Function at 0x429f60
Capabilities:
Query service status
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468d80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x8940
call fcn.0045f430
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov dword [eax], 0
mov dword [ecx], 0
mov dword [ebp - 0x10], esp
xor eax, eax
push eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x54]
push edx
mov ecx, 0x188
lea edi, [ebp - 0xcd0]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
push 0x7a80
lea eax, [ebp - 0x8950]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42a03f
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x42a03f
mov ebx, dword [0x4902e8]
test dword [0x4900e8], ebx
je 0x429ffb
push str.NamePipeServiceInstanceThread:_Read_from_Pipe_Success
call fcn.0040aab0
mov ebx, dword [0x4902e8]
add esp, 4
mov ecx, dword [ebp - 0x54]
mov edx, ecx
shr ecx, 2
lea esi, [ebp - 0x8950]
lea edi, [ebp - 0xcd0]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xcd0], 0x8001
jne 0x42a030
cmp dword [ebp - 0xccc], 0x620
je 0x42a060
test dword [0x4900e8], ebx
je 0x42a060
push str.NamePipeServiceInstanceThread:_Pipe_read_msg_contents_error__something_wrong
jmp 0x42a052
mov ebx, dword [0x4902e8]
test dword [0x4900e8], ebx
je 0x42a060
push str.NamePipeServiceInstanceThread:_Read_from_Pipe_Failed
call fcn.0040aab0
mov ebx, dword [0x4902e8]
add esp, 4
mov esi, dword [ebp - 0xcc8]
lea eax, [esi - 9]
cmp eax, 0x37
mov dword [ebp - 0x44], esi
ja case.0x42a07c.10
movzx eax, byte [eax + 0x42b844]
jmp dword [eax*4 + 0x42b7d8]
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42a0ad
test dword [0x4900e8], ebx
je 0x42b78b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_FEATUREUPDATE._ulSessionId___d__out_of_range
call fcn.0040aab0
add esp, 8
jmp 0x42b78b
mov ecx, 0x491a60
call fcn.00431830
mov ecx, dword [0x4900e8]
test dword [0x4902e8], ecx
je 0x42b78b
push str.finish_feature_update
call fcn.0040aab0
add esp, 4
jmp 0x42b78b
mov eax, dword [0x491098]
xor edi, edi
cmp eax, 7
ja 0x42a1a5
mov esi, dword [ebp - 0xcc0]
cmp esi, 0x14
jae 0x42a1b0
cmp dword [0x49039c], edi
je 0x42a10d
mov dword [0x49039c], edi
mov edi, 1
push 0
push esi
call fcn.00429620
add esp, 8
cmp eax, 0xffffffff
je 0x42a1f2
push esi
lea eax, [eax + eax*8]
shl eax, 5
push str..pipeExtEventPipe
lea edx, [eax + 0x493d0c]
push str._s_s_d
push edx
mov dword [eax + 0x493e10], 1
mov dword [eax + 0x493d08], esi
call fcn.0045ebd9
mov eax, dword [0x491164]
mov ecx, dword [0x49109c]
add esp, 0x10
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], edi
mov edx, dword [0x4900e8]
test dword [0x4902e8], edx
je 0x42b78b
push str.Send_RegOption_to_Client
call fcn.0040aab0
add esp, 4
jmp 0x42b78b
mov esi, dword [ebp - 0xcc4]
cmp esi, 0x14
jb 0x42a1cf
test dword [0x4900e8], ebx
je 0x42b78b
push esi
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_SETUP._ulSessionId___d__out_of_range
call fcn.0040aab0
add esp, 8
jmp 0x42b78b
cmp dword [0x49039c], edi
je 0x42a1e2
mov dword [0x49039c], edi
mov edi, 1
push 0
push esi
call fcn.00429620
add esp, 8
cmp eax, 0xffffffff
jne 0x42a21d
test dword [0x4900e8], ebx
je 0x42b7c6
push esi
push str.NamePipeServiceInstance:__d_not_enough_session_slot_to_assign_this_setup_session
call fcn.0040aab0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [eax + eax*8]
shl eax, 5
push esi
push str..pipeExtEventPipe
mov dword [eax + 0x493e10], 1
mov dword [eax + 0x493d08], esi
lea eax, [eax + 0x493d0c]
push str._s_s_d
push eax
call fcn.0045ebd9
mov ecx, dword [ebp - 0xcb8]
mov edx, dword [0x49109c]
mov eax, dword [ebp - 0xcbc]
mov ebx, dword [ebp - 0xcc0]
or edx, ecx
mov ecx, dword [0x491160]
mov dword [0x49109c], edx
mov edx, dword [ebp - 0xcb4]
and edx, 0x8000
add esp, 0x10
cmp ecx, 1
mov esi, eax
