Function at 0x409f00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x426151
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x104
push ebx
push esi
push edi
mov eax, dword [0x42f390]
mov dword [esp + 0x118], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x124]
lea ecx, [esp + 0x34]
push eax
mov byte [esp + 0x11c], 2
call fcn.00404160
lea ecx, [esp + 0xc8]
mov byte [esp + 0x118], 3
call fcn.00404a40
lea ecx, [esp + 0x70]
push 1
push ecx
lea ecx, [esp + 0x3c]
mov byte [esp + 0x120], 4
call fcn.004045d0
mov edx, dword [esp + 0x74]
lea eax, [edx - 1]
cmp eax, 6
ja case.default.0x409f87
jmp dword [eax*4 + 0x40a9b8]
push str.Start_pending
jmp 0x409fcc
push str.Stop_pending
jmp 0x409fcc
push str.Running
jmp 0x409fcc
push str.Continue_pending
jmp 0x409fcc
push str.Pause_pending
jmp 0x409fcc
push str.Paused
jmp 0x409fcc
mov eax, dword [esp + 0x7c]
test eax, eax
jne case.0x409f87.1
push str.Status:_unknown_
jmp 0x409fcc
push str.Stopped
lea ecx, [esp + 0x10]
call fcn.0041ef0f
lea eax, [esp + 0x14]
lea ecx, [esp + 0x34]
push eax
call fcn.004044a0
mov ecx, dword [esp + 0xc]
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x18]
push str.__s_s_
push eax
mov byte [esp + 0x128], 5
call fcn.0041e21c
add esp, 0x10
lea ecx, [esp + 0x14]
mov byte [esp + 0x118], 4
call fcn.0041edd2
push 1
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.0041eb47
mov edi, dword [esp + 0x128]
push edi
call fcn.00408bf0
add esp, 0xc
lea ecx, [esp + 0x30]
push str.SystemRoot
call fcn.0041ee40
mov eax, dword [0x42f390]
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x118], 7
push ecx
lea ecx, [esp + 0xcc]
call fcn.004051b0
test eax, eax
jne 0x40a076
lea ecx, [esp + 0x24]
call fcn.0041ed5d
lea edx, [esp + 0x14]
lea ecx, [esp + 0x34]
push edx
call fcn.004044c0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x11c], 8
call fcn.0041eebf
lea ecx, [esp + 0x14]
mov byte [esp + 0x118], 7
call fcn.0041edd2
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40a0c0
push str._unavailable_
lea ecx, [esp + 0x10]
call fcn.0041ef0f
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx - 8]
test eax, eax
je 0x40a13f
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push edx
call fcn.0041de96
test eax, eax
jne 0x40a13f
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x20]
mov eax, dword [eax - 8]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.0041dc9c
push eax
lea edx, [esp + 0x28]
lea eax, [esp + 0x18]
mov bl, 9
push edx
push eax
mov byte [esp + 0x124], bl
call fcn.0041efb5
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x11c], 0xa
call fcn.0041eebf
lea ecx, [esp + 0x14]
mov byte [esp + 0x118], bl
call fcn.0041edd2
lea ecx, [esp + 0x20]
mov byte [esp + 0x118], 7
call fcn.0041edd2
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push str.Pathname
push str.__s_s_
push edx
call fcn.0041e21c
add esp, 0x10
lea eax, [esp + 0x10]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0041eb47
push edi
call fcn.00408bf0
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.0041ed5d
mov eax, dword [esp + 0x70]
mov ecx, eax
and ecx, 0x10
cmp cl, 0x10
jne 0x40a195
push str.Runs_in_its_own_process
