Function at 0x100281e0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d8357
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x1010f16c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, cl
mov byte [ebp - 0x81], bl
lea eax, [ebp - 0x90]
mov dword [ebp - 0x90], 0
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
mov dword [ebp - 4], 0
mov eax, 0x100f4d08
push 0xf003f
test bl, bl
mov esi, 0x100f4cfc
push 0
cmove esi, eax
push 0
mov dword [ebp - 0x8c], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x10028276
call ebx
push eax
push str.OpenSCManager_failed___d__n
call fcn.10005c70
add esp, 8
jmp 0x100282df
push 4
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x100282a5
call ebx
push eax
push dword [ebp - 0x8c]
push str.OpenService__s_failed___d__n
call fcn.10036dd0
add esp, 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x100282df
lea eax, [ebp - 0x88]
push eax
push 0x24
lea eax, [ebp - 0x4c]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x10028374
call ebx
push eax
push str.QueryServiceStatusEx_failed___d__n
call fcn.10005c70
add esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov dl, byte [ebp - 0x81]
lea ecx, [ebp - 0x80]
call fcn.10027550
mov byte [ebp - 4], 1
cmp byte [ebp - 0x50], 0
jne 0x1002853d
xor dl, dl
lea ecx, [ebp - 0x40]
call fcn.10027340
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
call fcn.1002bdb0
mov esi, eax
mov byte [ebp - 4], 3
cmp dword [esi + 0x14], 0x10
jb 0x10028322
mov esi, dword [esi]
call ebx
push esi
push eax
push str.init_driver_copy_driver_to_sys_false_code:_d__path:_s
push str.init_driver
push 0x181
push str.d:projectwireguard_engine_rulesproxy_api.cpp
push 8
call fcn.10070dc0
add esp, 0x1c
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x100283a8
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002839e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002860f
jmp 0x1002839e
cmp dword [ebp - 0x48], 4
jne 0x100282d3
push str.service_is_running_n
call fcn.10005c70
add esp, 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov bl, 1
jmp 0x100285de
push edx
push ecx
call fcn.1009091b
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.10005b50
lea ecx, [ebp - 0x80]
call fcn.1002bbc0
test al, al
jne 0x1002853d
mov dl, byte [0x10115763]
lea ecx, [ebp - 0x40]
call fcn.10027340
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
call fcn.1002bdb0
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 0x10
jb 0x100283ff
mov eax, dword [eax]
cmp byte [ebp - 0x81], 0
mov ecx, str.nfwfp
push eax
mov eax, str.nftdi
cmove eax, ecx
push eax
call fcn.10078a00
add esp, 8
test eax, eax
setne byte [ebp - 0x81]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1002845e
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10028454
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10028614
push edx
push ecx
call fcn.1009091b
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.10005b50
cmp byte [ebp - 0x81], 0
je 0x10028598
call ebx
mov dl, byte [0x10115763]
lea ecx, [ebp - 0x40]
mov esi, eax
call fcn.10027340
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
call fcn.1002bdb0
mov byte [ebp - 4], 9
cmp dword [eax + 0x14], 0x10
jb 0x100284b6
mov eax, dword [eax]
push esi
push eax
push str.init_driver_nf_registerDriverEx:_s_false_code:_d
push str.init_driver
push 0x187
push str.d:projectwireguard_engine_rulesproxy_api.cpp
push 0x20
call fcn.10070dc0
add esp, 0x1c
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1002850e
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10028504
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10028619
push edx
push ecx
call fcn.1009091b
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.10005b50
mov ecx, dword [ebp - 0x8c]
xor dl, dl
call fcn.10068b20
xor bl, bl
jmp 0x1002859a
cmp byte [ebp - 0x81], 0
mov ecx, str.nfwfp
mov eax, str.nftdi
cmove eax, ecx
push eax
call fcn.100789d0
add esp, 4
test eax, eax
je 0x10028598
call ebx
push eax
movzx eax, byte [ebp - 0x81]
push eax
push str.init_driver_nf_registerDriver__d_is_is_special_false_code:_d
push str.init_driver
push 0x194
push str.d:projectwireguard_engine_rulesproxy_api.cpp
push 0x20
call fcn.10070dc0
mov ecx, dword [ebp - 0x8c]
add esp, 0x1c
xor dl, dl
call fcn.10068b20
xor bl, bl
jmp 0x1002859a
mov bl, 1
mov byte [ebp - 4], 0x24
lea eax, [ebp - 0x68]
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 0x24
mov ecx, eax
call fcn.10005b50
mov byte [ebp - 4], 0
lea eax, [ebp - 0x80]
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 0
mov dword [ebp - 0x88], eax
mov byte [ebp - 4], 0
mov ecx, eax
call fcn.10005b50
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x90]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100908e7
mov esp, ebp
pop ebp
ret
call fcn.100abcda
call fcn.100abcda
call fcn.100abcda
int3