Function at 0x42a210
Capabilities:
Query service status
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470760
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x8940
call fcn.00461300
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov dword [eax], 0
mov dword [ecx], 0
mov dword [ebp - 0x10], esp
xor eax, eax
push eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x54]
push edx
mov ecx, 0x188
lea edi, [ebp - 0xcd0]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
push 0x7a80
lea eax, [ebp - 0x8950]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42a2ef
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x42a2ef
mov ebx, dword [0x49a2e8]
test dword [0x49a0e8], ebx
je 0x42a2ab
push str.NamePipeServiceInstanceThread:_Read_from_Pipe_Success
call fcn.0040acd0
mov ebx, dword [0x49a2e8]
add esp, 4
mov ecx, dword [ebp - 0x54]
mov edx, ecx
shr ecx, 2
lea esi, [ebp - 0x8950]
lea edi, [ebp - 0xcd0]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xcd0], 0x8001
jne 0x42a2e0
cmp dword [ebp - 0xccc], 0x620
je 0x42a310
test dword [0x49a0e8], ebx
je 0x42a310
push str.NamePipeServiceInstanceThread:_Pipe_read_msg_contents_error__something_wrong
jmp 0x42a302
mov ebx, dword [0x49a2e8]
test dword [0x49a0e8], ebx
je 0x42a310
push str.NamePipeServiceInstanceThread:_Read_from_Pipe_Failed
call fcn.0040acd0
mov ebx, dword [0x49a2e8]
add esp, 4
mov esi, dword [ebp - 0xcc8]
lea eax, [esi - 9]
cmp eax, 0x37
mov dword [ebp - 0x44], esi
ja case.0x42a32c.10
movzx eax, byte [eax + 0x42bb04]
jmp dword [eax*4 + 0x42ba98]
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42a35d
test dword [0x49a0e8], ebx
je 0x42ba4c
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_FEATUREUPDATE._ulSessionId___d__out_of_range
call fcn.0040acd0
add esp, 8
jmp 0x42ba4c
mov ecx, 0x49c088
call fcn.00431a60
mov ecx, dword [0x49a0e8]
test dword [0x49a2e8], ecx
je 0x42ba4c
push str.finish_feature_update
call fcn.0040acd0
add esp, 4
jmp 0x42ba4c
mov eax, dword [0x49b638]
xor edi, edi
cmp eax, 7
ja 0x42a455
mov esi, dword [ebp - 0xcc0]
cmp esi, 0x14
jae 0x42a460
cmp dword [0x49a39c], edi
je 0x42a3bd
mov dword [0x49a39c], edi
mov edi, 1
push 0
push esi
call fcn.00429840
add esp, 8
cmp eax, 0xffffffff
je 0x42a4a2
push esi
lea eax, [eax + eax*8]
shl eax, 5
push str..pipeExtEventPipe
lea edx, [eax + 0x4a9164]
push str._s_s_d
push edx
mov dword [eax + 0x4a9268], 1
mov dword [eax + 0x4a9160], esi
call fcn.00460f01
mov eax, dword [0x49b704]
mov ecx, dword [0x49b63c]
add esp, 0x10
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], edi
mov edx, dword [0x49a0e8]
test dword [0x49a2e8], edx
je 0x42ba4c
push str.Send_RegOption_to_Client
call fcn.0040acd0
add esp, 4
jmp 0x42ba4c
mov esi, dword [ebp - 0xcc4]
cmp esi, 0x14
jb 0x42a47f
test dword [0x49a0e8], ebx
je 0x42ba4c
push esi
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_SETUP._ulSessionId___d__out_of_range
call fcn.0040acd0
add esp, 8
jmp 0x42ba4c
cmp dword [0x49a39c], edi
je 0x42a492
mov dword [0x49a39c], edi
mov edi, 1
push 0
push esi
call fcn.00429840
add esp, 8
cmp eax, 0xffffffff
jne 0x42a4cd
test dword [0x49a0e8], ebx
je 0x42ba87
push esi
push str.NamePipeServiceInstance:__d_not_enough_session_slot_to_assign_this_setup_session
call fcn.0040acd0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [eax + eax*8]
shl eax, 5
push esi
push str..pipeExtEventPipe
mov dword [eax + 0x4a9268], 1
mov dword [eax + 0x4a9160], esi
lea eax, [eax + 0x4a9164]
push str._s_s_d
push eax
call fcn.00460f01
mov ecx, dword [ebp - 0xcb8]
mov edx, dword [0x49b63c]
mov eax, dword [ebp - 0xcbc]
mov ebx, dword [ebp - 0xcc0]
or edx, ecx
mov ecx, dword [0x49b700]
mov dword [0x49b63c], edx
mov edx, dword [ebp - 0xcb4]
and edx, 0x8000
add esp, 0x10
cmp ecx, 1
mov esi, eax