mov dword [0x4910d0], edx
jne 0x42a297
mov dword [0x4929e8], ebx
mov dword [0x4929ec], eax
push eax
mov ecx, 0x491a60
call fcn.0042d780
push esi
mov ecx, 0x491a60
mov dword [eax + 0x15c], 1
call fcn.0042d780
mov dword [eax + 0x44], ebx
mov ecx, dword [0x491160]
mov eax, dword [0x491164]
mov edx, dword [0x4929e8]
mov dword [ebp - 0x34], ecx
mov ecx, dword [0x4910c4]
mov dword [ebp - 0x40], eax
mov eax, dword [0x4929ec]
push ecx
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edi
call fcn.0040f990
add esp, 4
jmp 0x42a181
mov edi, dword [ebp - 0xcc0]
cmp edi, 0x14
mov dword [ebp - 0x14], edi
jb 0x42a335
test dword [0x4900e8], ebx
je 0x42b78b
push edi
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_READY._ulSessionId___d__out_of_range
call fcn.0040aab0
add esp, 8
jmp 0x42b78b
push 1
push edi
call fcn.00429620
add esp, 8
cmp eax, 0xffffffff
je 0x42a5dc
lea edi, [eax + eax*8]
shl edi, 5
mov eax, dword [edi + 0x493e10]
mov ecx, 3
cmp eax, ecx
je 0x42a377
cmp eax, 5
je 0x42a377
cmp esi, 0xb
jne 0x42a377
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
mov ebx, dword [0x4902e8]
cmp dword [edi + 0x493e10], ecx
jne 0x42a397
cmp dword [0x493d04], 1
jne 0x42a397
mov edx, dword [ebp + 0xc]
mov dword [edx], 1
mov ebx, dword [0x4902e8]
cmp esi, 0x1e
jne 0x42a3b2
mov dword [edi + 0x493e10], 2
mov dword [0x493d04], 1
jmp 0x42a3cb
cmp dword [edi + 0x493e10], 5
je 0x42a3cb
mov dword [edi + 0x493e10], ecx
mov dword [0x493d04], 0
cmp dword [edi + 0x493e10], 2
jne 0x42a418
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
mov eax, dword [0x4910b8]
test eax, eax
je 0x42a412
xor esi, esi
jmp 0x42a3f0
mov ecx, dword [0x4910b8]
push esi
call fcn.004020a0
mov ecx, dword [0x4910b8]
push esi
mov dword [ebp + esi*4 - 0x34], eax
call fcn.00402040
inc esi
cmp esi, 5
jb 0x42a3f0
mov ebx, dword [0x4902e8]
cmp dword [edi + 0x493d08], 0xffffffff
jne 0x42a44a
mov eax, dword [ebp - 0x14]
push eax
push str..pipeExtEventPipe
lea ecx, [edi + 0x493d0c]
push str._s_s_d
push ecx
mov dword [edi + 0x493d08], eax
call fcn.0045ebd9
mov ebx, dword [0x4902e8]
add esp, 0x10
test dword [0x4900e8], ebx
je 0x42a469
mov edx, dword [ebp - 0x14]
push edx
push str.NamePipeServiceInstance._Got_EXTEVENT_REQTYPE_SESSION_READY_from_session__d
call fcn.0040aab0
mov ebx, dword [0x4902e8]
add esp, 8
mov eax, dword [0x493d00]
cmp eax, dword [ebp - 0x14]
mov edi, eax
je 0x42a4a7
test dword [0x4900e8], ebx
je 0x42a48f
mov ecx, dword [ebp - 0x14]
push ecx
push eax
push str.NamePipeServiceInstance._Active_session_has_changed_from__d_to__d
call fcn.0040aab0
add esp, 0xc
cmp dword [ebp - 0x44], 0xb
mov edx, dword [ebp - 0x14]
mov dword [0x493d00], edx
jne 0x42a4a7
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
mov ecx, dword [0x4910d8]
test ecx, ecx
je 0x42b78b
cmp dword [ebp - 0x44], 0xb
jne 0x42b78b
call fcn.004177f0
cmp dword [0x491098], 6
je 0x42b78b
push 1
push edi
call fcn.00429620
mov ecx, dword [ebp - 0x14]
add esp, 8
cmp edi, ecx
je 0x42b78b
cmp edi, 0xffffffff
je 0x42b78b
cmp eax, 0xffffffff
jne 0x42a526
mov ecx, dword [0x4900e8]
test dword [0x4902e8], ecx
je 0x42b7c6
push edi
push str.NamePipeServiceInstance:_BUG__d_notin_list
call fcn.0040aab0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [eax + eax*8]
shl edx, 5
cmp dword [edx + 0x493e10], 5
jne 0x42b78b
xor eax, eax
push 1
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov eax, dword [0x491164]
push 0
lea ecx, [ebp - 0x6b0]
lea esi, [edx + 0x493d0c]
push ecx
push esi
mov dword [ebp - 0x6a8], 0x1b
mov dword [ebp - 0x6a0], eax
call fcn.00409bf0
add esp, 0x10
test eax, eax
jne 0x42b78b
mov edx, dword [0x4900e8]
test dword [0x4902e8], edx
je 0x42b78b
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_CLIENTSETUNLOCKEVENT_on_pipe__s_.
