Function at 0x10027ada
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10028224
mov dword [ebp - 0x14], 0xca4f833f
mov dword [ebp - 8], 0xf3d4210e
mov dword [ebp - 0x58], 0
jmp 0x10027b0d
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x10027b23
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x148], 1
jmp 0x10027b06
mov dword [ebp - 0x14], 0
jmp 0x10027b33
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jg 0x10027b6a
mov dword [ebp - 0x104], 6
cmp dword [ebp - 0x104], 0
jne 0x10027b58
mov dword [ebp - 0x8c], 1
jmp 0x10027b5f
and dword [ebp - 0x8c], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 8], eax
jmp 0x10027b2c
mov dword [ebp - 0x14], 0xffffffe3
jmp 0x10027b7a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff2
jge 0x10027c21
mov dword [ebp - 8], 0
jmp 0x10027b94
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jg 0x10027bd8
mov dword [ebp - 0x10c], 0xa7b051af
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x148], 0x3735b263
jl 0x10027bc0
mov dword [ebp - 0xdc], 1
jmp 0x10027bc7
and dword [ebp - 0xdc], 0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xdc]
mov dword [ebp - 0x10c], eax
jmp 0x10027b8d
mov dword [ebp - 8], 0
jmp 0x10027be8
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jg 0x10027c1c
mov byte [ebp - 0x25], 0
movzx eax, byte [ebp - 0x25]
test eax, eax
je 0x10027c02
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov byte [ebp - 0x1b], 0
movzx eax, byte [ebp - 0x1b]
test eax, eax
je 0x10027c1a
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
jmp 0x10027be1
jmp 0x10027b73
mov byte [ebp - 0x1f], 0
mov dword [ebp - 0x38], 0x1e1e87df
mov dword [ebp - 0x70], 0xfffffff7
mov dword [ebp - 0x10], 0
jmp 0x10027c43
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x10027c56
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 4], 0xfffffff8
jmp 0x10027c3c
mov dword [ebp - 0x10], 0
jmp 0x10027c66
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x10027c79
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2c], 0x4888999d
jmp 0x10027c5f
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x38]
cmp dword [ebp + eax - 4], ecx
jle 0x10027c94
mov dword [ebp - 0x84], 1
jmp 0x10027c9b
and dword [ebp - 0x84], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
cmp dword [ebp - 0x84], eax
jge 0x10027cb9
mov dword [ebp - 0xfc], 1
jmp 0x10027cc0
and dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0xfc]
cmp eax, 0x5689
jne 0x10027cdc
mov dword [ebp - 0xe4], 1
jmp 0x10027ce3
and dword [ebp - 0xe4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
mov dword [ebp - 0x78], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x78]
mov dword [ebp + eax - 0x2c], ecx
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0xe4]
jge 0x10027d14
mov dword [ebp - 0x94], 1
jmp 0x10027d1b
and dword [ebp - 0x94], 0
mov eax, dword [ebp - 0x38]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 4]
imul ecx, dword [ebp - 0x94]
add eax, ecx
je 0x10027e36
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xa4], 0x7c57f39c
cmp dword [ebp - 0x18], 0
je 0x10027d97
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0xa4], eax
jge 0x10027d6e
mov dword [ebp - 0xf4], 1
jmp 0x10027d75
and dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0xf4]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 4]
jne 0x10027d97
mov dword [ebp - 0x9c], 1
jmp 0x10027d9e
and dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x9c], eax
jg 0x10027db5
mov dword [ebp - 0xd0], 1
jmp 0x10027dbc
and dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xd0]
jl 0x10027ddc
cmp dword [ebp - 0xa4], 0
je 0x10027ddc
mov dword [ebp - 0xd8], 1
jmp 0x10027de3
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xd8], eax
jl 0x10027dfa
mov dword [ebp - 0xac], 1
jmp 0x10027e01
and dword [ebp - 0xac], 0
mov eax, dword [ebp - 0xac]
sub eax, 0x5900b088
cmp dword [ebp - 0x18], eax
je 0x10027e1a
mov dword [ebp - 0x6c], 1
jmp 0x10027e1e
and dword [ebp - 0x6c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6c]
mov dword [ebp + eax - 0x2c], ecx
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x70], eax
jmp 0x100280c7
mov dword [ebp - 0xc], 0xc214
mov dword [ebp - 0x50], 0