mov dword [0x49b670], edx
jne 0x42a547
mov dword [0x4a7fd8], ebx
mov dword [0x4a7fdc], eax
push eax
mov ecx, 0x49c088
call fcn.0042d920
push esi
mov ecx, 0x49c088
mov dword [eax + 0x15c], 1
call fcn.0042d920
mov dword [eax + 0x44], ebx
mov ecx, dword [0x49b700]
mov eax, dword [0x49b704]
mov edx, dword [0x4a7fd8]
mov dword [ebp - 0x34], ecx
mov ecx, dword [0x49b664]
mov dword [ebp - 0x40], eax
mov eax, dword [0x4a7fdc]
push ecx
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edi
call fcn.0040fd30
add esp, 4
jmp 0x42a431
mov edi, dword [ebp - 0xcc0]
cmp edi, 0x14
mov dword [ebp - 0x14], edi
jb 0x42a5e5
test dword [0x49a0e8], ebx
je 0x42ba4c
push edi
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_READY._ulSessionId___d__out_of_range
call fcn.0040acd0
add esp, 8
jmp 0x42ba4c
push 1
push edi
call fcn.00429840
add esp, 8
cmp eax, 0xffffffff
je 0x42a88c
lea edi, [eax + eax*8]
shl edi, 5
mov eax, dword [edi + 0x4a9268]
mov ecx, 3
cmp eax, ecx
je 0x42a627
cmp eax, 5
je 0x42a627
cmp esi, 0xb
jne 0x42a627
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
mov ebx, dword [0x49a2e8]
cmp dword [edi + 0x4a9268], ecx
jne 0x42a647
cmp dword [0x4a915c], 1
jne 0x42a647
mov edx, dword [ebp + 0xc]
mov dword [edx], 1
mov ebx, dword [0x49a2e8]
cmp esi, 0x1e
jne 0x42a662
mov dword [edi + 0x4a9268], 2
mov dword [0x4a915c], 1
jmp 0x42a67b
cmp dword [edi + 0x4a9268], 5
je 0x42a67b
mov dword [edi + 0x4a9268], ecx
mov dword [0x4a915c], 0
cmp dword [edi + 0x4a9268], 2
jne 0x42a6c8
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
mov eax, dword [0x49b658]
test eax, eax
je 0x42a6c2
xor esi, esi
jmp 0x42a6a0
mov ecx, dword [0x49b658]
push esi
call fcn.00401c70
mov ecx, dword [0x49b658]
push esi
mov dword [ebp + esi*4 - 0x34], eax
call fcn.00401bf0
inc esi
cmp esi, 5
jb 0x42a6a0
mov ebx, dword [0x49a2e8]
cmp dword [edi + 0x4a9160], 0xffffffff
jne 0x42a6fa
mov eax, dword [ebp - 0x14]
push eax
push str..pipeExtEventPipe
lea ecx, [edi + 0x4a9164]
push str._s_s_d
push ecx
mov dword [edi + 0x4a9160], eax
call fcn.00460f01
mov ebx, dword [0x49a2e8]
add esp, 0x10
test dword [0x49a0e8], ebx
je 0x42a719
mov edx, dword [ebp - 0x14]
push edx
push str.NamePipeServiceInstance._Got_EXTEVENT_REQTYPE_SESSION_READY_from_session__d
call fcn.0040acd0
mov ebx, dword [0x49a2e8]
add esp, 8
mov eax, dword [0x4a9158]
cmp eax, dword [ebp - 0x14]
mov edi, eax
je 0x42a757
test dword [0x49a0e8], ebx
je 0x42a73f
mov ecx, dword [ebp - 0x14]
push ecx
push eax
push str.NamePipeServiceInstance._Active_session_has_changed_from__d_to__d
call fcn.0040acd0
add esp, 0xc
cmp dword [ebp - 0x44], 0xb
mov edx, dword [ebp - 0x14]
mov dword [0x4a9158], edx
jne 0x42a757
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
mov ecx, dword [0x49b678]
test ecx, ecx
je 0x42ba4c
cmp dword [ebp - 0x44], 0xb
jne 0x42ba4c
call fcn.00417c10
cmp dword [0x49b638], 6
je 0x42ba4c
push 1
push edi
call fcn.00429840
mov ecx, dword [ebp - 0x14]
add esp, 8
cmp edi, ecx
je 0x42ba4c
cmp edi, 0xffffffff
je 0x42ba4c
cmp eax, 0xffffffff
jne 0x42a7d6
mov ecx, dword [0x49a0e8]
test dword [0x49a2e8], ecx
je 0x42ba87
push edi
push str.NamePipeServiceInstance:_BUG__d_notin_list
call fcn.0040acd0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [eax + eax*8]
shl edx, 5
cmp dword [edx + 0x4a9268], 5
jne 0x42ba4c
xor eax, eax
push 1
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov eax, dword [0x49b704]
push 0
lea ecx, [ebp - 0x6b0]
lea esi, [edx + 0x4a9164]
push ecx
push esi
mov dword [ebp - 0x6a8], 0x1b
mov dword [ebp - 0x6a0], eax
call fcn.00409e90
add esp, 0x10
test eax, eax
jne 0x42ba4c
mov edx, dword [0x49a0e8]
test dword [0x49a2e8], edx
je 0x42ba4c
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_CLIENTSETUNLOCKEVENT_on_pipe__s_.
