Function at 0x41ea10
Capabilities:
Query service configuration

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, ecx
sub esp, 0x5c
mov eax, dword [ecx + 0x7c]
test eax, eax
je 0x41ebf3
mov dword [esp + 4], 0x1000
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
sub esp, 8
test eax, eax
mov ebx, eax
je 0x41eca0
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1000
mov dword [esp], eax
call fcn.004327e0
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x1000
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x7c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
sub esp, 0x10
test eax, eax
mov edi, eax
jne 0x41eb40
call fcn.0042c430
lea esi, [esp + 0x40]
lea edx, [esp + 0x38]
mov dword [esp], 0x15
mov ebp, eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x38], esi
call fcn.004ed900
mov edx, dword [esp + 0x2c]
mov dword [eax], 0x7551794d
mov dword [eax + 4], 0x53797265
mov dword [eax + 8], 0x69767265
mov dword [eax + 0xc], 0x6f436563
mov dword [eax + 0x10], 0x6769666e
mov byte [eax + 0x14], 0
mov dword [esp + 0x10], str.QueryServiceConfig_failed
mov dword [esp + 0xc], 0x8d
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], ebp
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], 0x14
mov dword [esp + 0x3c], 0x14
call fcn.0042ce70
mov eax, dword [esp + 0x38]
cmp eax, esi
je 0x41eb28
mov dword [esp], eax
call fcn.004ed8c0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
mov eax, edi
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov edx, dword [ebx + 4]
mov eax, dword [esp + 0x70]
mov dword [eax], edx
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
lea edi, [esp + 0x38]
lea esi, [esp + 0x40]
call fcn.0042c430
mov dword [esp], 0x15
mov ebx, eax
mov dword [esp + 0x38], esi
call fcn.004ed900
mov dword [eax], 0x7551794d
mov dword [eax + 4], 0x53797265
mov dword [eax + 8], 0x69767265
mov dword [eax + 0xc], 0x6f436563
mov dword [eax + 0x10], 0x6769666e
mov byte [eax + 0x14], 0
mov dword [esp + 0x10], str.QueryServiceConfig_successfully
mov dword [esp + 0xc], 0x94
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], 0x14
mov dword [esp + 0x3c], 0x14
call fcn.0042ce70
mov eax, dword [esp + 0x38]
cmp eax, esi
je 0x41ebe2
mov dword [esp], eax
call fcn.004ed8c0
add esp, 0x5c
mov edi, 1
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret 4
mov eax, dword [0x5510cc]
mov dword [esp + 8], 0x10020
mov dword [esp + 4], eax
mov eax, dword [ecx + 0x78]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
sub esp, 0xc
test eax, eax
mov dword [esi + 0x7c], eax
jne 0x41ea24
lea edi, [esp + 0x38]
lea esi, [esp + 0x40]
call fcn.0042c430
mov dword [esp], 0x15
mov ebx, eax
mov dword [esp + 0x38], esi
call fcn.004ed900
mov dword [eax], 0x7551794d
mov dword [eax + 4], 0x53797265
mov dword [eax + 8], 0x69767265
mov dword [eax + 0xc], 0x6f436563
mov dword [eax + 0x10], 0x6769666e
mov byte [eax + 0x14], 0
mov dword [esp + 0x10], str.Couldnt_open_service
mov dword [esp + 0xc], 0x7d
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp], ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], 0x14
mov dword [esp + 0x3c], 0x14
call fcn.0042ce70
jmp 0x41ed1d
lea edi, [esp + 0x38]
lea esi, [esp + 0x40]
call fcn.0042c430
mov dword [esp], 0x15
mov ebx, eax
mov dword [esp + 0x38], esi
call fcn.004ed900
mov dword [eax], 0x7551794d
mov dword [eax + 4], 0x53797265
mov dword [eax + 8], 0x69767265
mov dword [eax + 0xc], 0x6f436563
mov dword [eax + 0x10], 0x6769666e
mov byte [eax + 0x14], 0
mov dword [esp + 0x10], str.Allocate_failed
mov dword [esp + 0xc], 0x86
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp], ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], 0x14
mov dword [esp + 0x3c], 0x14
call fcn.0042ce70
mov eax, dword [esp + 0x38]
cmp eax, esi
je 0x41ed2d
mov dword [esp], eax
call fcn.004ed8c0
add esp, 0x5c
xor edi, edi
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret 4