Function at 0x401830
Capabilities:
Query service configuration
Query service status
Set console window title

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x405004]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
push str.vgkChecker_v1.0_RELEASE__smef.pw
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
test eax, eax
je 0x401c39
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 4
lea eax, [esp + 0x18]
push eax
push 0x14
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [esp + 0xc]
test eax, eax
je 0x401c25
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], 0
je 0x401c49
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [0x40538c], eax
test eax, eax
jne 0x401918
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x4011a0
push 0x401020
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push ecx
mov edx, str._error_
mov ecx, eax
call fcn.00401310
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, eax
call fcn.00401550
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.OpenSCManager_failed._n
call fcn.00401310
jmp 0x401983
push 0xf01ff
push 0x405018
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [0x405388], eax
test eax, eax
jne 0x4019ac
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x4011a0
push 0x401020
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push ecx
mov edx, str._error_
mov ecx, eax
call fcn.00401310
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, eax
call fcn.00401550
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.OpenService_failed._n
call fcn.00401310
push dword [0x40538c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x10
push str.vgkChecker
push str.A_fatal_error_occured_and_the_program_cannot_continue.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00401c6e
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0xc]
xor edi, edi
push ecx
push edi
push edi
xor esi, esi
or ebx, 0xffffffff
push eax
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x401a29
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4019e4
mov edi, dword [esp + 0xc]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
jmp 0x401a29
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x4011a0
push 0x401020
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push ecx
mov edx, str._error_
mov ecx, eax
call fcn.00401310
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, eax
call fcn.00401550
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.QueryServiceConfig_failed._n
call fcn.00401310
lea eax, [esp + 0xc]
push eax
push edi
push esi
push dword [0x405388]
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x401a85
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x4011a0
push 0x401020
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push ecx
mov edx, str._error_
mov ecx, eax
call fcn.00401310
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, eax
call fcn.00401550
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.QueryServiceConfig_failed._n
call fcn.00401310
test esi, esi
je 0x401a93
mov ebx, dword [esi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0x24
lea eax, [esp + 0x20]
push eax
push 0
push dword [0x405388]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x401bdb
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x4011a0
push 0x4010a0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push ecx
mov edx, str._warning_
mov ecx, eax
call fcn.00401310
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, eax
call fcn.00401550
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.QueryServiceStatusEx_failed._n
call fcn.00401310
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x4011a0
push 0x401120
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push ecx
mov edx, str._notice_
mov ecx, eax
call fcn.00401310
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, eax
call fcn.00401550
mov edx, str.Vanguard_driver_is_not_running
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp ebx, 4
mov eax, str.__and_is_set_to_auto_start._n
mov esi, str.__and_is_set_to_not_auto_start._n
cmovne esi, eax
call fcn.00401310
mov edx, esi
mov ecx, eax
call fcn.00401310
push dword [0x405388]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [0x40538c]
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x4011a0
push 0x401120
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push ecx
mov edx, str._notice_
mov ecx, eax
call fcn.00401310
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, eax
call fcn.00401550
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Press_enter_to_close_app._n
call fcn.00401310
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::basic_istream_char__struct_std::char_traits_char__::get_void_]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00401c6e
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x1c], 4
jne 0x401b02
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x4011a0
push 0x401120
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push ecx
mov edx, str._notice_
mov ecx, eax
call fcn.00401310
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, eax
call fcn.00401550
mov edx, str.Vanguard_driver_is_running
jmp 0x401b3c
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push str.vgkNoMore
push str.GetTokenInformation_failed._Program_will_close.
jmp 0x401c45
push 0x10
push str.vgkNoMore
push str.OpenProcessToken_failed._Program_will_close.
push 0
call esi
push 0x10
push str.vgkChecker
push str.Process_requires_elevation.
push 0
call esi
mov ecx, dword [esp + 0x3c]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401c6e
mov esp, ebp
pop ebp
ret