call fcn.0040acd0
add esp, 8
jmp 0x42ba4c
mov edi, dword [ebp - 0xcc0]
cmp edi, 0x14
jb 0x42a87c
test dword [0x49a0e8], ebx
je 0x42ba4c
push edi
push esi
push str.NamePipeServiceInstance._WARNING_reqtype_d._ulSessionId___d__out_of_range
call fcn.0040acd0
add esp, 0xc
jmp 0x42a8f4
push 1
push edi
call fcn.00429840
add esp, 8
cmp eax, 0xffffffff
jne 0x42a8b7
test dword [0x49a0e8], ebx
je 0x42ba87
push edi
push str.NamePipeServiceInstance:_BUG__d_notin_list
call fcn.0040acd0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [eax + eax*8]
shl eax, 5
mov dword [eax + 0x4a9268], 4
cmp dword [0x4a9158], edi
jne 0x42a8fa
mov ecx, dword [0x49b678]
test ecx, ecx
mov dword [0x4a9158], 0xffffffff
mov dword [0x4a915c], 1
je 0x42a8fa
push 0
call fcn.00417c50
mov ebx, dword [0x49a2e8]
test dword [0x49a0e8], ebx
je 0x42ba4c
mov ecx, dword [ebp - 0x44]
push edi
push ecx
push str.NamePipeServiceInstance._reqtype_d_called_from_session__d
jmp 0x42ba44
mov esi, dword [ebp - 0xcc0]
cmp esi, 0x14
mov dword [ebp - 0x14], esi
jb 0x42a93a
test dword [0x49a0e8], ebx
je 0x42ba4c
push esi
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_READYBUTLOCKED._ulSessionId___d__out_of_range
jmp 0x42a9fa
push 1
push esi
call fcn.00429840
add esp, 8
cmp eax, 0xffffffff
je 0x42aba5
lea eax, [eax + eax*8]
shl eax, 5
mov ecx, dword [eax + 0x4a9268]
cmp ecx, 5
lea eax, [eax + 0x4a9268]
je 0x42a96b
mov dword [eax], 3
cmp dword [0x4a9158], esi
jne 0x42aa08
mov ecx, dword [0x49b678]
test ecx, ecx
mov dword [0x4a915c], 1
je 0x42aa08
push 0
call fcn.00417c50
call fcn.0040a190
mov esi, eax
cmp dword [0x49b638], 6
jne 0x42aa02
test esi, esi
je 0x42aa02
mov edx, dword [0x49b704]
xor eax, eax
push 1
push eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x6b0]
push eax
push esi
mov dword [ebp - 0x6a8], 0xd
mov dword [ebp - 0x6a0], edx
call fcn.00409e90
add esp, 0x10
test eax, eax
jne 0x42aa02
mov ebx, dword [0x49a2e8]
test dword [0x49a0e8], ebx
je 0x42ba4c
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_SCREENSAVERSTOP_on_pipe__s_.
call fcn.0040acd0
add esp, 8
mov ebx, dword [0x49a2e8]
test dword [0x49a0e8], ebx
je 0x42ba4c
mov ecx, dword [ebp - 0x14]
push ecx
push str.NamePipeServiceInstance._EXTEVENT_REQTYPE_CLT_READYBUTLOCKED_called_from_session__d
call fcn.0040acd0
add esp, 8
jmp 0x42ba4c
mov eax, dword [ebp - 0xcc0]
cmp eax, 0x14
mov esi, eax
jb 0x42aa4f
test dword [0x49a0e8], ebx
je 0x42aa7f
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_LOGGEDOFF._ulSessionId___d__out_of_range
call fcn.0040acd0
add esp, 8
jmp 0x42aa79
mov ecx, dword [0x4a9158]
cmp ecx, eax
je 0x42aa70
test dword [0x49a0e8], ebx
je 0x42aa70
push eax
push ecx
push str.NamePipeServiceInstance._WARNING._EXTEVENT_REQTYPE_CLT_LOGGEDOFF_m_SessionClients.ulActiveSessionId___d____ulSessionId___d_
call fcn.0040acd0
add esp, 0xc
push esi
call fcn.00429890
add esp, 4
mov ebx, dword [0x49a2e8]
test dword [0x49a0e8], ebx
je 0x42ba4c
push esi
push str.NamePipeServiceInstance._EXTEVENT_REQTYPE_CLT_LOGGEDOFF_called_from_session__d
call fcn.0040acd0
add esp, 8
jmp 0x42ba4c
mov eax, dword [ebp - 0xcc0]
cmp eax, 0x14
mov esi, eax
jb 0x42aac9
test dword [0x49a0e8], ebx
je 0x42ab1d
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_IN_RESUME._ulSessionId___d__out_of_range
call fcn.0040acd0
mov ebx, dword [0x49a2e8]
add esp, 8
jmp 0x42ab1d
mov ecx, dword [0x4a9158]
cmp ecx, eax
je 0x42aaf0
test dword [0x49a0e8], ebx
je 0x42aaf0
push eax
push ecx
push str.NamePipeServiceInstance._WARNING._EXTEVENT_REQTYPE_CLT_IN_RESUME_m_SessionClients.ulActiveSessionId___d____ulSessionId___d_
call fcn.0040acd0
mov ebx, dword [0x49a2e8]
add esp, 0xc
push 1
push esi
call fcn.00429840
add esp, 8
cmp eax, 0xffffffff
je 0x42aba5
lea eax, [eax + eax*8]
shl eax, 5
cmp dword [eax + 0x4a9160], 0xffffffff
je 0x42ab1d
