Function at 0x100082e7
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100141a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x24], ebx
mov eax, dword [0x10014024]
mov edi, 0x10014024
cmp eax, edi
je 0x10008334
test byte [eax + 0x1c], 1
je 0x10008334
cmp byte [eax + 0x19], 5
jb 0x10008334
push ebx
push dword [eax + 0x14]
mov edx, 0x10002130
push dword [eax + 0x10]
push 0x7b
pop ecx
call fcn.10002ec1
mov eax, dword [0x10014024]
test ebx, ebx
jne 0x10008372
mov esi, 0x80004003
cmp eax, edi
je 0x10008531
test byte [eax + 0x1c], 1
je 0x10008531
cmp byte [eax + 0x19], 2
jb 0x10008531
push esi
push dword [eax + 0x14]
mov edx, 0x10002130
push dword [eax + 0x10]
push 0x7c
pop ecx
call fcn.10002ec1
jmp 0x10008531
push 0x20001
xor esi, esi
push esi
push esi
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x100083eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x10008397
push 0x57
pop esi
mov edx, dword [0x10014024]
cmp edx, edi
je 0x100083d5
test byte [edx + 0x1c], 2
je 0x100083d5
movzx ecx, byte [edx + 0x19]
mov eax, esi
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
cmp ecx, eax
jb 0x100083d5
push esi
push dword [edx + 0x14]
push dword [edx + 0x10]
mov edx, 0x10002130
push 0x7d
pop ecx
call fcn.10002ec1
mov edx, dword [0x10014024]
test esi, esi
jle 0x100084fc
movzx esi, si
or esi, 0x80070000
jmp 0x100084fc
push 4
push 0x10001fc8
push eax
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x1000845c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x1000840e
push 0x57
pop esi
mov edx, dword [0x10014024]
cmp edx, edi
je 0x10008446
test byte [edx + 0x1c], 2
je 0x10008446
movzx ecx, byte [edx + 0x19]
mov eax, esi
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
cmp ecx, eax
jb 0x10008446
push esi
push dword [edx + 0x14]
push dword [edx + 0x10]
mov edx, 0x10002130
push 0x7e
pop ecx
call fcn.10002ec1
test esi, esi
jle 0x100084ea
movzx esi, si
or esi, 0x80070000
jmp 0x100084ea
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
test eax, eax
jne 0x100084d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x10008484
push 0x57
pop esi
mov edx, dword [0x10014024]
mov edi, 0x10014024
cmp edx, edi
je 0x100084c1
test byte [edx + 0x1c], 2
je 0x100084c1
movzx eax, byte [edx + 0x19]
mov ecx, esi
neg ecx
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp eax, ecx
jb 0x100084c1
push esi
push dword [edx + 0x14]
push dword [edx + 0x10]
mov edx, 0x10002130
push 0x7f
pop ecx
call fcn.10002ec1
test esi, esi
jle 0x100084e3
movzx esi, si
or esi, 0x80070000
jmp 0x100084e3
mov ecx, dword [ebp - 0x24]
xor eax, eax
cmp dword [ebp - 0x1c], 4
mov edi, 0x10014024
sete al
mov dword [ecx], eax
push ebx
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
push dword [ebp - 0x28]
call dword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov edx, dword [0x10014024]
mov ebx, dword [ebp - 0x24]
cmp edx, edi
je 0x10008531
test byte [edx + 0x1c], 1
je 0x10008531
movzx eax, byte [edx + 0x19]
mov ecx, esi
sar ecx, 0x1f
and ecx, 0xfffffffd
add ecx, 5
cmp eax, ecx
jl 0x10008531
push dword [ebx]
mov ecx, 0x80
push esi
push dword [edx + 0x14]
push dword [edx + 0x10]
mov edx, 0x10002130
call fcn.10004314
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10003014
mov esp, ebp
pop ebp
ret