Function at 0x100ac9e
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], 0x24
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov eax, dword [0x1019080]
mov ebx, 0x1019080
cmp eax, ebx
je 0x100af4a
test byte [eax + 0x1c], 0x10
je 0x100af4a
cmp byte [eax + 0x19], 4
jb 0x100af4a
mov edi, 0x100afb8
push edi
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100130b
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.API_MS_Win_Core_Profile_L1_1_0.dll_QueryPerformanceFrequency]
mov eax, dword [ebp - 0x18]
mov dword [section.RT_BSS], eax
mov eax, dword [ebp - 0x14]
push 4
push esi
mov dword [0x1018004], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
xor eax, eax
cmp esi, eax
jl 0x100c275
mov esi, dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_CreateEventW]
push eax
push eax
push 1
push eax
call esi
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x44], eax
xor ecx, ecx
cmp eax, ecx
je 0x100c2aa
push ecx
push ecx
push 1
push ecx
call esi
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x48], eax
test eax, eax
je 0x100c2aa
push 0
push 0x100af94
push 0xa
push 0x100af84
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
mov esi, eax
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100ad8f
test byte [eax + 0x1c], 0x10
je 0x100ad8f
cmp byte [eax + 0x19], 4
jb 0x100ad8f
push esi
push edi
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001331
test esi, esi
jne 0x100af66
push 0x100a279
push 0x4d2
push 0x21
push esi
push esi
push dword [0x1019610]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
mov esi, eax
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100add7
test byte [eax + 0x1c], 0x10
je 0x100add7
cmp byte [eax + 0x19], 4
jb 0x100add7
push esi
push edi
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001331
test esi, esi
jne 0x100af66
xor eax, eax
inc eax
push eax
push esi
push esi
mov dword [0x10190b0], eax
call dword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_OpenSCManagerW]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x100c2c7
push 4
push 0x100af70
push eax
call dword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x100c307
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100ae37
test byte [eax + 0x1c], 0x10
je 0x100ae37
cmp byte [eax + 0x19], 4
jb 0x100ae37
push edi
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100130b
lea eax, [ebp - 0x10]
push eax
push 0x24
lea eax, [ebp - 0x3c]
push eax
push esi
push dword [ebp - 8]
call dword [sym.imp.API_MS_WIN_Service_Management_L2_1_0.dll_QueryServiceStatusEx]
test eax, eax
je 0x100c347
cmp dword [ebp - 0x38], 1
je 0x100af54
cmp dword [ebp - 0x38], 3
je 0x100af54
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100ae8d
test byte [eax + 0x1c], 0x10
je 0x100ae8d
cmp byte [eax + 0x19], 4
jb 0x100ae8d
push dword [ebp - 0x20]
push edi
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001331
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 4]
push eax
push 0
push 0x100000
mov dword [esi + 0x50], eax
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_OpenProcess]
mov dword [esi + 0x4c], eax
test eax, eax
je 0x100c37c
push 0x3020
push 2
push 4
mov ecx, esi
call fcn.0100b1f5
mov esi, eax
test esi, esi
jl 0x100af04
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor eax, eax
mov edi, 0x1019120
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0100a65c
mov esi, eax
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100af04
test byte [eax + 0x1c], 0x10
je 0x100af04
cmp byte [eax + 0x19], 4
jb 0x100af04
push esi
push 0x100afb8
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001331
cmp dword [ebp - 0xc], 0
mov edi, dword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_CloseServiceHandle]
je 0x100af15
push dword [ebp - 0xc]
call edi
cmp dword [ebp - 8], 0
je 0x100af20
push dword [ebp - 8]
call edi
mov edi, 0x100afb8
mov eax, dword [ebp - 4]
mov dword [eax + 0x40], esi
mov eax, dword [eax + 0x48]
test eax, eax
je 0x100af39
push eax
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
test esi, esi
jl 0x100c3f1
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
mov edi, 0x100afb8
jmp 0x100acf4
mov eax, dword [0x1019080]
cmp eax, ebx
jne 0x100c3bc
jmp 0x100c3d6
jle 0x100af25
jmp 0x100c3e0
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100af25
test byte [eax + 0x1c], 0x10
je 0x100af25
cmp byte [eax + 0x19], 4
jb 0x100af25
push esi
push edi
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001331
jmp 0x100af25
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
test eax, eax
jg 0x100c2bb
mov esi, eax
jmp 0x100af25
and eax, 0xffff
or eax, 0x80070000
jmp 0x100c2b4
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, esi
jle 0x100c2db
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100af04
test byte [eax + 0x1c], 0x10
je 0x100af04
cmp byte [eax + 0x19], 4
jb 0x100af04
push esi
push edi
push 0xf
jmp 0x100aef9
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, esi
jle 0x100c31b
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100af04
test byte [eax + 0x1c], 0x10
je 0x100af04
cmp byte [eax + 0x19], 4
jb 0x100af04
push esi
push edi
push 0x10
jmp 0x100aef9
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov esi, eax
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100c373
test byte [eax + 0x1c], 0x10
je 0x100c373
cmp byte [eax + 0x19], 4
jb 0x100c373
push esi
push edi
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001331
test esi, esi
jg 0x100c3e0
jmp 0x100af04
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
test eax, eax
jle 0x100c390
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100af04
test byte [eax + 0x1c], 0x10
je 0x100af04
cmp byte [eax + 0x19], 4
jb 0x100af04
push esi
push edi
push 0x15
jmp 0x100aef9
test byte [eax + 0x1c], 0x10
je 0x100c3d6
cmp byte [eax + 0x19], 4
jb 0x100c3d6
push edi
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100130b
mov esi, 0x80004005
jmp 0x100af04
and esi, 0xffff
or esi, 0x80070000
jmp 0x100af04
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100af41
test dword [eax + 0x1c], 0x40000
je 0x100af41
cmp byte [eax + 0x19], 2
jb 0x100af41
push esi
push edi
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001331
jmp 0x100af41