Function at 0x426780
Capabilities:
Check os version
Query service status

Disassembly:
push 0xffffffffffffffff
push 0x440926
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1bc
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x18], 0
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
rep stosd dword es:[edi], eax
mov ecx, 0x24
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
mov eax, 0x46cdbc
mov dword [esp + 0x34], 0x94
test eax, eax
jne 0x4267dc
xor eax, eax
jmp 0x4267e3
push 0x46cdbc
call ebp
mov esi, dword [esp + 0x1dc]
push 0x46cdbc
push eax
mov ecx, esi
call fcn.00406b60
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x426826
mov edx, 0x46cda4
test edx, edx
jne 0x426815
push edx
jmp 0x426ad0
push 0x46cda4
call ebp
push 0x46cda4
jmp 0x426ad0
mov eax, dword [esp + 0x38]
cmp eax, 6
jne 0x42683d
lea edx, [esp + 0xc8]
mov edi, 0x46cd9c
jmp 0x42685d
cmp eax, 5
jne 0x426abb
cmp dword [esp + 0x3c], 1
jne 0x426abb
lea edx, [esp + 0xc8]
mov edi, 0x46cd8c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xcc]
push ecx
mov ecx, ebx
call fcn.0041c400
mov esi, eax
test esi, esi
jne 0x4268c1
mov edx, 0x46cd7c
test edx, edx
jne 0x4268a8
mov ecx, dword [esp + 0x1dc]
push edx
push eax
jmp 0x426ad3
push 0x46cd7c
call ebp
mov ecx, dword [esp + 0x1dc]
push 0x46cd7c
push eax
jmp 0x426ad3
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x4268ff
mov ecx, 0x46cd6c
test ecx, ecx
je 0x4268e1
push 0x46cd6c
call ebp
mov ecx, dword [esp + 0x1dc]
push 0x46cd6c
push eax
call fcn.00406b60
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x426ad8
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [0x449b4c]
mov eax, 0x47c558
test eax, eax
mov dword [esp + 0x10], edx
je 0x426971
mov ecx, eax
shr ecx, 0x10
jne 0x426936
xor eax, eax
mov edx, 0x47c558
mov ax, dx
lea ecx, [esp + 0x10]
push eax
call fcn.0041bb30
jmp 0x426971
push 0x47c558
call ebp
mov esi, eax
test esi, esi
je 0x426971
push esi
lea ecx, [esp + 0x14]
call fcn.00406a40
test eax, eax
je 0x426971
lea eax, [esi + 1]
cmp eax, esi
jb 0x426971
mov edi, dword [esp + 0x10]
mov ecx, esi
mov edx, ecx
mov esi, 0x47c558
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1d4], 0
dec eax
je 0x426a0b
sub eax, 3
je 0x4269ca
sub eax, 3
je 0x4269ae
mov eax, 0x46cd60
test eax, eax
jne 0x4269a0
push eax
jmp 0x426a24
push 0x46cd60
call ebp
push 0x46cd60
jmp 0x426a24
mov ecx, 0x46cd58
test ecx, ecx
jne 0x4269bc
xor eax, eax
push ecx
jmp 0x426a24
push 0x46cd58
call ebp
push 0x46cd58
jmp 0x426a24
mov ecx, ebx
call fcn.00426ce0
test eax, eax
je 0x4269f1
mov edx, 0x46cd50
test edx, edx
jne 0x4269e3
xor eax, eax
push edx
jmp 0x426a24
push 0x46cd50
call ebp
push 0x46cd50
jmp 0x426a24
mov eax, 0x46cd48
test eax, eax
jne 0x4269fd
push eax
jmp 0x426a24
push 0x46cd48
call ebp
push 0x46cd48
jmp 0x426a24
mov ecx, 0x46cd40
test ecx, ecx
jne 0x426a18
xor eax, eax
jmp 0x426a1f
push 0x46cd40
call ebp
push 0x46cd40
push eax
lea ecx, [esp + 0x18]
call fcn.00406aa0
lea edx, [esp + 0x10]
push 0x46cb3c
lea eax, [esp + 0x18]
push edx
push eax
call fcn.00427810
mov eax, dword [eax]
mov byte [esp + 0x1d4], 1
push eax
mov ecx, dword [eax - 8]
push ecx
mov ecx, dword [esp + 0x1e4]
call fcn.00406b60
mov eax, dword [esp + 0x14]
mov ecx, dword [0x449b50]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x426a8e
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x426a8e
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.0043fa08
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x449b50]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x426ad8
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x426ad8
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.0043fa08
add esp, 4
jmp 0x426ad8
mov eax, 0x46cd2c
test eax, eax
je 0x426acb
push 0x46cd2c
call ebp
push 0x46cd2c
push eax
mov ecx, esi
call fcn.00406b60
mov ecx, dword [esp + 0x1cc]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c8
ret 4