Function at 0x40918c
Capabilities:
Query or enumerate registry value
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x441008]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x44], 0x24
mov ebx, ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov eax, dword [0x4410a0]
cmp eax, 0x4410a0
je 0x4091d1
test byte [eax + 0x1c], 0x10
je 0x4091d1
cmp byte [eax + 0x19], 4
jae 0x42053c
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.api_ms_win_core_profile_l1_1_0.dll_QueryPerformanceFrequency]
mov eax, dword [ebp - 0x4c]
push 4
mov dword [section.RT_BSS], eax
mov eax, dword [ebp - 0x48]
push edi
mov dword [0x440004], eax
call dword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoInitializeEx]
mov esi, eax
test esi, esi
js 0x420554
push edi
push edi
push 1
push edi
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_CreateEventW]
mov dword [ebx + 0x44], eax
test eax, eax
je 0x420588
push edi
push edi
push 1
push edi
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_CreateEventW]
mov dword [ebx + 0x48], eax
test eax, eax
je 0x420588
call fcn.00418a67
mov esi, eax
test esi, esi
js 0x409417
push edi
lea eax, [ebp - 0x30]
push eax
push 1
push 0x401b20
call dword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x420588
push dword [ebp - 0x30]
push 0x401bb0
push 0xa
push 0x401bd4
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
mov edi, eax
mov eax, dword [0x4410a0]
cmp eax, 0x4410a0
je 0x409286
test byte [eax + 0x1c], 0x10
je 0x409286
cmp byte [eax + 0x19], 4
jae 0x4205b6
test edi, edi
jne 0x4207b5
push dword [ebp - 0x30]
xor ecx, ecx
push 0x419df0
push ecx
push 0x4d2
push 0x21
push ecx
push ecx
push 0x401be8
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIf3]
mov edi, eax
mov eax, dword [0x4410a0]
cmp eax, 0x4410a0
je 0x4092cb
test byte [eax + 0x1c], 0x10
je 0x4092cb
cmp byte [eax + 0x19], 4
jae 0x4205cf
test edi, edi
jne 0x4207b5
push dword [ebx + 0x58]
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_SetEvent]
test eax, eax
je 0x4205e8
xor eax, eax
xor esi, esi
inc eax
push eax
push esi
push esi
mov dword [0x441798], eax
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x38], edi
test edi, edi
je 0x420627
push 4
push 0x401c2c
push edi
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov edi, eax
mov dword [ebp - 0x34], edi
test edi, edi
je 0x42066e
mov eax, dword [0x4410a0]
cmp eax, 0x4410a0
je 0x40933b
test byte [eax + 0x1c], 0x10
je 0x40933b
cmp byte [eax + 0x19], 4
jae 0x4206b5
lea eax, [ebp - 0x44]
push eax
push 0x24
lea eax, [ebp - 0x2c]
push eax
push esi
push edi
call dword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
je 0x4206cd
cmp dword [ebp - 0x28], 1
je 0x420780
cmp dword [ebp - 0x28], 3
je 0x420780
mov eax, dword [0x4410a0]
mov edi, 0x4410a0
cmp eax, edi
je 0x409387
test byte [eax + 0x1c], 0x10
je 0x409387
cmp byte [eax + 0x19], 4
jae 0x4206fe
mov eax, dword [ebp - 0x10]
push eax
push esi
push 0x100000
mov dword [ebx + 0x50], eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_OpenProcess]
mov dword [ebx + 0x4c], eax
test eax, eax
je 0x420719
sub esp, 0xc
call fcn.00408ce6
mov esi, eax
test esi, esi
js 0x409417
xor eax, eax
mov dword [ebp - 0x40], 4
mov edi, 0x441634
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x3c]
push eax
push ecx
push 0x18
push 0x401c40
push 0x402578
push reloc.MMDevAPI.DLL_Ordinal_2
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
je 0x420773
push ecx
mov ecx, ebx
call fcn.00406476
mov esi, eax
mov eax, dword [0x4410a0]
cmp eax, 0x4410a0
je 0x409417
test byte [eax + 0x1c], 0x10
je 0x409417
cmp byte [eax + 0x19], 4
jae 0x42075a
cmp dword [ebp - 0x30], 0
je 0x409426
push dword [ebp - 0x30]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x409434