jmp 0x10027e4d
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x10027e63
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x138], 0x447d0519
jmp 0x10027e46
mov eax, dword [ebp - 0xc]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 4]
test eax, eax
jne 0x10027fdd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c], 0
je 0x10027f26
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x11c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c], 0x395c
jne 0x10027eaf
mov dword [ebp - 0xe0], 1
jmp 0x10027eb6
and dword [ebp - 0xe0], 0
cmp dword [ebp - 0xe0], 0
jne 0x10027ecb
mov dword [ebp - 0xb4], 1
jmp 0x10027ed2
and dword [ebp - 0xb4], 0
cmp dword [ebp - 0xb4], 0xfffb
jbe 0x10027eea
mov dword [ebp - 0xe8], 1
jmp 0x10027ef1
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xe8], eax
jne 0x10027f08
mov dword [ebp - 0xbc], 1
jmp 0x10027f0f
and dword [ebp - 0xbc], 0
mov eax, dword [ebp - 0xbc]
sub eax, dword [ebp - 0xc]
je 0x10027f26
mov dword [ebp - 0xf0], 1
jmp 0x10027f2d
and dword [ebp - 0xf0], 0
cmp dword [ebp - 0xf0], 0x964e
jle 0x10027f52
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 4], 0
je 0x10027f52
mov dword [ebp - 0xc4], 1
jmp 0x10027f59
and dword [ebp - 0xc4], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xc4], eax
je 0x10027f70
mov dword [ebp - 0xf8], 1
jmp 0x10027f77
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xf8], eax
jne 0x10027f8e
mov dword [ebp - 0xcc], 1
jmp 0x10027f95
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0xcc]
sub eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0xc]
jg 0x10027faf
mov dword [ebp - 0x100], 1
jmp 0x10027fb6
and dword [ebp - 0x100], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x100], eax
jne 0x10027fca
mov dword [ebp - 0x74], 1
jmp 0x10027fce
and dword [ebp - 0x74], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x74]
mov dword [ebp + eax - 0x138], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, 0xffff
sub ecx, dword [ebp + eax - 4]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2c], ecx
cmp dword [ebp - 0x38], 0
jne 0x10028012
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 4], 0
jne 0x10028012
and dword [ebp - 0xd4], 0
jmp 0x1002801c
mov dword [ebp - 0xd4], 1
cmp dword [ebp - 0xd4], 6
jae 0x10028031
mov dword [ebp - 0xec], 1
jmp 0x10028038
and dword [ebp - 0xec], 0
cmp dword [ebp - 0xc], 4
je 0x1002804a
mov dword [ebp - 0x114], 1
jmp 0x10028051
and dword [ebp - 0x114], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 4]
mov dword [ebp - 0x13c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c], 9
jl 0x1002807a
mov dword [ebp - 0x108], 1
jmp 0x10028081
and dword [ebp - 0x108], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 4], 0
jl 0x10028097
mov dword [ebp - 0x7c], 1
jmp 0x1002809b
and dword [ebp - 0x7c], 0
mov eax, dword [ebp - 0xec]
add eax, dword [ebp - 0x7c]
mov dword [ebp - 0x80], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x80]
mov dword [ebp + eax - 0x138], ecx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x80]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2c], eax
mov byte [ebp - 0x1d], 0
movzx eax, byte [ebp - 0x1d]
test eax, eax
je 0x100280e4
push 0
push 0
push 0x3ad
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
movzx eax, byte [ebp - 0x1f]
test eax, eax
je 0x100281be
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x68], 0
jmp 0x10028107
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x1002811d
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x110], 0xec2e
jmp 0x10028100
mov dword [ebp - 0x48], 0
jmp 0x1002812d
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x10028193
mov dword [ebp - 0x64], 0x32bb11ac
mov dword [ebp - 0x64], 0
jmp 0x1002814a
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jg 0x10028191
mov dword [ebp - 0x30], 0x3afc3718
mov byte [ebp - 0x21], 0
movzx eax, byte [ebp - 0x21]
test eax, eax
je 0x10028169
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x30], 0
jmp 0x10028179
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1002818f
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x110], 0x425a
jmp 0x10028172
jmp 0x10028143
jmp 0x10028126