mov dword [eax + 0x4a9268], 5
test dword [0x49a0e8], ebx
je 0x42ba4c
push esi
push str.NamePipeServiceInstance._EXTEVENT_REQTYPE_CLT_IN_RESUME_called_from_session__d
call fcn.0040acd0
add esp, 8
jmp 0x42ba4c
mov eax, dword [ebp - 0xcc0]
cmp eax, 0x14
mov esi, eax
jb 0x42ab6e
test dword [0x49a0e8], ebx
je 0x42abf2
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_OUTOF_RESUME._ulSessionId___d__out_of_range
call fcn.0040acd0
mov ebx, dword [0x49a2e8]
add esp, 8
jmp 0x42abf2
mov ecx, dword [0x4a9158]
cmp ecx, eax
je 0x42ab95
test dword [0x49a0e8], ebx
je 0x42ab95
push eax
push ecx
push str.NamePipeServiceInstance._WARNING._EXTEVENT_REQTYPE_CLT_OUTOF_RESUME_m_SessionClients.ulActiveSessionId___d____ulSessionId___d_
call fcn.0040acd0
mov ebx, dword [0x49a2e8]
add esp, 0xc
push 1
push esi
call fcn.00429840
add esp, 8
cmp eax, 0xffffffff
jne 0x42abd0
test dword [0x49a0e8], ebx
je 0x42ba87
push esi
push str.NamePipeServiceInstance:_BUG__d_notin_list
call fcn.0040acd0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [eax + eax*8]
shl eax, 5
cmp dword [eax + 0x4a9160], 0xffffffff
je 0x42abf2
cmp dword [eax + 0x4a9268], 5
jne 0x42abf2
mov dword [eax + 0x4a9268], 3
test dword [0x49a0e8], ebx
je 0x42ba4c
push esi
push str.NamePipeServiceInstance._EXTEVENT_REQTYPE_CLT_OUTOF_RESUME_called_from_session__d
call fcn.0040acd0
add esp, 8
jmp 0x42ba4c
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42ac3b
test dword [0x49a0e8], ebx
je 0x42ba4c
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_SAFEESCAPEREGISTRATIONQUERY._ulSessionId___d__out_of_range
call fcn.0040acd0
add esp, 8
jmp 0x42ba4c
mov ecx, 0x49c088
call fcn.004300f0
mov ecx, dword [0x49a2e8]
mov edx, dword [0x49b704]
mov dword [ebp - 0x34], eax
mov eax, dword [0x49a0e8]
test eax, ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x38], 0x24
je 0x42ba4c
push str.Finish_Safe_Escape_Registration_Status_Query_n
call fcn.0040acd0
add esp, 4
jmp 0x42ba4c
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42acb5
test dword [0x49a0e8], ebx
je 0x42ba4c
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_SAFEESCAPEREGISTRATIONUPDATE._ulSessionId___d__out_of_range
call fcn.0040acd0
add esp, 8
jmp 0x42ba4c
test dword [0x49a0e8], ebx
mov ecx, dword [0x49b704]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x38], 0x25
je 0x42ba4c
push str.Finish_Safe_Escape_Registration_Status_Update_n
call fcn.0040acd0
add esp, 4
jmp 0x42ba4c
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42ad1b
test dword [0x49a0e8], ebx
je 0x42ba4c
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_SAVEPROFILEATSHUTDOWN_FINISHES._ulSessionId___d__out_of_range
call fcn.0040acd0
add esp, 8
jmp 0x42ba4c
mov ecx, 0x49b9a0
call fcn.00416110
mov eax, dword [0x49a0e8]
test dword [0x49a2e8], eax
mov edx, dword [0x49b704]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x38], 0x27
je 0x42ba4c
push str.Finish_EXTEVENT_REQTYPE_CLT_SAVEPROFILEATSHUTDOWN_FINISHES_n
call fcn.0040acd0
add esp, 4
jmp 0x42ba4c
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42ad90
test dword [0x49a0e8], ebx
je 0x42ba4c
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_STOPSCREENSAVEREVENT._ulSessionId___d__out_of_range
call fcn.0040acd0
add esp, 8
jmp 0x42ba4c
mov eax, dword [0x49b66c]
test eax, eax
je 0x42ae0f
call fcn.0040a190
mov esi, eax
cmp dword [0x4a9158], 0xffffffff
je 0x42ae0f
test esi, esi
je 0x42ae0f
xor eax, eax
push 1
push eax
lea edx, [ebp - 0x6b0]
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov ecx, dword [0x49b704]
push edx
push esi
mov dword [ebp - 0x6a8], 0x29
mov dword [ebp - 0x6a0], ecx
call fcn.00409e90
mov ebx, dword [0x49a2e8]
add esp, 0x10
test eax, eax
jne 0x42ae0f
test dword [0x49a0e8], ebx
je 0x42ba4c
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_SCREENSAVERSTOP_on_pipe__s_.