push eax
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x409442
push eax
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
cmp dword [ebx + 0x48], 0
mov dword [ebx + 0x40], esi
je 0x409454
push dword [ebx + 0x48]
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_SetEvent]
test esi, esi
js 0x4207cc
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041a3d0
mov esp, ebp
pop ebp
ret 4
push dword [eax + 0x14]
mov edx, 0x403b58
push dword [eax + 0x10]
push 0xb
pop ecx
call fcn.00428048
jmp 0x4091d1
mov eax, dword [0x4410a0]
mov edi, 0x4410a0
cmp eax, edi
je 0x409417
test byte [eax + 0x1c], 0x10
je 0x409417
cmp byte [eax + 0x19], 4
jb 0x409417
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xc
jmp 0x420763
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov esi, eax
jmp 0x4205a6
push esi
push dword [eax + 0x14]
mov edx, 0x403b58
push dword [eax + 0x10]
push 0x13
pop ecx
call fcn.00419c0e
test esi, esi
jle 0x409417
movzx esi, si
jmp 0x4207c1
push edi
push dword [eax + 0x14]
mov edx, 0x403b58
push dword [eax + 0x10]
push 0xd
pop ecx
call fcn.00419c0e
jmp 0x409286
push edi
push dword [eax + 0x14]
mov edx, 0x403b58
push dword [eax + 0x10]
push 0xe
pop ecx
call fcn.00419c0e
jmp 0x4092cb
mov eax, dword [0x4410a0]
cmp eax, 0x4410a0
je 0x409417
test byte [eax + 0x1c], 0x10
je 0x409417
cmp byte [eax + 0x19], 4
jb 0x409417
push dword [ebx + 0x58]
mov edx, 0x403b58
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xf
pop ecx
call fcn.00419c0e
jmp 0x409417
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x42063c
movzx esi, si
or esi, 0x80070000
mov eax, dword [0x4410a0]
cmp eax, 0x4410a0
je 0x409417
test byte [eax + 0x1c], 0x10
je 0x409417
cmp byte [eax + 0x19], 4
jb 0x409417
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x10
jmp 0x420763
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x420683
movzx esi, si
or esi, 0x80070000
mov eax, dword [0x4410a0]
cmp eax, 0x4410a0
je 0x409417
test byte [eax + 0x1c], 0x10
je 0x409417
cmp byte [eax + 0x19], 4
jb 0x409417
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x11
jmp 0x420763
push dword [eax + 0x14]
mov edx, 0x403b58
push dword [eax + 0x10]
push 0x12
pop ecx
call fcn.00428048
jmp 0x40933b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov esi, eax
mov eax, dword [0x4410a0]
cmp eax, 0x4410a0
je 0x4205a6
test byte [eax + 0x1c], 0x10
je 0x4205a6
cmp byte [eax + 0x19], 4
jb 0x4205a6
jmp 0x420592
push dword [ebp - 0x10]
mov edx, 0x403b58
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x14
pop ecx
call fcn.00419c0e
jmp 0x409387
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x42072e
movzx esi, si
or esi, 0x80070000
mov eax, dword [0x4410a0]
cmp eax, edi
je 0x409417
test byte [eax + 0x1c], 0x10
je 0x409417
cmp byte [eax + 0x19], 4
jb 0x409417
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x16
jmp 0x420763
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x18
mov edx, 0x403b58
pop ecx
call fcn.00419c0e
jmp 0x409417
mov eax, dword [ebp - 0x3c]
mov dword [0x441258], eax
jmp 0x4093f1
mov eax, dword [0x4410a0]
cmp eax, 0x4410a0
je 0x4207ab
test byte [eax + 0x1c], 0x10
je 0x4207ab
cmp byte [eax + 0x19], 4
jb 0x4207ab
push dword [eax + 0x14]
mov edx, 0x403b58
push dword [eax + 0x10]
push 0x15
pop ecx
call fcn.00428048
mov esi, 0x80004005
jmp 0x409417
jg 0x4207be
mov esi, edi
jmp 0x409417
movzx esi, di
or esi, 0x80070000
jmp 0x409417
mov eax, dword [0x4410a0]
cmp eax, 0x4410a0
je 0x40945c
test dword [eax + 0x1c], 0x40000
je 0x40945c
cmp byte [eax + 0x19], 2
jb 0x40945c
push esi
push dword [eax + 0x14]
mov edx, 0x403b58
push dword [eax + 0x10]
push 0x19
pop ecx
call fcn.00419c0e
jmp 0x40945c