Function at 0x44a880
Capabilities:
Create thread
Query service status

Disassembly:
sub esp, 0x138
push ebx
push ebp
push esi
mov esi, dword [esp + 0x148]
xor ebp, ebp
push edi
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebx, 1
mov dword [esi + 0x2b34], eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], ebp
call fcn.00445b80
test eax, eax
jne 0x44a8d0
mov dword [esi + 0x17c0], ebx
jmp 0x44a975
call fcn.0044a7d0
test eax, eax
je 0x44a975
push ebx
push ebp
push ebp
mov dword [esi + 0x17bc], ebp
mov dword [esi + 0x17c0], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebp
je 0x44a948
push 4
push 0x47d3f8
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
je 0x44a936
lea eax, [esp + 0x28]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x44a92f
mov eax, dword [esp + 0x2c]
cmp eax, 4
je 0x44a92a
cmp eax, 2
jne 0x44a92f
mov ebp, 1
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebp, ebp
mov ebx, 1
jne 0x44a94e
xor ebp, ebp
mov dword [esp + 0x10], ebp
jmp 0x44a950
xor ebp, ebp
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebp
push ecx
push ebp
push esi
push 0x44a6f0
push ebp
push ebp
call fcn.0045233c
add esp, 0x18
cmp eax, ebp
je 0x44a975
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0x17c0], ebp
jne 0x44aa9d
call fcn.00445660
test eax, eax
je 0x44aa11
push ebx
mov ecx, esi
call fcn.0041f270
cmp eax, ebp
je 0x44a9a0
mov dword [esp + 0x10], ebp
jmp 0x44a9a4
mov dword [esp + 0x24], ebx
cmp eax, 0x6a6
jne 0x44aa07
push 0x47d3dc
push ebp
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventA]
cmp eax, ebp
je 0x44aa07
mov edx, dword [esi + 4]
mov dword [esp + 0x20], eax
push 0x2bf20
lea eax, [esp + 0x20]
push ebp
push eax
push 2
mov dword [esp + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, ebp
je 0x44ac97
cmp eax, ebx
jne 0x44a9f0
mov dword [esp + 0x10], ebx
jmp 0x44aa07
cmp eax, 0x81
je 0x44aa03
cmp eax, 0xffffffff
je 0x44aa03
cmp eax, 0x102
jne 0x44aa07
mov dword [esp + 0x10], ebp
cmp dword [esp + 0x24], ebp
jne 0x44aa9d
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
mov ebx, 0x6a6
mov ecx, edi
inc edi
cmp ecx, 0xa
jge 0x44aa5b
push 1
mov ecx, esi
call fcn.0041f270
mov ebx, eax
test ebx, ebx
je 0x44aa48
push 0
mov ecx, esi
call fcn.0041f270
mov dword [esp + 0x10], 0
jmp 0x44aa50
mov dword [esp + 0x10], 1
push 0x1f4
call ebp
test ebx, ebx
jne 0x44aa1e
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x44aa9b
mov dl, byte [0x481910]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x45]
mov byte [esp + 0x44], dl
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x48]
push 0x47d404
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x50]
push ecx
call fcn.00446ef0
add esp, 0x10
xor ebp, ebp
lea edi, [esi + 0x17c4]
push edi
call fcn.00433480
add esp, 4
call fcn.00445820
mov ebx, dword [esp + 0x10]
test eax, eax
je 0x44ab11
cmp ebx, ebp
je 0x44ab11
lea edx, [esp + 0x14]
push edx
push edi
call fcn.004337f0
add esp, 8
test eax, eax
je 0x44ab11
mov eax, dword [esp + 0x14]
mov dword [esi + 0x17c8], eax
call fcn.0042b620
test eax, eax
je 0x44aafa
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00431520
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x138
ret
mov edx, dword [esp + 0x14]
mov ecx, esi
push edx
call fcn.0042a770
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x138
ret
call fcn.00445800
test eax, eax
je 0x44ab9f
cmp ebx, ebp
je 0x44abe1
mov eax, dword [esi + 0x17cc]
xor ebx, ebx
test eax, eax
jbe 0x44ac97
lea edi, [esi + 0x17d0]
lea ebp, [esi + 0x1820]
mov eax, dword [edi + 0x1310]
test eax, eax
jl 0x44ab83
cmp eax, 1
jle 0x44ab56
cmp eax, 4
jne 0x44ab83
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x44ab83
mov eax, dword [edi]
mov ecx, esi
push eax
call fcn.0042a770
test eax, eax
jne 0x44ab83
call fcn.0042b620
test eax, eax
je 0x44ab83
mov ecx, dword [edi]
push ecx
call fcn.00431520
add esp, 4
mov eax, dword [esi + 0x17cc]
inc ebx
add edi, 4
add ebp, 0x78
cmp ebx, eax
jb 0x44ab42
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x138
ret
cmp ebx, ebp
je 0x44abe1
call fcn.00445820
test eax, eax
jne 0x44ac97
push ebp
mov ecx, esi
call fcn.0042a770
test eax, eax
jne 0x44ac97
call fcn.0042b620
test eax, eax
je 0x44ac97
push ebp
call fcn.00431520
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x138
ret
push ebp
mov ecx, esi
call fcn.0042a770
test eax, eax
jne 0x44abff
call fcn.0042b620
test eax, eax
je 0x44abff
push ebp
call fcn.00431520
add esp, 4
cmp dword [0x485b08], ebp
je 0x44ac97
mov ebx, 0xc358
cmp dword [0x485b0c], ebp
jne 0x44ac97
mov ecx, dword [esi + 4]
cmp ecx, ebp
je 0x44ac97
mov eax, dword [esi + 0x2b34]
cmp eax, ebp
je 0x44ac97
push 0xffffffffffffffff
lea edx, [esp + 0x20]
push ebp
push edx
push 2
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x44ac97
cmp dword [0x485b08], ebp
je 0x44ac97
cmp dword [0x485b0c], ebp
jne 0x44ac97
mov ecx, esi
call fcn.004204d0
test eax, eax
je 0x44ac8b
mov eax, dword [esi + 0x17c8]
mov dword [esp + 0x14], eax
mov eax, dword [edi]
dec eax
je 0x44ac79
sub eax, 2
je 0x44ac79
sub eax, 5
jne 0x44ac8b
lea ecx, [esp + 0x18]
push 4
push ecx
mov ecx, esi
mov dword [esp + 0x20], ebx
call fcn.00429eb0
cmp dword [0x485b08], ebp
jne 0x44ac10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x138
ret