mov byte [ebp - 0x23], 0
movzx eax, byte [ebp - 0x23]
test eax, eax
je 0x100281a5
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0x1a2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
mov dword [ebp - 0x60], 0x97f6af11
mov dword [ebp - 0x60], 0xfffffffe
jmp 0x100281d5
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xfffffffd
jge 0x1002821f
mov dword [ebp - 0x40], 0
mov byte [ebp - 0x1a], 0
movzx eax, byte [ebp - 0x1a]
test eax, eax
je 0x100281fd
push 0x1e48
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x40], 0xffffffec
jmp 0x1002820d
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xd
jl 0x1002821d
cmp dword [ebp - 0x40], 0
je 0x1002821b
jmp 0x1002821d
jmp 0x10028206
jmp 0x100281ce
jmp 0x100284e5
mov dword [ebp - 0x3c], 0x64f14790
mov dword [ebp - 0xa0], 0xe468
mov dword [ebp - 0xb8], 0xfffffff6
mov dword [ebp - 0x4c], 0
jmp 0x1002824f
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x10028262
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x34], 0xd435
jmp 0x10028248
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x34], 0x63f9
mov dword [ebp - 0x3c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34], 0x9120
jle 0x10028294
or eax, 0xffffffff
je 0x10028294
mov dword [ebp - 0x88], 1
jmp 0x1002829b
and dword [ebp - 0x88], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
add eax, dword [ebp - 0x88]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x34]
jge 0x100282c3
mov dword [ebp - 0x90], 1
jmp 0x100282ca
and dword [ebp - 0x90], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x90], eax
jl 0x100282e4
mov dword [ebp - 0x98], 1
jmp 0x100282eb
and dword [ebp - 0x98], 0
cmp dword [ebp - 0x98], 0xc694
jl 0x10028309
mov eax, 0xbf079684
test eax, eax
jne 0x10028309
and dword [ebp - 0xa8], 0
jmp 0x10028313
mov dword [ebp - 0xa8], 1
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xa8], eax
jg 0x1002832d
mov dword [ebp - 0xb0], 1
jmp 0x10028334
and dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xb8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
cmp dword [ebp - 0xb8], eax
jl 0x1002835e
mov dword [ebp - 0xc0], 1
jmp 0x10028365
and dword [ebp - 0xc0], 0
cmp dword [ebp - 0xc0], 0xd6a5
je 0x10028394
mov dword [ebp - 0x12c], 0xffffffff
mov dword [ebp - 0xc8], 1
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
jmp 0x10028401
mov dword [ebp - 0x54], 0
jmp 0x100283a4
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x100283ba
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x118], 4
jmp 0x1002839d
mov dword [ebp - 0x3c], 0
jmp 0x100283ca
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xb
jl 0x100283e4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x118], 0
je 0x100283e2
jmp 0x100283e4
jmp 0x100283c3
mov byte [ebp - 0x24], 0
movzx eax, byte [ebp - 0x24]
test eax, eax
je 0x10028401
push 0xbbb
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
mov byte [ebp - 0x1e], 0
mov dword [ebp - 0x120], 0xbca6
mov byte [ebp - 0x1c], 0
movzx eax, byte [ebp - 0x1c]
test eax, eax
je 0x10028423
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
mov byte [ebp - 0x22], 0
movzx eax, byte [ebp - 0x22]
test eax, eax
je 0x10028439
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
movzx eax, byte [ebp - 0x1e]
test eax, eax
je 0x100284aa
mov dword [ebp - 0x5c], 0x97f6af11
mov dword [ebp - 0x5c], 0xfffffffe
jmp 0x10028458
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xfffffffd
jge 0x100284a2
mov dword [ebp - 0x44], 0
mov byte [ebp - 0x26], 0
movzx eax, byte [ebp - 0x26]
test eax, eax
je 0x10028480
push 0x1e48
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x44], 0xffffffec
jmp 0x10028490
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xd
jl 0x100284a0
cmp dword [ebp - 0x44], 0
je 0x1002849e
jmp 0x100284a0
jmp 0x10028489
jmp 0x10028451
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [ebp - 0x128], 8
mov byte [ebp - 0x20], 0
movzx eax, byte [ebp - 0x20]
test eax, eax
je 0x100284ca
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov byte [ebp - 0x19], 0
movzx eax, byte [ebp - 0x19]
test eax, eax
je 0x100284e5
push 0
push 0x1398
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
mov esp, ebp
pop ebp
ret