call fcn.0040aab0
add esp, 8
jmp 0x42b78b
mov edi, dword [ebp - 0xcc0]
cmp edi, 0x14
jb 0x42a5cc
test dword [0x4900e8], ebx
je 0x42b78b
push edi
push esi
push str.NamePipeServiceInstance._WARNING_reqtype_d._ulSessionId___d__out_of_range
call fcn.0040aab0
add esp, 0xc
jmp 0x42a644
push 1
push edi
call fcn.00429620
add esp, 8
cmp eax, 0xffffffff
jne 0x42a607
test dword [0x4900e8], ebx
je 0x42b7c6
push edi
push str.NamePipeServiceInstance:_BUG__d_notin_list
call fcn.0040aab0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [eax + eax*8]
shl eax, 5
mov dword [eax + 0x493e10], 4
cmp dword [0x493d00], edi
jne 0x42a64a
mov ecx, dword [0x4910d8]
test ecx, ecx
mov dword [0x493d00], 0xffffffff
mov dword [0x493d04], 1
je 0x42a64a
push 0
call fcn.00417830
mov ebx, dword [0x4902e8]
test dword [0x4900e8], ebx
je 0x42b78b
mov ecx, dword [ebp - 0x44]
push edi
push ecx
push str.NamePipeServiceInstance._reqtype_d_called_from_session__d
jmp 0x42b783
mov esi, dword [ebp - 0xcc0]
cmp esi, 0x14
mov dword [ebp - 0x14], esi
jb 0x42a68a
test dword [0x4900e8], ebx
je 0x42b78b
push esi
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_READYBUTLOCKED._ulSessionId___d__out_of_range
jmp 0x42a74a
push 1
push esi
call fcn.00429620
add esp, 8
cmp eax, 0xffffffff
je 0x42a8f5
lea eax, [eax + eax*8]
shl eax, 5
mov ecx, dword [eax + 0x493e10]
cmp ecx, 5
lea eax, [eax + 0x493e10]
je 0x42a6bb
mov dword [eax], 3
cmp dword [0x493d00], esi
jne 0x42a758
mov ecx, dword [0x4910d8]
test ecx, ecx
mov dword [0x493d04], 1
je 0x42a758
push 0
call fcn.00417830
call fcn.00409d60
mov esi, eax
cmp dword [0x491098], 6
jne 0x42a752
test esi, esi
je 0x42a752
mov edx, dword [0x491164]
xor eax, eax
push 1
push eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x6b0]
push eax
push esi
mov dword [ebp - 0x6a8], 0xd
mov dword [ebp - 0x6a0], edx
call fcn.00409bf0
add esp, 0x10
test eax, eax
jne 0x42a752
mov ebx, dword [0x4902e8]
test dword [0x4900e8], ebx
je 0x42b78b
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_SCREENSAVERSTOP_on_pipe__s_.
call fcn.0040aab0
add esp, 8
mov ebx, dword [0x4902e8]
test dword [0x4900e8], ebx
je 0x42b78b
mov ecx, dword [ebp - 0x14]
push ecx
push str.NamePipeServiceInstance._EXTEVENT_REQTYPE_CLT_READYBUTLOCKED_called_from_session__d
call fcn.0040aab0
add esp, 8
jmp 0x42b78b
mov eax, dword [ebp - 0xcc0]
cmp eax, 0x14
mov esi, eax
jb 0x42a79f
test dword [0x4900e8], ebx
je 0x42a7cf
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_LOGGEDOFF._ulSessionId___d__out_of_range
call fcn.0040aab0
add esp, 8
jmp 0x42a7c9
mov ecx, dword [0x493d00]
cmp ecx, eax
je 0x42a7c0
test dword [0x4900e8], ebx
je 0x42a7c0
push eax
push ecx
push str.NamePipeServiceInstance._WARNING._EXTEVENT_REQTYPE_CLT_LOGGEDOFF_m_SessionClients.ulActiveSessionId___d____ulSessionId___d_
call fcn.0040aab0
add esp, 0xc
push esi
call fcn.00429670
add esp, 4
mov ebx, dword [0x4902e8]
test dword [0x4900e8], ebx
je 0x42b78b
push esi
push str.NamePipeServiceInstance._EXTEVENT_REQTYPE_CLT_LOGGEDOFF_called_from_session__d
call fcn.0040aab0
add esp, 8
jmp 0x42b78b
mov eax, dword [ebp - 0xcc0]
cmp eax, 0x14
mov esi, eax
jb 0x42a819
test dword [0x4900e8], ebx
je 0x42a86d
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_IN_RESUME._ulSessionId___d__out_of_range
call fcn.0040aab0
mov ebx, dword [0x4902e8]
add esp, 8
jmp 0x42a86d
mov ecx, dword [0x493d00]
cmp ecx, eax
je 0x42a840
test dword [0x4900e8], ebx
je 0x42a840
push eax
push ecx
push str.NamePipeServiceInstance._WARNING._EXTEVENT_REQTYPE_CLT_IN_RESUME_m_SessionClients.ulActiveSessionId___d____ulSessionId___d_
call fcn.0040aab0
mov ebx, dword [0x4902e8]
add esp, 0xc
push 1
push esi
call fcn.00429620
add esp, 8
cmp eax, 0xffffffff
je 0x42a8f5
lea eax, [eax + eax*8]
shl eax, 5
cmp dword [eax + 0x493d08], 0xffffffff
je 0x42a86d