jmp 0x40a1c6
mov edx, eax
and edx, 0x20
cmp dl, 0x20
jne 0x40a1a6
push str.Shares_a_process_with_other_processes
jmp 0x40a1c6
mov ecx, eax
and ecx, 1
cmp cl, 1
jne 0x40a1b7
push str.Kernel_device_driver
jmp 0x40a1c6
mov edx, eax
and edx, 2
cmp dl, 2
jne 0x40a1d3
push str.File_system_driver
lea ecx, [esp + 0x10]
call fcn.0041ef0f
mov eax, dword [esp + 0x70]
and eax, 0x100
cmp eax, 0x100
jne 0x40a216
lea eax, [esp + 0xc]
push str._and_can_iteract_with_the_desktop
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0041f01b
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x11c], 0xb
call fcn.0041eebf
lea ecx, [esp + 0x14]
mov byte [esp + 0x118], 7
call fcn.0041edd2
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push str.Service_Type
push str.__s_s_
push eax
call fcn.0041e21c
add esp, 0x10
lea edx, [esp + 0x10]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.0041eb47
push edi
call fcn.00408bf0
add esp, 0xc
lea ecx, [esp + 0x34]
call fcn.00404570
cmp eax, 4
ja case.default.0x40a25c
jmp dword [eax*4 + 0x40a9d4]
push str.Boot
jmp 0x40a28b
push str.System
jmp 0x40a28b
push str.Automatic
jmp 0x40a28b
push str.Manual
jmp 0x40a28b
push str.Disabled
jmp 0x40a28b
push str._unknown_
lea ecx, [esp + 0x10]
call fcn.0041ef0f
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push str.Start_Type
push str.__s_s_
push ecx
call fcn.0041e21c
add esp, 0x10
lea edx, [esp + 0x10]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.0041eb47
push edi
call fcn.00408bf0
add esp, 0xc
lea ecx, [esp + 0x34]
call fcn.004045a0
cmp eax, 3
ja case.default.0x40a2da
jmp dword [eax*4 + 0x40a9e8]
push str.Ignore
jmp 0x40a302
push str.Normal
jmp 0x40a302
push str.Severe
jmp 0x40a302
push str.Critical
jmp 0x40a302
push str._unknown_
lea ecx, [esp + 0x10]
call fcn.0041ef0f
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push str.Error_Severity
push str.__s_s_
push ecx
call fcn.0041e21c
add esp, 0x10
lea edx, [esp + 0x10]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.0041eb47
push edi
call fcn.00408bf0
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x34]
push eax
call fcn.004044e0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x11c], 0xc
call fcn.0041eebf
lea ecx, [esp + 0x14]
mov byte [esp + 0x118], 7
call fcn.0041edd2
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40a3b3
push eax
push str.Group
lea ecx, [esp + 0x18]
push str.__s_s_
push ecx
call fcn.0041e21c
add esp, 0x10
lea edx, [esp + 0x10]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.0041eb47
push edi
call fcn.00408bf0
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x34]
push eax
call fcn.00404520
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x11c], 0xd
call fcn.0041eebf
lea ecx, [esp + 0x14]
mov byte [esp + 0x118], 7
call fcn.0041edd2
mov eax, dword [esp + 0x128]
test eax, eax
jne 0x40a42f
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40a408
push str.LocalSystem
lea ecx, [esp + 0x10]
call fcn.0041ef0f
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push str.Service_Account_Name
push str.__s_s_
push eax
call fcn.0041e21c
add esp, 0x10
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
