Function at 0x4a42d0
Capabilities:
Query service status
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x270
mov eax, dword [0x596fb8]
xor eax, esp
mov dword [esp + 0x26c], eax
cmp dword [0x597e70], 0
push edi
jne 0x4a43d2
mov eax, dword [esp + 0x278]
mov dword [0x5981b0], eax
call fcn.0048ece0
call fcn.004b4950
call fcn.0051ad30
call fcn.00408040
call fcn.00496be0
call fcn.004a1650
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
mov edi, eax
push edi
push str.ole_initialize:__08x_n
push 0xffffff00
call fcn.0048f0a0
add esp, 0xc
call fcn.004a2570
mov ecx, dword [0x598188]
mov eax, dword [ecx]
test eax, 0x2000
je 0x4a4376
mov edx, dword [ecx + 0x44]
push edx
mov edx, dword [ecx + 0x40]
mov ecx, dword [ecx + 4]
push edx
mov edx, eax
and ecx, 0x40000
push ecx
and edx, 0x1000000
push edx
and eax, 8
push eax
call fcn.004bd730
jmp 0x4a4895
test eax, 0x20000
je 0x4a43a4
call fcn.00404160
test eax, eax
je 0x4a4895
xor eax, eax
pop edi
mov ecx, dword [esp + 0x26c]
xor ecx, esp
call fcn.0054962d
add esp, 0x270
ret 8
test eax, 0x4000
je 0x4a43d6
call fcn.004aeca0
test eax, eax
jne 0x4a43d6
xor edi, edi
call fcn.004a38f0
test eax, eax
jne 0x4a4895
mov dword [0x598184], 1
jmp 0x4a4895
mov edi, dword [esp + 4]
push 0
push 0
push 0
push 0
call dword [0x597dbc]
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 8
mov dword [esp + 0xc], 0x42ff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.00409340
mov eax, dword [0x598188]
cmp dword [eax + 0x38], 0
je 0x4a4418
mov ecx, dword [eax + 0x38]
push ecx
call fcn.00409320
push esi
mov esi, dword [0x58a698]
test esi, esi
jle 0x4a4462
mov ecx, dword [0x58def4]
imul ecx, esi
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [0x58def8]
sar edx, 4
imul ecx, esi
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [0x58def4], eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov dword [0x58def8], ecx
cmp byte [0x598018], 0
je 0x4a4492
call fcn.004aeca0
test eax, eax
jne 0x4a4492
xor edi, edi
call fcn.004a38f0
test eax, eax
jne 0x4a4894
mov dword [0x598184], 1
jmp 0x4a4894
cmp byte [0x598017], 0
je 0x4a44a5
mov dword [0x598128], 1
cmp byte [0x598016], 0
jne 0x4a44bc
mov edx, dword [0x598188]
test dword [edx], 0x1000000
je 0x4a44c3
push 0
call fcn.0048f510
cmp byte [0x598015], 0
je 0x4a44d3
push 1
call fcn.0048f400
call fcn.0048f0c0
push str.load_localization_n
push 0xffffff00
call fcn.0048f0a0
mov eax, dword [0x598188]
mov eax, dword [eax + 0x58]
add esp, 8
cmp eax, 0xffffffff
jne 0x4a44fc
mov eax, dword [0x597eb0]
push eax
call fcn.004a16c0
mov eax, dword [0x598188]
test byte [eax], 8
je 0x4a4518
push 1
call fcn.0048f400
mov eax, dword [0x598188]
mov ecx, 0x40000
test dword [eax + 4], ecx
je 0x4a452e
mov dword [0x598128], 1
jmp 0x4a453d
test dword [eax + 8], ecx
je 0x4a453d
mov dword [0x598128], 0
push edi
push str.ole_initialize:__08x_n
push 0xffffff00
call fcn.0048f0a0
mov ecx, dword [0x598188]
add esp, 0xc
test dword [ecx], 0x1000
je 0x4a4563
call fcn.0040d0e0
mov edx, dword [0x598188]
push ebx
mov ebx, 4
cmp dword [edx + 0x64], ebx
push ebp
jne 0x4a4665
call fcn.004aeca0
test eax, eax
jne 0x4a4665
push ebx
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
xor esi, esi
xor edi, edi
test ebp, ebp
je 0x4a45f4
lea eax, [esp + 0x78]
push eax
call fcn.004ba090
push ebx
lea ecx, [esp + 0x7c]
push ecx
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x4a45f4
lea edx, [esp + 0x10]
push edx
push 0x24
lea eax, [esp + 0x3c]