mov dword [eax + 0x493e10], 5
test dword [0x4900e8], ebx
je 0x42b78b
push esi
push str.NamePipeServiceInstance._EXTEVENT_REQTYPE_CLT_IN_RESUME_called_from_session__d
call fcn.0040aab0
add esp, 8
jmp 0x42b78b
mov eax, dword [ebp - 0xcc0]
cmp eax, 0x14
mov esi, eax
jb 0x42a8be
test dword [0x4900e8], ebx
je 0x42a942
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_OUTOF_RESUME._ulSessionId___d__out_of_range
call fcn.0040aab0
mov ebx, dword [0x4902e8]
add esp, 8
jmp 0x42a942
mov ecx, dword [0x493d00]
cmp ecx, eax
je 0x42a8e5
test dword [0x4900e8], ebx
je 0x42a8e5
push eax
push ecx
push str.NamePipeServiceInstance._WARNING._EXTEVENT_REQTYPE_CLT_OUTOF_RESUME_m_SessionClients.ulActiveSessionId___d____ulSessionId___d_
call fcn.0040aab0
mov ebx, dword [0x4902e8]
add esp, 0xc
push 1
push esi
call fcn.00429620
add esp, 8
cmp eax, 0xffffffff
jne 0x42a920
test dword [0x4900e8], ebx
je 0x42b7c6
push esi
push str.NamePipeServiceInstance:_BUG__d_notin_list
call fcn.0040aab0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [eax + eax*8]
shl eax, 5
cmp dword [eax + 0x493d08], 0xffffffff
je 0x42a942
cmp dword [eax + 0x493e10], 5
jne 0x42a942
mov dword [eax + 0x493e10], 3
test dword [0x4900e8], ebx
je 0x42b78b
push esi
push str.NamePipeServiceInstance._EXTEVENT_REQTYPE_CLT_OUTOF_RESUME_called_from_session__d
call fcn.0040aab0
add esp, 8
jmp 0x42b78b
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42a98b
test dword [0x4900e8], ebx
je 0x42b78b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_SAFEESCAPEREGISTRATIONQUERY._ulSessionId___d__out_of_range
call fcn.0040aab0
add esp, 8
jmp 0x42b78b
mov ecx, 0x491a60
call fcn.0042ff10
mov ecx, dword [0x4902e8]
mov edx, dword [0x491164]
mov dword [ebp - 0x34], eax
mov eax, dword [0x4900e8]
test eax, ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x38], 0x24
je 0x42b78b
push str.Finish_Safe_Escape_Registration_Status_Query_n
call fcn.0040aab0
add esp, 4
jmp 0x42b78b
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42aa05
test dword [0x4900e8], ebx
je 0x42b78b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_SAFEESCAPEREGISTRATIONUPDATE._ulSessionId___d__out_of_range
call fcn.0040aab0
add esp, 8
jmp 0x42b78b
test dword [0x4900e8], ebx
mov ecx, dword [0x491164]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x38], 0x25
je 0x42b78b
push str.Finish_Safe_Escape_Registration_Status_Update_n
call fcn.0040aab0
add esp, 4
jmp 0x42b78b
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42aa6b
test dword [0x4900e8], ebx
je 0x42b78b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_SAVEPROFILEATSHUTDOWN_FINISHES._ulSessionId___d__out_of_range
call fcn.0040aab0
add esp, 8
jmp 0x42b78b
mov ecx, 0x492e78
call fcn.00415a10
mov eax, dword [0x4900e8]
test dword [0x4902e8], eax
mov edx, dword [0x491164]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x38], 0x27
je 0x42b78b
push str.Finish_EXTEVENT_REQTYPE_CLT_SAVEPROFILEATSHUTDOWN_FINISHES_n
call fcn.0040aab0
add esp, 4
jmp 0x42b78b
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42aae0
test dword [0x4900e8], ebx
je 0x42b78b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_STOPSCREENSAVEREVENT._ulSessionId___d__out_of_range
call fcn.0040aab0
add esp, 8
jmp 0x42b78b
mov eax, dword [0x4910cc]
test eax, eax
je 0x42ab5f
call fcn.00409d60
mov esi, eax
cmp dword [0x493d00], 0xffffffff
je 0x42ab5f
test esi, esi
je 0x42ab5f
xor eax, eax
push 1
push eax
lea edx, [ebp - 0x6b0]
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov ecx, dword [0x491164]
push edx
push esi
mov dword [ebp - 0x6a8], 0x29
mov dword [ebp - 0x6a0], ecx
call fcn.00409bf0
mov ebx, dword [0x4902e8]
add esp, 0x10
test eax, eax
jne 0x42ab5f
test dword [0x4900e8], ebx
je 0x42b78b
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_SCREENSAVERSTOP_on_pipe__s_.