call fcn.0040acd0
mov ebx, dword [0x49a2e8]
add esp, 8
test dword [0x49a0e8], ebx
je 0x42ba4c
push str.Finish_EXTEVENT_REQTYPE_CLT_STOPSCREENSAVEREVENT_n
call fcn.0040acd0
add esp, 4
jmp 0x42ba4c
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42ae57
test dword [0x49a0e8], ebx
je 0x42ba4c
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_STARTSCREENSAVEREVENT._ulSessionId___d__out_of_range
call fcn.0040acd0
add esp, 8
jmp 0x42ba4c
mov eax, dword [0x49b66c]
test eax, eax
je 0x42aed6
call fcn.0040a190
mov esi, eax
cmp dword [0x4a9158], 0xffffffff
je 0x42aed6
test esi, esi
je 0x42aed6
xor eax, eax
push 1
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov eax, dword [0x49b704]
push 0
lea ecx, [ebp - 0x6b0]
push ecx
push esi
mov dword [ebp - 0x6a8], 0x2b
mov dword [ebp - 0x6a0], eax
call fcn.00409e90
mov ebx, dword [0x49a2e8]
add esp, 0x10
test eax, eax
jne 0x42aed6
test dword [0x49a0e8], ebx
je 0x42ba4c
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_SCREENSAVERSTART_on_pipe__s_.
call fcn.0040acd0
mov ebx, dword [0x49a2e8]
add esp, 8
test dword [0x49a0e8], ebx
je 0x42ba4c
push str.Finish_EXTEVENT_REQTYPE_CLT_STARTSCREENSAVEREVENT_n
call fcn.0040acd0
add esp, 4
jmp 0x42ba4c
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42af1e
test dword [0x49a0e8], ebx
je 0x42ba4c
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_WRITEEVENTLOGMSG._ulSessionId___d__out_of_range
call fcn.0040acd0
add esp, 8
jmp 0x42ba4c
mov ecx, dword [0x49b838]
test ecx, ecx
mov eax, dword [ebp - 0xcbc]
mov dword [ebp + 0xc], eax
je 0x42ba4c
mov edx, dword [ebp - 0xcc0]
push 0
push 0
push 0
push eax
push edx
mov dword [ebp - 4], 0
call fcn.004114d0
cmp dword [ebp + 0xc], 0x8000006e
mov dword [ebp - 4], 0xffffffff
jne 0x42ba4c
push 0xc
call fcn.00423990
add esp, 4
jmp 0x42ba4c
test dword [0x49a0e8], ebx
je 0x42afa7
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_REGISTERCOMOBJECT_is_called
call fcn.0040acd0
add esp, 4
mov ecx, dword [0x4a9158]
push 1
push ecx
call fcn.00429840
add esp, 8
cmp eax, 0xffffffff
je 0x42ba4c
mov edx, dword [0x48e84c]
lea ebx, [eax + eax*8]
shl ebx, 5
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0xcc0]
mov dword [ebp + 0x10], ebx
lea ebx, [ebx + 0x4a926c]
push ecx
mov ecx, ebx
mov dword [ebp - 0x18], 1
mov dword [ebp + 0xc], edx
call fcn.00429bf0
mov edx, dword [ebp + 0xc]
cmp edx, dword [0x48e84c]
jne 0x42ba4c
push 0x30
call fcn.00460f8e
mov edx, eax
add esp, 4
xor eax, eax
test edx, edx
je 0x42b01e
mov ecx, 0xc
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, edx
lea edi, [eax + 8]
mov ecx, 0xa
lea esi, [ebp - 0xcc0]
rep movsd dword es:[edi], dword [esi]
mov dword [eax], 0
mov dword [eax + 4], 0
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x42b04c
mov dword [eax + 4], ecx
mov ecx, dword [ebx + 8]
mov dword [ecx], eax
jmp 0x42b04f
mov dword [ebx + 4], eax
mov edx, dword [ebx + 0xc]
mov dword [ebx + 8], eax
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
inc edx
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov dword [ebx + 0xc], edx
push 1
mov dword [ebp - 0x6a8], 0x2d
mov ecx, 0xa
lea esi, [ebp - 0xcc0]
lea edi, [ebp - 0x6a0]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x10]
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x6b0]
push eax
lea esi, [esi + 0x4a9164]
push esi
call fcn.00409e90
add esp, 0x10
test eax, eax
jne 0x42b7b1
mov ecx, dword [0x49a0e8]
test dword [0x49a2e8], ecx
je 0x42b0d2
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_CLT_REGISTERCOMOBJECT_on_pipe__s_.