jmp 0x40a45b
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40a46e
push eax
push str.Driver_Object_Name
lea eax, [esp + 0x18]
push str.__s_s_
push eax
call fcn.0041e21c
add esp, 0x10
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
lea edx, [esp + 0x18]
push edx
call fcn.0041eb47
push edi
call fcn.00408bf0
add esp, 0xc
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x34]
push eax
call fcn.00404500
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x118], 0xe
mov eax, dword [ecx - 8]
test eax, eax
je 0x40a721
push str.Dependencies
lea edx, [esp + 0x14]
push str.__s_
push edx
call fcn.0041e21c
add esp, 0xc
lea eax, [esp + 0x10]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0041eb47
push edi
call fcn.00408bf0
add esp, 0xc
lea ecx, [esp + 0x1c]
push 0x42e79c
call fcn.0041de96
mov esi, eax
cmp esi, 0xffffffff
je 0x40a63a
lea ecx, [esp + 0x20]
push esi
push ecx
lea ecx, [esp + 0x24]
call fcn.0041ddd1
push 1
push 0x2b
lea ecx, [esp + 0x1c]
mov byte [esp + 0x120], 0xf
call fcn.0041dc68
lea edx, [esp + 0x48]
push 1
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x120], 0x10
call fcn.0041ddd1
mov ecx, dword [esp + 0x14]
mov eax, dword [eax]
push ecx
push eax
call fcn.004117d4
add esp, 8
lea ecx, [esp + 0x48]
test eax, eax
sete bl
call fcn.0041edd2
lea ecx, [esp + 0x14]
mov byte [esp + 0x118], 0xf
call fcn.0041edd2
test bl, bl
je 0x40a5aa
lea edx, [esp + 0x28]
push 1
push edx
lea ecx, [esp + 0x28]
call fcn.0041dc9c
push str.__Group_
push eax
lea eax, [esp + 0x4c]
mov byte [esp + 0x120], 0x11
push eax
call fcn.0041f01b
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x11c], 0x12
call fcn.0041eebf
lea ecx, [esp + 0x44]
mov byte [esp + 0x118], 0x11
call fcn.0041edd2
lea ecx, [esp + 0x28]
mov byte [esp + 0x118], 0xf
call fcn.0041edd2
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
push str.__s_
push edx
call fcn.0041e21c
add esp, 0xc
lea eax, [esp + 0x10]
push 3
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.0041eb47
push edi
call fcn.00408bf0
add esp, 0xc
inc esi
lea ecx, [esp + 0x18]
push esi
push ecx
lea ecx, [esp + 0x24]
call fcn.0041dc9c
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x11c], 0x13
call fcn.0041eebf
lea ecx, [esp + 0x18]
mov byte [esp + 0x118], 0xf
call fcn.0041edd2
lea ecx, [esp + 0x20]
mov byte [esp + 0x118], 0xe
call fcn.0041edd2
push 0x42e79c
lea ecx, [esp + 0x20]
call fcn.0041de96
mov esi, eax
cmp esi, 0xffffffff
jne 0x40a4df
push 1
push 0x2b
lea ecx, [esp + 0x1c]
call fcn.0041dc68
lea edx, [esp + 0x18]
push 1
push edx
lea ecx, [esp + 0x24]
mov byte [esp + 0x120], 0x14
call fcn.0041ddd1
mov ecx, dword [esp + 0x14]
mov eax, dword [eax]
push ecx
push eax
call fcn.004117d4
add esp, 8
lea ecx, [esp + 0x18]
test eax, eax
sete bl
call fcn.0041edd2
lea ecx, [esp + 0x14]
mov byte [esp + 0x118], 0xe
call fcn.0041edd2
test bl, bl
je 0x40a6ee
lea edx, [esp + 0x28]
push 1
push edx
lea ecx, [esp + 0x24]
call fcn.0041dc9c
push str.__Group_
push eax
lea eax, [esp + 0x20]
mov bl, 0x15
push eax
mov byte [esp + 0x124], bl
call fcn.0041f01b
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x11c], 0x16
call fcn.0041eebf