call fcn.0040aab0
mov ebx, dword [0x4902e8]
add esp, 8
test dword [0x4900e8], ebx
je 0x42b78b
push str.Finish_EXTEVENT_REQTYPE_CLT_STOPSCREENSAVEREVENT_n
call fcn.0040aab0
add esp, 4
jmp 0x42b78b
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42aba7
test dword [0x4900e8], ebx
je 0x42b78b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_STARTSCREENSAVEREVENT._ulSessionId___d__out_of_range
call fcn.0040aab0
add esp, 8
jmp 0x42b78b
mov eax, dword [0x4910cc]
test eax, eax
je 0x42ac26
call fcn.00409d60
mov esi, eax
cmp dword [0x493d00], 0xffffffff
je 0x42ac26
test esi, esi
je 0x42ac26
xor eax, eax
push 1
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov eax, dword [0x491164]
push 0
lea ecx, [ebp - 0x6b0]
push ecx
push esi
mov dword [ebp - 0x6a8], 0x2b
mov dword [ebp - 0x6a0], eax
call fcn.00409bf0
mov ebx, dword [0x4902e8]
add esp, 0x10
test eax, eax
jne 0x42ac26
test dword [0x4900e8], ebx
je 0x42b78b
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_SCREENSAVERSTART_on_pipe__s_.
call fcn.0040aab0
mov ebx, dword [0x4902e8]
add esp, 8
test dword [0x4900e8], ebx
je 0x42b78b
push str.Finish_EXTEVENT_REQTYPE_CLT_STARTSCREENSAVEREVENT_n
call fcn.0040aab0
add esp, 4
jmp 0x42b78b
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42ac6e
test dword [0x4900e8], ebx
je 0x42b78b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_WRITEEVENTLOGMSG._ulSessionId___d__out_of_range
call fcn.0040aab0
add esp, 8
jmp 0x42b78b
mov ecx, dword [0x491298]
test ecx, ecx
mov eax, dword [ebp - 0xcbc]
mov dword [ebp + 0xc], eax
je 0x42b78b
mov edx, dword [ebp - 0xcc0]
push 0
push 0
push 0
push eax
push edx
mov dword [ebp - 4], 0
call fcn.00411150
cmp dword [ebp + 0xc], 0x8000006e
mov dword [ebp - 4], 0xffffffff
jne 0x42b78b
push 0xc
call fcn.00423550
add esp, 4
jmp 0x42b78b
test dword [0x4900e8], ebx
je 0x42acf7
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_REGISTERCOMOBJECT_is_called
call fcn.0040aab0
add esp, 4
mov ecx, dword [0x493d00]
push 1
push ecx
call fcn.00429620
add esp, 8
cmp eax, 0xffffffff
je 0x42b78b
mov edx, dword [0x4860ac]
lea ebx, [eax + eax*8]
shl ebx, 5
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0xcc0]
mov dword [ebp + 0x10], ebx
lea ebx, [ebx + 0x493e14]
push ecx
mov ecx, ebx
mov dword [ebp - 0x18], 1
mov dword [ebp + 0xc], edx
call fcn.004299b0
mov edx, dword [ebp + 0xc]
cmp edx, dword [0x4860ac]
jne 0x42b78b
push 0x30
call fcn.0045ec66
mov edx, eax
add esp, 4
xor eax, eax
test edx, edx
je 0x42ad6e
mov ecx, 0xc
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, edx
lea edi, [eax + 8]
mov ecx, 0xa
lea esi, [ebp - 0xcc0]
rep movsd dword es:[edi], dword [esi]
mov dword [eax], 0
mov dword [eax + 4], 0
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x42ad9c
mov dword [eax + 4], ecx
mov ecx, dword [ebx + 8]
mov dword [ecx], eax
jmp 0x42ad9f
mov dword [ebx + 4], eax
mov edx, dword [ebx + 0xc]
mov dword [ebx + 8], eax
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
inc edx
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov dword [ebx + 0xc], edx
push 1
mov dword [ebp - 0x6a8], 0x2d
mov ecx, 0xa
lea esi, [ebp - 0xcc0]
lea edi, [ebp - 0x6a0]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x10]
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x6b0]
push eax
lea esi, [esi + 0x493d0c]
push esi
call fcn.00409bf0
add esp, 0x10
test eax, eax
jne 0x42b4f0
mov ecx, dword [0x4900e8]
test dword [0x4902e8], ecx
je 0x42ae22
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_CLT_REGISTERCOMOBJECT_on_pipe__s_.