call fcn.0040acd0
add esp, 8
mov dword [ebp - 0x18], 1
jmp 0x42ba1d
test dword [0x49a0e8], ebx
je 0x42b0f3
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_UNREGISTERCOMOBJECT_is_called
call fcn.0040acd0
add esp, 4
mov eax, dword [0x4a9158]
push 1
push eax
call fcn.00429840
add esp, 8
cmp eax, 0xffffffff
je 0x42ba4c
lea ebx, [eax + eax*8]
xor eax, eax
shl ebx, 5
lea esi, [ebx + 0x4a926c]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x50], vtable.Eeu::LinkedListIterator_struct_tagComCallbacks_.0
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0xcc0]
push edx
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.0042a080
test al, al
je 0x42b1ef
push 0
push 0
lea eax, [ebp - 0x50]
push eax
mov ecx, esi
call fcn.0042a1e0
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x6a8], 0x36
mov ecx, 0xa
lea esi, [ebp - 0xcc0]
lea edi, [ebp - 0x6a0]
rep movsd dword es:[edi], dword [esi]
push 1
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x6b0]
push edx
lea esi, [ebx + 0x4a9164]
push esi
call fcn.00409e90
add esp, 0x10
test eax, eax
jne 0x42b1d8
mov eax, dword [0x49a0e8]
test dword [0x49a2e8], eax
je 0x42b1cf
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_CLT_UNREGISTERCOMOBJECT_on_pipe__s_.
call fcn.0040acd0
add esp, 8
mov dword [ebp - 0x18], 1
jmp 0x42b1df
mov dword [ebp - 0x18], 2
mov ecx, dword [0x49b704]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 4], 0xffffffff
jmp 0x42ba4c
mov esi, dword [0x49a0e8]
test ebx, esi
je 0x42b21e
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_GETCOMCALLBACKS_is_called
call fcn.0040acd0
mov ebx, dword [0x49a2e8]
mov esi, dword [0x49a0e8]
add esp, 4
mov edx, dword [ebp - 0xcc4]
cmp edx, 0x14
jb 0x42b244
test ebx, esi
je 0x42ba4c
push edx
push str.NamePipeInstance_warning_EXTEVENT_REQTYPE_CLT_GETCOMCALLBACKS_ulSessionId___u__out_of_range
call fcn.0040acd0
add esp, 8
jmp 0x42ba4c
xor eax, eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
push 1
rep stosd dword es:[edi], eax
push edx
mov dword [ebp - 0x18], 2
call fcn.00429840
add esp, 8
cmp eax, 0xffffffff
jne 0x42b294
test ebx, esi
je 0x42ba87
mov edx, dword [0x4a9158]
push edx
push str.NamePipeServiceInstance:_BUG_activesession__d_notin_list
call fcn.0040acd0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea esi, [eax + eax*8]
shl esi, 5
mov ebx, dword [esi + 0x4a9270]
lea eax, [esi + 0x4a926c]
mov dword [ebp - 0x50], vtable.Eeu::LinkedListIterator_struct_tagComCallbacks_.0
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], ebx
test ebx, ebx
mov dword [ebp - 4], 3
je 0x42b35f
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x6a0]
push eax
lea ecx, [ebp - 0x50]
call fcn.00429b10
test al, al
je 0x42b30e
push 1
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x6b0]
push edx
lea eax, [esi + 0x4a9164]
push eax
mov dword [ebp - 0x6a8], 0x2d
call fcn.00409e90
add esp, 0x10
test eax, eax
je 0x42b336
test ebx, ebx
je 0x42b35f
mov ebx, dword [ebx]
test ebx, ebx
mov dword [ebp - 0x48], ebx
jne 0x42b2c2
mov eax, dword [0x49b704]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x2c
jmp 0x42ba4c
mov ecx, dword [0x49a0e8]
test dword [0x49a2e8], ecx
je 0x42b358
lea edx, [esi + 0x4a9164]
push edx
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_CLT_GETCOMCALLBACKS_on_pipe__s_.
call fcn.0040acd0
add esp, 8
mov dword [ebp - 0x18], 1
mov eax, dword [0x49b704]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x2c
jmp 0x42ba4c
test dword [0x49a0e8], ebx
je 0x42b38f
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_APPLYADCBYSELECTED.._is_called
call fcn.0040acd0
add esp, 4
mov ecx, dword [0x4a9158]
push 1
push ecx
call fcn.00429840
mov edx, eax
add esp, 8
cmp edx, 0xffffffff
je 0x42ba4c
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x6a8], 0x2f
mov ecx, 0xa
lea esi, [ebp - 0xcc0]
lea edi, [ebp - 0x6a0]
rep movsd dword es:[edi], dword [esi]
lea esi, [edx + edx*8]
push 1
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x6b0]
shl esi, 5
push eax
lea esi, [esi + 0x4a9164]
push esi
call fcn.00409e90
add esp, 0x10
test eax, eax
jne 0x42ba1d
mov ecx, dword [0x49a0e8]
test dword [0x49a2e8], ecx
je 0x42ba1d
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_APPLYADCBYSELECTED_on_pipe__s_.