lea ecx, [esp + 0x18]
mov byte [esp + 0x118], bl
call fcn.0041edd2
lea ecx, [esp + 0x28]
mov byte [esp + 0x118], 0xe
call fcn.0041edd2
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
push str.__s_
push edx
call fcn.0041e21c
add esp, 0xc
lea eax, [esp + 0x10]
push 3
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.0041eb47
push edi
call fcn.00408bf0
add esp, 0xc
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x90]
call fcn.004034f0
push 3
lea ecx, [esp + 0x90]
mov byte [esp + 0x11c], 0x17
call fcn.00403680
test eax, eax
je 0x40a8d0
lea ecx, [esp + 0x5c]
call fcn.0041e490
lea edx, [esp + 0x5c]
lea ecx, [esp + 0x8c]
push edx
mov byte [esp + 0x11c], 0x18
call fcn.00403800
mov eax, dword [esp + 0x64]
test eax, eax
jle 0x40a7ad
push str.Dependents
lea eax, [esp + 0x14]
push str.__s_
push eax
call fcn.0041e21c
add esp, 0xc
lea edx, [esp + 0x10]
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.0041eb47
push edi
call fcn.00408bf0
add esp, 0xc
mov eax, dword [esp + 0x64]
xor esi, esi
test eax, eax
jle 0x40a8bf
mov bl, 0x19
mov eax, dword [esp + 0x60]
lea ecx, [esp + 0x4c]
mov eax, dword [eax + esi*4]
push eax
call fcn.00404160
lea ecx, [esp + 0x4c]
mov byte [esp + 0x118], bl
call fcn.00404540
and eax, 1
cmp al, 1
je 0x40a845
lea ecx, [esp + 0x4c]
call fcn.00404540
and eax, 2
cmp al, 2
je 0x40a845
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x50]
call fcn.004044a0
mov edx, dword [eax]
push str.Service
push edx
lea eax, [esp + 0x18]
push str.__s_s_
push eax
mov byte [esp + 0x128], 0x1b
call fcn.0041e21c
add esp, 0x10
lea ecx, [esp + 0x18]
mov byte [esp + 0x118], bl
call fcn.0041edd2
push 3
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
jmp 0x40a893
lea eax, [esp + 0x28]
lea ecx, [esp + 0x4c]
push eax
call fcn.004044a0
mov ecx, dword [eax]
push str.Device
push ecx
lea edx, [esp + 0x18]
push str.__s_s_
push edx
mov byte [esp + 0x128], 0x1a
call fcn.0041e21c
add esp, 0x10
lea ecx, [esp + 0x28]
mov byte [esp + 0x118], bl
call fcn.0041edd2
push 3
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.0041eb47
push edi
call fcn.00408bf0
add esp, 0xc
lea ecx, [esp + 0x4c]
mov byte [esp + 0x118], 0x18
call fcn.00404240
mov eax, dword [esp + 0x64]
inc esi
cmp esi, eax
jl 0x40a7bd
lea ecx, [esp + 0x5c]
mov byte [esp + 0x118], 0x17
call fcn.0041e4c3
lea ecx, [esp + 0xb0]
mov byte [esp + 0x118], 0x1d
call fcn.0041e4c3
lea ecx, [esp + 0x9c]
mov byte [esp + 0x118], 0x1c
call fcn.0041e4c3
lea ecx, [esp + 0x8c]
mov byte [esp + 0x118], 0xe
call fcn.00404240
lea ecx, [esp + 0x1c]
mov byte [esp + 0x118], 7
call fcn.0041edd2
lea ecx, [esp + 0x24]
mov byte [esp + 0x118], 6
call fcn.0041edd2
lea ecx, [esp + 0x30]
mov byte [esp + 0x118], 4
call fcn.0041edd2
lea ecx, [esp + 0xc8]
mov byte [esp + 0x118], 3
call fcn.00404a70
lea ecx, [esp + 0x34]
mov byte [esp + 0x118], 2
call fcn.00404240
lea ecx, [esp + 0x10]
mov byte [esp + 0x118], 1
call fcn.0041edd2
lea ecx, [esp + 0xc]
mov byte [esp + 0x118], 0
call fcn.0041edd2
lea ecx, [esp + 0x124]
mov dword [esp + 0x118], 0xffffffff
call fcn.0041edd2
mov ecx, dword [esp + 0x110]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x110
ret