call fcn.0040aab0
add esp, 8
mov dword [ebp - 0x18], 1
jmp 0x42b75c
test dword [0x4900e8], ebx
je 0x42ae43
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_UNREGISTERCOMOBJECT_is_called
call fcn.0040aab0
add esp, 4
mov eax, dword [0x493d00]
push 1
push eax
call fcn.00429620
add esp, 8
cmp eax, 0xffffffff
je 0x42b78b
lea ebx, [eax + eax*8]
xor edi, edi
shl ebx, 5
lea esi, [ebx + 0x493e14]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x50], vtable.Eeu::LinkedListIterator_struct_tagComCallbacks_.0
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], edi
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0xcc0]
push edx
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.00429de0
test al, al
je 0x42af46
cmp esi, dword [ebp - 0x4c]
jne 0x42aeb5
mov eax, dword [ebp - 0x48]
cmp eax, edi
je 0x42aeb5
push edi
push edi
push eax
mov ecx, esi
call fcn.00429e50
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
push 1
mov dword [ebp - 0x6a8], 0x36
mov ecx, 0xa
lea esi, [ebp - 0xcc0]
lea edi, [ebp - 0x6a0]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x6b0]
push ecx
lea esi, [ebx + 0x493d0c]
push esi
call fcn.00409bf0
add esp, 0x10
test eax, eax
jne 0x42af30
mov edx, dword [0x4900e8]
test dword [0x4902e8], edx
je 0x42af27
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_CLT_UNREGISTERCOMOBJECT_on_pipe__s_.
call fcn.0040aab0
add esp, 8
mov dword [ebp - 0x18], 1
jmp 0x42af37
mov dword [ebp - 0x18], 2
mov eax, dword [0x491164]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 4], 0xffffffff
jmp 0x42b78b
mov esi, dword [0x4900e8]
test ebx, esi
je 0x42af75
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_GETCOMCALLBACKS_is_called
call fcn.0040aab0
mov ebx, dword [0x4902e8]
mov esi, dword [0x4900e8]
add esp, 4
mov edx, dword [ebp - 0xcc4]
cmp edx, 0x14
jb 0x42af9b
test ebx, esi
je 0x42b78b
push edx
push str.NamePipeInstance_warning_EXTEVENT_REQTYPE_CLT_GETCOMCALLBACKS_ulSessionId___u__out_of_range
call fcn.0040aab0
add esp, 8
jmp 0x42b78b
xor eax, eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
push 1
rep stosd dword es:[edi], eax
push edx
mov dword [ebp - 0x18], 2
call fcn.00429620
add esp, 8
cmp eax, 0xffffffff
jne 0x42afeb
test ebx, esi
je 0x42b7c6
mov ecx, dword [0x493d00]
push ecx
push str.NamePipeServiceInstance:_BUG_activesession__d_notin_list
call fcn.0040aab0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea esi, [eax + eax*8]
shl esi, 5
mov ebx, dword [esi + 0x493e18]
lea eax, [esi + 0x493e14]
mov dword [ebp - 0x50], vtable.Eeu::LinkedListIterator_struct_tagComCallbacks_.0
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], ebx
test ebx, ebx
mov dword [ebp - 4], 3
je 0x42b0ad
lea esp, [esp]
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
lea edx, [ebp - 0x6a0]
rep stosd dword es:[edi], eax
push edx
lea ecx, [ebp - 0x50]
call fcn.004298e0
test al, al
je 0x42b06c
push 1
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x6b0]
push ecx
lea edx, [esi + 0x493d0c]
push edx
mov dword [ebp - 0x6a8], 0x2d
call fcn.00409bf0
add esp, 0x10
test eax, eax
je 0x42b085
test ebx, ebx
je 0x42b0ad
mov ebx, dword [ebx]
test ebx, ebx
mov dword [ebp - 0x48], ebx
jne 0x42b020
mov dword [ebp - 4], 0xffffffff
jmp 0x42b75c
mov eax, dword [0x4900e8]
test dword [0x4902e8], eax
je 0x42b0a6
lea ecx, [esi + 0x493d0c]
push ecx
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_CLT_GETCOMCALLBACKS_on_pipe__s_.
call fcn.0040aab0
add esp, 8
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0xffffffff
jmp 0x42b75c
test dword [0x4900e8], ebx
je 0x42b0ce
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_APPLYADCBYSELECTED.._is_called
call fcn.0040aab0
add esp, 4
mov eax, dword [0x493d00]
push 1
push eax
call fcn.00429620
mov edx, eax
add esp, 8
cmp edx, 0xffffffff
je 0x42b78b
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x6a8], 0x2f
mov ecx, 0xa
lea esi, [ebp - 0xcc0]
lea edi, [ebp - 0x6a0]
rep movsd dword es:[edi], dword [esi]
lea esi, [edx + edx*8]
push 1
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x6b0]
shl esi, 5
push edx
lea esi, [esi + 0x493d0c]
push esi
call fcn.00409bf0
add esp, 0x10
test eax, eax
jne 0x42b160
mov eax, dword [0x4900e8]
test dword [0x4902e8], eax
je 0x42b160
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_APPLYADCBYSELECTED_on_pipe__s_.
