Function at 0x100409b
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x1006074]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x40], ecx
xor ebx, ebx
push 0x2000
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], ebx
call dword [sym.imp.IISUTIL.dll_public:_void___thiscall_BUFFER::constructor_unsigned_int_]
cmp esi, ebx
je 0x100431b
cmp edi, ebx
je 0x100431b
push 1
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x54], eax
cmp eax, ebx
jne 0x100411d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jg 0x1004111
mov dword [ebp - 0x34], eax
jmp 0x10042ff
and eax, 0xffff
or eax, 0x80070000
jmp 0x1004109
mov ecx, dword [ebp - 0x40]
push eax
call fcn.01003c9f
cmp eax, ebx
mov dword [ebp - 0x34], eax
jl 0x10042f6
mov ecx, dword [ebp - 0x40]
and dword [ebp - 0x38], 0
add ecx, 4
mov eax, dword [ecx]
mov ebx, eax
imul ebx, ebx, 0x24
test eax, eax
jbe 0x10042a4
add esi, 4
mov dword [ebp - 0x48], esi
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x38]
call fcn.01004a9f
mov dword [ebp - 0x34], eax
test eax, eax
jl 0x10042e7
push 0xf01ff
push dword [ebp - 0x44]
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x3c], esi
test esi, esi
je 0x10042ca
lea eax, [ebp - 0x84]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x10042ca
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push esi
call edi
test eax, eax
jne 0x10041f2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x7a
jne 0x10042d6
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0xc]
jbe 0x10041db
push eax
lea ecx, [ebp - 0x30]
call dword [sym.imp.IISUTIL.dll_private:_int___thiscall_BUFFER::ReallocStorage_unsigned_int_]
test eax, eax
je 0x10042da
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x3c]
call edi
test eax, eax
je 0x10042d6
mov eax, dword [ebp - 0x44]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10041f8
sub eax, edx
sar eax, 1
mov edx, eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x20]
lea ecx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x1004211
sub eax, ecx
sar eax, 1
mov dword [ebp - 0x64], eax
lea eax, [eax + edx + 2]
lea eax, [ebx + eax*2]
mov dword [ebp - 0x58], eax
cmp dword [ebp + 8], eax
jb 0x1004287
mov edi, dword [ebp - 0x48]
push 7
pop ecx
lea eax, [edx + edx + 2]
add edi, 4
push eax
push dword [ebp - 0x44]
lea esi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x60]
mov dword [ebp - 0x4c], eax
lea eax, [edi + ebx]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x64]
mov esi, dword [ebp - 0x48]
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x10]
mov dword [esi - 4], ebx
push dword [eax + 0x20]
mov eax, dword [ebp - 0x4c]
add eax, edi
add eax, ebx
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x4c]
add esp, 0x18
add eax, ebx
mov dword [esi], eax
mov eax, dword [ebp - 0x58]
inc dword [ebp - 0x38]
mov ecx, dword [ebp - 0x40]
add dword [ebp - 0x48], 0x24
mov ebx, eax
mov eax, dword [ebp - 0x38]
add ecx, 4
cmp eax, dword [ecx]
jb 0x1004150
mov edi, dword [ebp - 0x68]
cmp dword [ebp + 8], ebx
jae 0x10042e3
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x10042b2
mov dword [eax], ebx
mov dword [ebp - 0x34], 0x8007007a
jmp 0x10042e7
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x34], eax
jmp 0x10042e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x10042bb
jmp 0x10042c5
call esi
jmp 0x10042d0
mov dword [ebp - 0x34], 0x80070008
jmp 0x10042e7
mov eax, dword [ecx]
mov dword [edi], eax
cmp dword [ebp - 0x3c], 0
je 0x10042f6
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x40]
call fcn.01003838
test byte [ebp - 8], 1
je 0x1004316
lea ecx, [ebp - 0x30]
call dword [sym.imp.IISUTIL.dll_public:_void___thiscall_BUFFER::FreeMemory_void_]
mov eax, dword [ebp - 0x34]
jmp 0x100432f
test byte [ebp - 8], 1
je 0x100432a
lea ecx, [ebp - 0x30]
call dword [sym.imp.IISUTIL.dll_public:_void___thiscall_BUFFER::FreeMemory_void_]
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010033bb
leave
ret 0x10