx
mov dword [0x492090], eax
mov dword [0x492094], ecx
jmp 0x42ba9b
mov eax, dword [0x49207c]
test eax, eax
je 0x42ba9b
test dword [0x4910e8], ebx
mov dword [0x49207c], 0
je 0x42b881
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_SVR_ISTMMHANDLEDBYADC_is_called
call fcn.0040a4a0
add esp, 4
mov edx, dword [0x492084]
mov eax, dword [0x492088]
mov ecx, dword [0x49208c]
mov dword [ebp - 0x34], edx
mov edx, dword [0x492090]
mov dword [ebp - 0x30], eax
mov eax, dword [0x492094]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [0x492164]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
jmp 0x42ba9b
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0xed0]
rep stosd dword es:[edi], eax
test dword [0x4910e8], ebx
mov dword [ebp + 0xc], 0
je 0x42b8f3
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_ENABLESTOPSERVICE_is_called
call fcn.0040a4a0
add esp, 4
push 4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x42b931
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0xed0]
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_ENABLESTOPSERVICE._failed_to_open_SCM._err_d
push edx
call fcn.0045f139
lea eax, [ebp - 0xed0]
push eax
call fcn.00410a60
add esp, 0x10
jmp 0x42ba5c
cmp dword [0x492098], 7
mov eax, str.Ati_HotKey_Poller
jbe 0x42b944
mov eax, str.Ati_External_Event_Utility
push 4
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x42b987
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0xed0]
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_ENABLESTOPSERVICE._failed_to_OpenService._err_d
push ecx
call fcn.0045f139
lea edx, [ebp - 0xed0]
push edx
call fcn.00410a60
add esp, 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x42ba5c
mov esi, dword [0x49f63c]
xor eax, eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x80], eax
push ecx
mov dword [ebp - 0x7c], eax
push edi
mov dword [ebp - 0x78], eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x42b9f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0xed0]
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_ENABLESTOPSERVICE._failed_to_QueryServiceStatus._err_d
push edx
call fcn.0045f139
lea eax, [ebp - 0xed0]
push eax
call fcn.00410a60
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 0x10
push edi
call esi
push ebx
call esi
jmp 0x42ba5c
or dword [ebp - 0x88], 1
mov edx, dword [esi + 0x4c]
lea ecx, [ebp - 0x90]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x42ba3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xed0]
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_ENABLESTOPSERVICE._failed_to_SetServiceStatus._err_d
push eax
call fcn.0045f139
lea ecx, [ebp - 0xed0]
push ecx
call fcn.00410a60
mov esi, dword [ebp + 0xc]
add esp, 0x10
jmp 0x42ba44
mov esi, 1
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push ebx
call edi
cmp esi, 1
mov dword [ebp - 0x18], 2
je 0x42ba63
mov dword [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x34], eax
mov edx, dword [0x492164]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0x2c
jmp 0x42ba9b
test dword [0x4910e8], ebx
je 0x42ba9b
mov eax, dword [ebp - 0xcc0]
push eax
push esi
push str.NamePipeServiceInstance._request__d_not_supported_for_data__d
call fcn.0040a4a0
add esp, 0xc
mov eax, dword [ebp + 8]
push 0
lea ecx, [ebp - 0x74]
push ecx
push 0x2c
lea edx, [ebp - 0x40]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42babb
cmp dword [ebp - 0x74], 0x2c
je 0x42bad6
mov ecx, dword [0x4910e8]
test dword [0x4912e8], ecx
je 0x42bad6
push str.Write_to_Pipe_Failed
call fcn.0040a4a0
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret