Function at 0x420c70
Capabilities:
Check os version
Query service status

Disassembly:
push 0xffffffffffffffff
push 0x42e486
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1bc
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x18], 0
mov ebp, dword [sym.imp.KERNEL32.DLL_lstrlenA]
rep stosd dword es:[edi], eax
mov ecx, 0x24
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
mov eax, str.WINDOWS
mov dword [esp + 0x34], 0x94
test eax, eax
jne 0x420ccc
xor eax, eax
jmp 0x420cd3
push str.WINDOWS
call ebp
mov esi, dword [esp + 0x1dc]
push str.WINDOWS
push eax
mov ecx, esi
call fcn.00406e80
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
test eax, eax
jne 0x420d16
mov edx, 0x45030c
test edx, edx
jne 0x420d05
push edx
jmp 0x420fc0
push 0x45030c
call ebp
push 0x45030c
jmp 0x420fc0
mov eax, dword [esp + 0x38]
cmp eax, 6
jne 0x420d2d
lea edx, [esp + 0xc8]
mov edi, str.MpsSvc
jmp 0x420d4d
cmp eax, 5
jne 0x420fab
cmp dword [esp + 0x3c], 1
jne 0x420fab
lea edx, [esp + 0xc8]
mov edi, str.SharedAccess
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xcc]
push ecx
mov ecx, ebx
call fcn.00420c20
mov esi, eax
test esi, esi
jne 0x420db1
mov edx, 0x4502e4
test edx, edx
jne 0x420d98
mov ecx, dword [esp + 0x1dc]
push edx
push eax
jmp 0x420fc3
push 0x4502e4
call ebp
mov ecx, dword [esp + 0x1dc]
push 0x4502e4
push eax
jmp 0x420fc3
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x420def
mov ecx, 0x4502d4
test ecx, ecx
je 0x420dd1
push 0x4502d4
call ebp
mov ecx, dword [esp + 0x1dc]
push 0x4502d4
push eax
call fcn.00406e80
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x420fc8
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [0x436cfc]
mov eax, 0x45ec20
test eax, eax
mov dword [esp + 0x10], edx
je 0x420e61
mov ecx, eax
shr ecx, 0x10
jne 0x420e26
xor eax, eax
mov edx, 0x45ec20
mov ax, dx
lea ecx, [esp + 0x10]
push eax
call fcn.00417360
jmp 0x420e61
push 0x45ec20
call ebp
mov esi, eax
test esi, esi
je 0x420e61
push esi
lea ecx, [esp + 0x14]
call fcn.00406d60
test eax, eax
je 0x420e61
lea eax, [esi + 1]
cmp eax, esi
jb 0x420e61
mov edi, dword [esp + 0x10]
mov ecx, esi
mov edx, ecx
mov esi, 0x45ec20
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1d4], 0
dec eax
je 0x420efb
sub eax, 3
je 0x420eba
sub eax, 3
je 0x420e9e
mov eax, 0x4502c8
test eax, eax
jne 0x420e90
push eax
jmp 0x420f14
push 0x4502c8
call ebp
push 0x4502c8
jmp 0x420f14
mov ecx, 0x4502c0
test ecx, ecx
jne 0x420eac
xor eax, eax
push ecx
jmp 0x420f14
push 0x4502c0
call ebp
push 0x4502c0
jmp 0x420f14
mov ecx, ebx
call fcn.004211d0
test eax, eax
je 0x420ee1
mov edx, 0x4502b8
test edx, edx
jne 0x420ed3
xor eax, eax
push edx
jmp 0x420f14
push 0x4502b8
call ebp
push 0x4502b8
jmp 0x420f14
mov eax, 0x4502b0
test eax, eax
jne 0x420eed
push eax
jmp 0x420f14
push 0x4502b0
call ebp
push 0x4502b0
jmp 0x420f14
mov ecx, 0x4502a8
test ecx, ecx
jne 0x420f08
xor eax, eax
jmp 0x420f0f
push 0x4502a8
call ebp
push 0x4502a8
push eax
lea ecx, [esp + 0x18]
call fcn.00406dc0
lea edx, [esp + 0x10]
push 0x4500a4
lea eax, [esp + 0x18]
push edx
push eax
call fcn.00421d00
mov eax, dword [eax]
mov byte [esp + 0x1d4], 1
push eax
mov ecx, dword [eax - 8]
push ecx
mov ecx, dword [esp + 0x1e4]
call fcn.00406e80
mov eax, dword [esp + 0x14]
mov ecx, dword [0x436d00]
mov esi, dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x420f7e
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x420f7e
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.0042d5f4
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x436d00]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x420fc8
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x420fc8
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.0042d5f4
add esp, 4
jmp 0x420fc8
mov eax, 0x450294
test eax, eax
je 0x420fbb
push 0x450294
call ebp
push 0x450294
push eax
mov ecx, esi
call fcn.00406e80
mov ecx, dword [esp + 0x1cc]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c8
ret 4