call fcn.0040aab0
add esp, 8
mov ecx, dword [0x491164]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
jmp 0x42b78b
test dword [0x4900e8], ebx
je 0x42b18a
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_APPLYADCBYSELECTED.._is_called
call fcn.0040aab0
add esp, 4
mov edx, dword [0x493d00]
push 1
push edx
call fcn.00429620
mov edx, eax
add esp, 8
cmp edx, 0xffffffff
je 0x42b78b
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x6a8], 0x3d
mov ecx, 0x27
lea esi, [ebp - 0xcc0]
lea edi, [ebp - 0x6a0]
rep movsd dword es:[edi], dword [esi]
push 1
lea esi, [edx + edx*8]
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x6b0]
shl esi, 5
push ecx
lea esi, [esi + 0x493d0c]
push esi
call fcn.00409bf0
add esp, 0x10
test eax, eax
jne 0x42b21e
mov edx, dword [0x4900e8]
test dword [0x4902e8], edx
je 0x42b21e
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_APPLYADCBYSELECTED_on_pipe__s_.
call fcn.0040aab0
add esp, 8
mov eax, dword [0x491164]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x2c
jmp 0x42b78b
test dword [0x4900e8], ebx
je 0x42b247
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_APPLYADCBY.._is_called
call fcn.0040aab0
add esp, 4
mov ecx, dword [0x493d00]
push 1
push ecx
call fcn.00429620
mov edx, eax
add esp, 8
cmp edx, 0xffffffff
je 0x42b78b
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x6a8], 0x38
mov ecx, 0x185
lea esi, [ebp - 0xcc4]
lea edi, [ebp - 0x6a4]
rep movsd dword es:[edi], dword [esi]
lea esi, [edx + edx*8]
push 1
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x6b0]
shl esi, 5
push eax
lea esi, [esi + 0x493d0c]
push esi
call fcn.00409bf0
add esp, 0x10
test eax, eax
jne 0x42b75c
mov ecx, dword [0x4900e8]
test dword [0x4902e8], ecx
je 0x42ae22
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_APPLYADCBYCONNECTED_on_pipe__s_.
call fcn.0040aab0
add esp, 8
mov dword [ebp - 0x18], 1
jmp 0x42b75c
test dword [0x4900e8], ebx
je 0x42b304
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_PRPCESSPENDINGHPD_is_called
call fcn.0040aab0
add esp, 4
cmp dword [0x493d00], 0xffffffff
je 0x42b78b
mov eax, dword [0x4910b8]
test eax, eax
je 0x42b3a1
mov ecx, dword [eax + 0x128]
test ecx, ecx
je 0x42b3a1
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov eax, dword [eax + 0x128]
lea edx, [ebp - 0x70]
push edx
mov ecx, eax
call fcn.00406870
test eax, eax
je 0x42b39a
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x24], edx
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x34], ecx
mov ecx, dword [0x491164]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
jmp 0x42b78b
mov dword [ebp - 0x18], 1
mov ecx, dword [0x491164]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
jmp 0x42b78b
test dword [0x4900e8], ebx
mov esi, dword [ebp - 0xcc4]
mov dword [ebp - 0x44], esi
je 0x42b3da
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_KILLCLIENTPROCESS_is_called
call fcn.0040aab0
mov ebx, dword [0x4902e8]
add esp, 4
cmp esi, 0x14
jb 0x42b404
cmp esi, 0xffffffff
je 0x42b40e
test dword [0x4900e8], ebx
je 0x42b78b
push 0xffffffffffffffff
push str.NamePipeInstance_warning_EXTEVENT_REQTYPE_CLT_KILLCLIENTPROCESS_ulSessionId___u__out_of_range
call fcn.0040aab0
add esp, 8
jmp 0x42b78b
cmp esi, 0xffffffff
je 0x42b40e
mov dword [ebp + 0xc], esi
jmp 0x42b41a
mov dword [ebp + 0xc], 0
mov esi, 0x14
mov ebx, 0x493d0c
mov dword [ebp + 0x10], 0x14
mov eax, dword [ebp + 0xc]
cmp eax, esi
ja 0x42b48a
mov ecx, dword [ebx - 4]
cmp ecx, eax
je 0x42b43b
inc eax
cmp eax, esi
jbe 0x42b430
jmp 0x42b48a
xor eax, eax
push 1
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x6b0]
push eax
push ebx
mov dword [ebp - 0x6a8], 0x35
call fcn.00409bf0
add esp, 0x10
test eax, eax
jne 0x42b48a
mov ecx, dword [0x4900e8]
test dword [0x4902e8], ecx
je 0x42b48a
push ebx
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_CLT_KILLCLIENTPROCESS_on_pipe__s_.