call fcn.0040acd0
add esp, 8
jmp 0x42ba1d
test dword [0x49a0e8], ebx
je 0x42b445
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_APPLYADCBYSELECTED.._is_called
call fcn.0040acd0
add esp, 4
mov eax, dword [0x4a9158]
push 1
push eax
call fcn.00429840
mov edx, eax
add esp, 8
cmp edx, 0xffffffff
je 0x42ba4c
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x6a8], 0x3d
mov ecx, 0x27
lea esi, [ebp - 0xcc0]
lea edi, [ebp - 0x6a0]
rep movsd dword es:[edi], dword [esi]
lea esi, [edx + edx*8]
push 1
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x6b0]
shl esi, 5
push edx
lea esi, [esi + 0x4a9164]
push esi
call fcn.00409e90
add esp, 0x10
test eax, eax
jne 0x42b4d7
mov eax, dword [0x49a0e8]
test dword [0x49a2e8], eax
je 0x42b4d7
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_APPLYADCBYSELECTED_on_pipe__s_.
call fcn.0040acd0
add esp, 8
mov ecx, dword [0x49b704]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
jmp 0x42ba4c
test dword [0x49a0e8], ebx
je 0x42b501
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_APPLYADCBY.._is_called
call fcn.0040acd0
add esp, 4
mov edx, dword [0x4a9158]
push 1
push edx
call fcn.00429840
mov edx, eax
add esp, 8
cmp edx, 0xffffffff
je 0x42ba4c
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x6a8], 0x38
mov ecx, 0x185
lea esi, [ebp - 0xcc4]
lea edi, [ebp - 0x6a4]
rep movsd dword es:[edi], dword [esi]
push 1
lea esi, [edx + edx*8]
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x6b0]
shl esi, 5
push ecx
lea esi, [esi + 0x4a9164]
push esi
call fcn.00409e90
add esp, 0x10
test eax, eax
jne 0x42b59c
mov edx, dword [0x49a0e8]
test dword [0x49a2e8], edx
je 0x42b595
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_APPLYADCBYCONNECTED_on_pipe__s_.
call fcn.0040acd0
add esp, 8
mov dword [ebp - 0x18], 1
mov eax, dword [0x49b704]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x2c
jmp 0x42ba4c
test dword [0x49a0e8], ebx
je 0x42b5c5
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_PRPCESSPENDINGHPD_is_called
call fcn.0040acd0
add esp, 4
cmp dword [0x4a9158], 0xffffffff
je 0x42ba4c
mov eax, dword [0x49b658]
test eax, eax
je 0x42b662
mov ecx, dword [eax + 0x128]
test ecx, ecx
je 0x42b662
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov eax, dword [eax + 0x128]
lea edx, [ebp - 0x70]
push edx
mov ecx, eax
call fcn.00406100
test eax, eax
je 0x42b65b
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x24], edx
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x34], ecx
mov ecx, dword [0x49b704]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
jmp 0x42ba4c
mov dword [ebp - 0x18], 1
mov ecx, dword [0x49b704]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
jmp 0x42ba4c
test dword [0x49a0e8], ebx
mov esi, dword [ebp - 0xcc4]
mov dword [ebp - 0x44], esi
je 0x42b69b
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_KILLCLIENTPROCESS_is_called
call fcn.0040acd0
mov ebx, dword [0x49a2e8]
add esp, 4
cmp esi, 0x14
jb 0x42b6c5
cmp esi, 0xffffffff
je 0x42b6cf
test dword [0x49a0e8], ebx
je 0x42ba4c
push 0xffffffffffffffff
push str.NamePipeInstance_warning_EXTEVENT_REQTYPE_CLT_KILLCLIENTPROCESS_ulSessionId___u__out_of_range
call fcn.0040acd0
add esp, 8
jmp 0x42ba4c
cmp esi, 0xffffffff
je 0x42b6cf
mov dword [ebp + 0xc], esi
jmp 0x42b6db
mov dword [ebp + 0xc], 0
mov esi, 0x14
mov ebx, 0x4a9164
mov dword [ebp + 0x10], 0x14
mov eax, dword [ebp + 0xc]
cmp eax, esi
ja 0x42b74b
mov ecx, dword [ebx - 4]
cmp ecx, eax
je 0x42b6fc
inc eax
cmp eax, esi
jbe 0x42b6f1
jmp 0x42b74b
xor eax, eax
push 1
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x6b0]
push eax
push ebx
mov dword [ebp - 0x6a8], 0x35
call fcn.00409e90
add esp, 0x10
test eax, eax
jne 0x42b74b
mov ecx, dword [0x49a0e8]
test dword [0x49a2e8], ecx
je 0x42b74b
push ebx
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_CLT_KILLCLIENTPROCESS_on_pipe__s_.
