Function at 0x41b0582d
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
xor edi, edi
cmp dword [0x41b29404], edi
je 0x41b08486
mov eax, dword [0x41b29408]
pop edi
leave
ret
push esi
xor esi, esi
inc esi
push esi
push edi
push edi
call dword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_OpenSCManagerW]
mov dword [ebp - 0x10], eax
cmp eax, edi
je 0x41b0cae2
push 5
push 0x41b0852c
push eax
call dword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp eax, edi
je 0x41b0ccf1
mov dword [ebp - 4], edi
cmp dword [0x41b29404], edi
jne 0x41b0850f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x41b28b68
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 8]
call dword [sym.imp.API_MS_WIN_Service_winsvc_L1_1_0.dll_QueryServiceStatus]
test eax, eax
je 0x41b0cc5c
mov eax, dword [ebp - 0x28]
cmp eax, 4
jne 0x41b0cb19
mov dword [0x41b29408], esi
mov dword [0x41b29404], esi
mov ecx, dword [0x41b28b68]
cmp dword [0x41b29404], 0
je 0x41b0cbf3
pop ebx
push dword [ebp - 8]
call dword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_CloseServiceHandle]
push dword [ebp - 0x10]
call dword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_CloseServiceHandle]
mov eax, dword [0x41b29408]
pop esi
jmp 0x41b05849
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x41b28b68]
cmp ecx, 0x41b28b68
je 0x41b0cb12
test dword [ecx + 0x1c], 0x400000
je 0x41b0cb12
push eax
push 0x41b1105c
push 0xc
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.41b0298a
xor eax, eax
jmp 0x41b08526
cmp eax, 5
je 0x41b084ef
cmp eax, 6
je 0x41b084ef
cmp eax, 7
je 0x41b084ef
cmp eax, esi
jne 0x41b0cc4e
cmp dword [ebp - 0x20], 0x435
jne 0x41b0cce6
xor eax, eax
cmp dword [ebp - 4], eax
jne 0x41b084fb
lea ecx, [ebp - 0xc]
push ecx
push eax
push eax
push dword [ebp - 8]
call dword [sym.imp.API_MS_WIN_Service_Management_L2_1_0.dll_QueryServiceConfigW]
test eax, eax
jne 0x41b0cb72
call ebx
cmp eax, 0x7a
jne 0x41b0cc9d
push dword [ebp - 0xc]
push 0
push dword [0x41b28b30]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x41b0cc27
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push esi
push dword [ebp - 8]
call dword [sym.imp.API_MS_WIN_Service_Management_L2_1_0.dll_QueryServiceConfigW]
test eax, eax
je 0x41b0cbaa
cmp dword [esi + 4], 2
jne 0x41b0cbd2
jmp 0x41b0cbdc
call ebx
mov ecx, dword [0x41b28b68]
cmp ecx, edi
je 0x41b0cbd2
test dword [ecx + 0x1c], 0x400000
je 0x41b0cbd2
push eax
push 0x41b1105c
push 0xd
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.41b0298a
mov dword [0x41b29404], 1
push esi
push 0
push dword [0x41b28b30]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
inc esi
jmp 0x41b084fb
mov eax, dword [ebp - 4]
imul eax, eax, 0x7d0
cmp eax, 0x1d4c0
jg 0x41b0ccc7
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 4]
cmp dword [0x41b29404], 0
jne 0x41b0850e
jmp 0x41b084ce
mov ecx, dword [0x41b28b68]
cmp ecx, edi
je 0x41b0cc95
test dword [ecx + 0x1c], 0x400000
je 0x41b0cc95
push 0x41b1105c
push 0xe
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.41b02941
jmp 0x41b0cbeb
cmp eax, 2
je 0x41b084fb
jmp 0x41b0cce6
call ebx
mov ecx, dword [0x41b28b68]
cmp ecx, edi
je 0x41b0cc8a
test dword [ecx + 0x1c], 0x400000
je 0x41b0cc8a
push eax
push 0x41b1105c
push 0x10
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.41b0298a
mov ecx, dword [0x41b28b68]
mov dword [0x41b29404], esi
jmp 0x41b08501
xor esi, esi
inc esi
jmp 0x41b08501
call ebx
mov ecx, dword [0x41b28b68]
cmp ecx, edi
je 0x41b0cce6
test dword [ecx + 0x1c], 0x400000
je 0x41b0cce6
push eax
push 0x41b1105c
push 0xf
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.41b0298a
jmp 0x41b0cce6
cmp ecx, edi
je 0x41b0cce6
test dword [ecx + 0x1c], 0x400000
je 0x41b0cce6
push 0x41b1105c
push 0x11
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.41b02941
mov dword [0x41b29404], esi
jmp 0x41b0850e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x41b28b68]
cmp ecx, 0x41b28b68
je 0x41b08518
test dword [ecx + 0x1c], 0x400000
je 0x41b08518
push eax
push 0x41b1105c
push 0x12
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.41b0298a
jmp 0x41b08518