call fcn.0040aab0
add esp, 8
mov eax, dword [ebp + 0x10]
add ebx, 0x120
dec eax
mov dword [ebp + 0x10], eax
jne 0x42b426
cmp dword [ebp - 0x44], 0xffffffff
jne 0x42b4b2
mov edx, dword [0x4910b0]
push 0
push 0
push 0x12
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov eax, dword [0x491164]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x2c
jmp 0x42b78b
test dword [0x4900e8], ebx
je 0x42b4e7
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_SVR_ISTMMHANDLEDBYADC_is_called
call fcn.0040aab0
add esp, 4
mov ecx, dword [0x4910d0]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x18], 2
jmp 0x42b75c
mov eax, dword [ebp - 0xcc0]
mov ecx, dword [ebp - 0xcbc]
mov edx, dword [ebp - 0xcb8]
mov dword [0x491084], eax
mov eax, dword [ebp - 0xcb4]
mov dword [0x491088], ecx
mov ecx, dword [ebp - 0xcb0]
mov dword [0x49107c], 1
mov dword [0x49108c], edx
mov dword [0x491090], eax
mov dword [0x491094], ecx
jmp 0x42b78b
mov eax, dword [0x49107c]
test eax, eax
je 0x42b78b
test dword [0x4900e8], ebx
mov dword [0x49107c], 0
je 0x42b571
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_SVR_ISTMMHANDLEDBYADC_is_called
call fcn.0040aab0
add esp, 4
mov edx, dword [0x491084]
mov eax, dword [0x491088]
mov ecx, dword [0x49108c]
mov dword [ebp - 0x34], edx
mov edx, dword [0x491090]
mov dword [ebp - 0x30], eax
mov eax, dword [0x491094]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [0x491164]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
jmp 0x42b78b
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0xed0]
rep stosd dword es:[edi], eax
test dword [0x4900e8], ebx
mov dword [ebp + 0xc], 0
je 0x42b5e3
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_ENABLESTOPSERVICE_is_called
call fcn.0040aab0
add esp, 4
push 4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x42b621
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0xed0]
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_ENABLESTOPSERVICE._failed_to_open_SCM._err_d
push edx
call fcn.0045ebd9
lea eax, [ebp - 0xed0]
push eax
call fcn.00411050
add esp, 0x10
jmp 0x42b74c
cmp dword [0x491098], 7
mov eax, str.Ati_HotKey_Poller
jbe 0x42b634
mov eax, str.Ati_External_Event_Utility
push 4
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x42b677
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0xed0]
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_ENABLESTOPSERVICE._failed_to_OpenService._err_d
push ecx
call fcn.0045ebd9
lea edx, [ebp - 0xed0]
push edx
call fcn.00411050
add esp, 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x42b74c
mov esi, dword [0x49368c]
xor eax, eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x80], eax
push ecx
mov dword [ebp - 0x7c], eax
push edi
mov dword [ebp - 0x78], eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x42b6e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0xed0]
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_ENABLESTOPSERVICE._failed_to_QueryServiceStatus._err_d
push edx
call fcn.0045ebd9
lea eax, [ebp - 0xed0]
push eax
call fcn.00411050
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 0x10
push edi
call esi
push ebx
call esi
jmp 0x42b74c
or dword [ebp - 0x88], 1
mov edx, dword [esi + 0x4c]
lea ecx, [ebp - 0x90]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x42b72f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xed0]
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_ENABLESTOPSERVICE._failed_to_SetServiceStatus._err_d
push eax
call fcn.0045ebd9
lea ecx, [ebp - 0xed0]
push ecx
call fcn.00411050
mov esi, dword [ebp + 0xc]
add esp, 0x10
jmp 0x42b734
mov esi, 1
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push ebx
call edi
cmp esi, 1
mov dword [ebp - 0x18], 2
je 0x42b753
mov dword [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x34], eax
mov edx, dword [0x491164]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0x2c
jmp 0x42b78b
test dword [0x4900e8], ebx
je 0x42b78b
mov eax, dword [ebp - 0xcc0]
push eax
push esi
push str.NamePipeServiceInstance._request__d_not_supported_for_data__d
call fcn.0040aab0
add esp, 0xc
mov eax, dword [ebp + 8]
push 0
lea ecx, [ebp - 0x74]
push ecx
push 0x2c
lea edx, [ebp - 0x40]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42b7ab
cmp dword [ebp - 0x74], 0x2c
je 0x42b7c6
mov ecx, dword [0x4900e8]
test dword [0x4902e8], ecx
je 0x42b7c6
push str.Write_to_Pipe_Failed
call fcn.0040aab0
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret