Function at 0x422ae0
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48aed0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
push eax
xor eax, eax
pop eax
je 0x422b06
invalid
mov edi, 0x4bd5a4
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [ebp + 8]
repne scasb al, byte es:[edi]
mov eax, dword [esi + 8]
not ecx
dec ecx
push ecx
push 0x4bd5a4
push eax
push 0
mov ecx, esi
call fcn.00414a80
test eax, eax
jne 0x422b44
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x2000
mov byte [ebp + 0xb], 0
mov dword [ebp - 0x14], 0
call fcn.0048504f
add esp, 4
mov ebx, eax
mov dword [ebp - 0x10], ebx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
mov dword [ebp - 0x1c], eax
je 0x422d60
mov esi, dword [esi + 4]
test esi, esi
jne 0x422b87
mov esi, 0x48d810
push 0xf01ff
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
mov dword [ebp - 0x14], eax
je 0x422d60
mov edi, 0x4bd5a4
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [ebp + 0xc]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esi + 8]
push 0x4bd5a4
push ecx
push eax
mov ecx, esi
call fcn.00414a80
test eax, eax
je 0x422da5
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push edx
push 0x2000
push ebx
push eax
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x422d60
mov edi, dword [ebx + 0xc]
test edi, edi
je 0x422d60
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x422d60
mov cl, byte [esi]
push eax
mov byte [ebp - 0x3c], cl
lea ecx, [ebp - 0x3c]
call fcn.004017b0
mov edx, dword [0x491cd4]
lea ecx, [ebp - 0x3c]
push edx
push 0
push esi
call fcn.004094e0
mov al, byte [ebp + 0xb]
mov esi, dword [ebx + 0xc]
push 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
mov byte [ebp - 0x2c], al
call fcn.004017b0
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
lea ecx, [ebp - 0x2c]
push ebx
call fcn.00401850
test al, al
je 0x422c7c
mov edi, dword [ebp - 0x28]
mov ecx, ebx
mov edx, ecx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2c]
call fcn.004099d0
mov eax, dword [ebp - 0x38]
xor esi, esi
cmp eax, esi
mov byte [ebp - 4], 1
mov bl, 0xff
je 0x422cb0
mov cl, byte [eax - 1]
test cl, cl
je 0x422ca6
cmp cl, bl
je 0x422ca6
mov eax, dword [ebp - 0x34]
push esi
push eax
lea ecx, [ebp - 0x3c]
call fcn.00401850
mov eax, dword [ebp - 0x38]
cmp eax, esi
je 0x422cb0
mov byte [eax - 1], bl
mov eax, dword [ebp - 0x38]
push eax
call fcn.0042b680
mov eax, dword [ebp - 0x28]
add esp, 4
cmp eax, esi
je 0x422ce5
mov cl, byte [eax - 1]
test cl, cl
je 0x422cdb
cmp cl, bl
je 0x422cdb
mov ecx, dword [ebp - 0x24]
push esi
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00401850
mov eax, dword [ebp - 0x28]
cmp eax, esi
je 0x422ce5
mov byte [eax - 1], bl
mov eax, dword [ebp - 0x28]
push eax
call fcn.0042b680
mov eax, dword [ebp - 0x38]
add esp, 4
cmp eax, esi
mov ecx, 0x48d810
je 0x422cfc
mov ecx, eax
mov eax, dword [ebp - 0x28]
cmp eax, esi
jne 0x422d08
mov eax, 0x48d810
push ecx
push eax
call fcn.0042c9d0
add esp, 8
test eax, eax
je 0x422d1a
mov byte [ebp + 0xb], 1
mov ecx, dword [ebp - 0x28]
cmp ecx, esi
je 0x422d3d
mov al, byte [ecx - 1]
test al, al
je 0x422d33
cmp al, bl
je 0x422d33
dec al
mov byte [ecx - 1], al
jmp 0x422d3d
dec ecx
push ecx
call fcn.00485078
add esp, 4
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x28], esi
cmp ecx, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
je 0x422d5d
mov al, byte [ecx - 1]
test al, al
je 0x422d99
cmp al, bl
je 0x422d99
dec al
mov byte [ecx - 1], al
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.00485078
mov eax, dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 4
test eax, eax
je 0x422d79
push eax
call esi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x422d83
push eax
call esi
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + 0xb]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
dec ecx
push ecx
call fcn.00485078
add esp, 4
jmp 0x422d5d
mov byte [ebp + 0xb], 1
jmp 0x422d60