Function at 0x417be0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44586e
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x45d0bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x4c], edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push ebx
call fcn.00417b30
test al, al
jne 0x417c2d
mov eax, 1
jmp 0x417db8
lea eax, [ebp - 0x41]
push eax
push 0x24
lea ecx, [ebp - 0x58]
call fcn.0040eb20
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x58]
sub edx, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x48], 0
cmp ecx, dword [ebp - 0x54]
jne 0x417cd2
xor ecx, ecx
lea eax, [ebp - 0x48]
push eax
push edx
push ecx
push 0
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x417d6e
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x7a
jne 0x417ce9
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x48]
mov ecx, eax
call fcn.0040bd80
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x58]
sub edx, ecx
cmp ecx, dword [ebp - 0x54]
jne 0x417cdf
xor ecx, ecx
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x4c]
push edx
push ecx
push 0
push dword [eax + 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x417d6e
call edi
mov esi, eax
test bl, bl
je 0x417de9
lea ecx, [ebp - 0x58]
call fcn.004023f0
mov eax, esi
jmp 0x417db8
test edx, edx
je 0x417ddf
jmp 0x417c58
test edx, edx
je 0x417de4
jmp 0x417c9b
call edi
mov esi, eax
test bl, bl
jne 0x417cc3
push 1
push 3
lea ecx, [ebp - 0x108]
call fcn.00406430
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x28]
add ecx, 0xb0
mov byte [ebp - 4], 4
push ecx
push eax
call fcn.0041aaa0
add esp, 8
push str.__Cannot_get_service_process_status.
push eax
lea eax, [ebp - 0xf8]
mov byte [ebp - 4], 5
push 0x447bb0
push eax
call fcn.00409a30
add esp, 8
push eax
call fcn.00409c90
add esp, 8
push eax
call fcn.00409a30
add esp, 8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.00406180
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x108]
call fcn.00406410
mov byte [ebp - 4], 6
jmp 0x417e61
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
cmp ecx, eax
jne 0x417dd6
xor ecx, ecx
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ecx + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [ecx + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [ecx + 0x20]
lea ecx, [ebp - 0x58]
mov dword [esi + 0x20], eax
call fcn.004023f0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424185
mov esp, ebp
pop ebp
ret 8
sub eax, ecx
jne 0x417d7a
call fcn.0040ecb0
call fcn.0040ecb0
call fcn.0040ecb0
push 1
push 3
lea ecx, [ebp - 0x108]
call fcn.00406430
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x28]
add ecx, 0xb0
mov byte [ebp - 4], 1
push ecx
push eax
call fcn.0041aaa0
add esp, 8
push str.__Cannot_get_service_process_status.
push eax
lea eax, [ebp - 0xf8]
mov byte [ebp - 4], 2
push 0x447bb0
push eax
call fcn.00409a30
add esp, 8
push eax
call fcn.00409c90
add esp, 8
push eax
call fcn.00409a30
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00406180
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x108]
call fcn.00406410
mov byte [ebp - 4], 3
push esi
push eax
lea ecx, [ebp - 0x20]
call fcn.00410e30
push 0x45968c
lea eax, [ebp - 0x20]
push eax
call fcn.00425c43
int3