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4a45f4
mov eax, dword [esp + 0x50]
test eax, eax
je 0x4a45e7
push eax
push edi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
jmp 0x4a45f4
mov ecx, dword [0x598188]
mov dword [ecx + 0x64], 5
mov edx, dword [0x598188]
cmp dword [edx + 0x64], ebx
jne 0x4a463e
push 0
push 0
push 0x4fd2f0
call fcn.004b9d00
mov ebx, eax
test ebx, ebx
je 0x4a4631
push ebx
call fcn.004b9cc0
test eax, eax
je 0x4a4629
mov eax, dword [0x598188]
mov dword [eax + 0x64], 5
push ebx
call fcn.004b8ca0
jmp 0x4a463e
mov ecx, dword [0x598188]
mov dword [ecx + 0x64], 5
test edi, edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4a4657
push 0xea60
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call ebx
test esi, esi
je 0x4a465e
push esi
call ebx
test ebp, ebp
je 0x4a4665
push ebp
call ebx
call fcn.004a3ec0
call fcn.004a2aa0
test eax, eax
jne 0x4a4892
mov edx, dword [0x598188]
cmp dword [edx + 0x78], eax
je 0x4a46b8
call fcn.004b3180
call fcn.004ae800
push str.load_everything_icon_n
push 0xffffff00
call fcn.0048f0a0
add esp, 8
call fcn.004a2450
mov eax, dword [0x598188]
mov ecx, dword [eax + 0x78]
push ecx
push 0
call fcn.00516340
jmp 0x4a4892
push str.create_mutex_n
push 0xffffff00
call fcn.0048f0a0
mov esi, dword [esp + 0x290]
add esp, 8
cmp byte [0x597e95], 0
jne 0x4a46f6
push esi
call fcn.004a3d20
test eax, eax
jne 0x4a46f6
push str.mutex_exists_n
call fcn.0048f080
add esp, 4
jmp 0x4a4892
mov edx, dword [0x598188]
test byte [edx], 4
je 0x4a470e
call fcn.004a3a50
test eax, eax
jne 0x4a4892
call fcn.004b3180
call fcn.004ae800
push str.load_everything_icon_n
push 0xffffff00
call fcn.0048f0a0
add esp, 8
call fcn.004a2450
push str.bookmarks_n
push 0xffffff00
call fcn.0048f0a0
add esp, 8
call fcn.00403670
push str.filters_n
push 0xffffff00
call fcn.0048f0a0
add esp, 8
call fcn.00499e50
push str.search_history_n
push 0xffffff00
call fcn.0048f0a0
add esp, 8
call fcn.004b8890
push str.set_hook_n
push 0xffffff00
call fcn.0048f0a0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x4a3ca0
push 0xffffffffffffffff
call dword [0x597e48]
push str.create_tray_n
push 0xffffff00
mov dword [esp + 0x18], eax
call fcn.0048f0a0
add esp, 8
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x38], 0x44
call dword [0x597d44]
test byte [esp + 0x60], 1
jne 0x4a47d1
mov word [esp + 0x64], si
movzx ecx, word [esp + 0x64]
push ecx
call fcn.004c1ab0
push str.enter_main_loop_n
push 0xffffff00
call fcn.0048f0a0
mov edi, dword [0x597e18]
mov ebx, dword [0x597de8]
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
add esp, 8
push 0
push 0
push 0
push 0
lea edx, [esp + 0x28]
push edx
call edi
test eax, eax
je 0x4a4877
cmp dword [0x598128], 0
je 0x4a4842
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
push str.MSG:__p__04x__p__p_n
push 0xff00ff00
call fcn.0048f0a0
add esp, 0x18
cmp dword [esp + 0x1c], 0x12
je 0x4a4887
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
test eax, eax
jle 0x4a4887
lea esi, [esp + 0x18]
call fcn.004a3820
test eax, eax
jne 0x4a4800
mov edx, esi
push edx
call ebp
mov eax, esi
push eax
call dword [0x597dc4]
jmp 0x4a4800
call fcn.004c76d0
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x4a4800
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
pop ebp
pop ebx
pop esi
call fcn.004a3630
cmp byte [0x59817c], 0
je 0x4a48a8
call fcn.004a3710
call fcn.004a3680
mov ecx, dword [esp + 0x270]
mov eax, dword [0x598184]
pop edi
xor ecx, esp
call fcn.0054962d
add esp, 0x270
ret 8