call fcn.0040acd0
add esp, 8
mov eax, dword [ebp + 0x10]
add ebx, 0x120
dec eax
mov dword [ebp + 0x10], eax
jne 0x42b6e7
cmp dword [ebp - 0x44], 0xffffffff
jne 0x42b773
mov edx, dword [0x49b650]
push 0
push 0
push 0x12
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov eax, dword [0x49b704]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x2c
jmp 0x42ba4c
test dword [0x49a0e8], ebx
je 0x42b7a8
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_SVR_ISTMMHANDLEDBYADC_is_called
call fcn.0040acd0
add esp, 4
mov ecx, dword [0x49b670]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x18], 2
jmp 0x42ba1d
mov eax, dword [ebp - 0xcc0]
mov ecx, dword [ebp - 0xcbc]
mov edx, dword [ebp - 0xcb8]
mov dword [0x49b624], eax
mov eax, dword [ebp - 0xcb4]
mov dword [0x49b628], ecx
mov ecx, dword [ebp - 0xcb0]
mov dword [0x49b61c], 1
mov dword [0x49b62c], edx
mov dword [0x49b630], eax
mov dword [0x49b634], ecx
jmp 0x42ba4c
mov eax, dword [0x49b61c]
test eax, eax
je 0x42ba4c
test dword [0x49a0e8], ebx
mov dword [0x49b61c], 0
je 0x42b832
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_SVR_ISTMMHANDLEDBYADC_is_called
call fcn.0040acd0
add esp, 4
mov edx, dword [0x49b624]
mov eax, dword [0x49b628]
mov ecx, dword [0x49b62c]
mov dword [ebp - 0x34], edx
mov edx, dword [0x49b630]
mov dword [ebp - 0x30], eax
mov eax, dword [0x49b634]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [0x49b704]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
jmp 0x42ba4c
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0xed0]
rep stosd dword es:[edi], eax
test dword [0x49a0e8], ebx
mov dword [ebp + 0xc], 0
je 0x42b8a4
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_ENABLESTOPSERVICE_is_called
call fcn.0040acd0
add esp, 4
push 4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x42b8e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0xed0]
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_ENABLESTOPSERVICE._failed_to_open_SCM._err_d
push edx
call fcn.00460f01
lea eax, [ebp - 0xed0]
push eax
call fcn.004113d0
add esp, 0x10
jmp 0x42ba0d
cmp dword [0x49b638], 7
mov eax, str.Ati_HotKey_Poller
jbe 0x42b8f5
mov eax, str.Ati_External_Event_Utility
push 4
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x42b938
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0xed0]
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_ENABLESTOPSERVICE._failed_to_OpenService._err_d
push ecx
call fcn.00460f01
lea edx, [ebp - 0xed0]
push edx
call fcn.004113d0
add esp, 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x42ba0d
mov esi, dword [0x4a8ae4]
xor eax, eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x80], eax
push ecx
mov dword [ebp - 0x7c], eax
push edi
mov dword [ebp - 0x78], eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x42b9a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0xed0]
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_ENABLESTOPSERVICE._failed_to_QueryServiceStatus._err_d
push edx
call fcn.00460f01
lea eax, [ebp - 0xed0]
push eax
call fcn.004113d0
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 0x10
push edi
call esi
push ebx
call esi
jmp 0x42ba0d
or dword [ebp - 0x88], 1
mov edx, dword [esi + 0x4c]
lea ecx, [ebp - 0x90]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x42b9f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xed0]
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_ENABLESTOPSERVICE._failed_to_SetServiceStatus._err_d
push eax
call fcn.00460f01
lea ecx, [ebp - 0xed0]
push ecx
call fcn.004113d0
mov esi, dword [ebp + 0xc]
add esp, 0x10
jmp 0x42b9f5
mov esi, 1
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push ebx
call edi
cmp esi, 1
mov dword [ebp - 0x18], 2
je 0x42ba14
mov dword [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x34], eax
mov edx, dword [0x49b704]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0x2c
jmp 0x42ba4c
test dword [0x49a0e8], ebx
je 0x42ba4c
mov eax, dword [ebp - 0xcc0]
push eax
push esi
push str.NamePipeServiceInstance._request__d_not_supported_for_data__d
call fcn.0040acd0
add esp, 0xc
mov eax, dword [ebp + 8]
push 0
lea ecx, [ebp - 0x74]
push ecx
push 0x2c
lea edx, [ebp - 0x40]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42ba6c
cmp dword [ebp - 0x74], 0x2c
je 0x42ba87
mov ecx, dword [0x49a0e8]
test dword [0x49a2e8], ecx
je 0x42ba87
push str.Write_to_Pipe_Failed
call fcn.0040acd0
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret