Function at 0x1102d360
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1118004b
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x140], eax
mov ecx, edi
and ecx, 2
mov esi, edx
mov edx, dword [0x111ee100]
mov ebx, dword [edx + 0x24]
mov dword [ebp - 0x154], ecx
mov ecx, dword [0x111ee45c]
mov eax, edi
not eax
and eax, 1
xor edx, edx
mov dword [ebp - 0x148], ecx
xor ecx, ecx
cmp eax, ecx
sete dl
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x130], ecx
mov eax, edx
mov dword [ebp - 0x144], eax
mov dword [0x111ee45c], eax
cmp dword [0x111ee23c], ecx
je 0x1102d3fc
and edi, 0xfffffffd
mov dword [ebp - 0x154], ecx
cmp esi, ecx
je 0x1102d4e4
cmp byte [esi], cl
je 0x1102d4e4
push 0x2f
push esi
mov byte [ebp - 0x110], cl
call fcn.11081d30
add esp, 8
mov dword [ebp - 0x14c], eax
test eax, eax
je 0x1102d442
push 0x100
lea ecx, [ebp - 0x110]
mov byte [eax], 0
push ecx
inc eax
push eax
push 0
call fcn.110ee9a0
add esp, 0x10
mov ecx, dword [0x111ee308]
mov edx, dword [ecx]
mov edx, dword [edx + 0x88]
push 0
push 2
lea eax, [ebp - 0x110]
push eax
push esi
call edx
mov dword [ebp - 0x130], eax
test eax, eax
jne 0x1102d48a
mov ecx, dword [0x111ee308]
mov eax, dword [ecx]
mov eax, dword [eax + 0x88]
push 0
push 3
lea edx, [ebp - 0x110]
push edx
push esi
call eax
mov dword [ebp - 0x130], eax
mov edx, 0x100
lea ecx, [ebp - 0x110]
mov byte [ecx], 0
inc ecx
dec edx
jne 0x1102d495
cmp eax, 0xffffffff
jne 0x1102d4c7
mov edx, dword [ebp - 0x140]
mov ecx, dword [ebx]
mov eax, dword [ecx + 4]
push edx
push esi
push 0
push 0x42c
push ebx
call eax
add esp, 0x14
mov dword [ebp - 0x130], 0
jmp 0x1102d4e4
test eax, eax
je 0x1102d4e4
mov ecx, dword [0x111ee308]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x130]
mov edx, dword [edx + 0x90]
push 0
push eax
call edx
mov ebx, 1
mov dword [ebp - 0x13c], ebx
call fcn.11145ef0
test eax, eax
je 0x1102d51b
mov eax, dword [ebp - 0x140]
push eax
call fcn.110271a0
add esp, 4
test al, al
je 0x1102d51b
mov dword [ebp - 0x13c], 0x3e
mov ebx, dword [ebp - 0x13c]
mov dword [ebp - 0x138], 0
test ebx, ebx
jle 0x1102d63a
cmp dword [ebp - 0x144], 0
je 0x1102d539
or edi, 1
mov ecx, dword [ebp - 0x150]
mov edx, dword [ebp - 0x140]
push ecx
mov ecx, dword [0x111ee100]
and edi, 0xfffffffd
push edi
push 0x19141918
push 0
push edx
mov dword [ebp + 0xc], edi
call fcn.110627b0
mov esi, eax
mov dword [ebp - 0x134], esi
test esi, esi
jne 0x1102d640
cmp dword [ebp - 0x144], eax
je 0x1102d640
cmp dword [ebp - 0x138], eax
jne 0x1102d612
cmp ebx, 2
jl 0x1102d5fb
push 0xf003f
push eax
push eax
call dword [sym.imp.aDvapi32.DLL_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
je 0x1102d5f5
xor edi, edi
push 4
push 0x1119b320
push ebx
call dword [sym.imp.aDvapi32.DLL_OpenServiceA]
mov esi, eax
test esi, esi
je 0x1102d5e5
lea eax, [ebp - 0x12c]
push eax
push esi
call dword [sym.imp.aDvapi32.DLL_QueryServiceStatus]
push esi
call dword [sym.imp.aDvapi32.DLL_CloseServiceHandle]
cmp dword [ebp - 0x128], 4
je 0x1102d5e5
push 0x32
call dword [sym.imp.KeRneL32.DLl_Sleep]
inc edi
cmp edi, 0x4b0
jl 0x1102d5a2
push ebx
call dword [sym.imp.aDvapi32.DLL_CloseServiceHandle]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp - 0x134]
mov ebx, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp eax, ebx
jl 0x1102d52d
jmp 0x1102d640
cmp ebx, 2
jle 0x1102d5fb
mov ecx, dword [0x111ee308]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
push 0x3a98
push 0
push 0
call eax
push 0x3e8
call dword [sym.imp.KeRneL32.DLl_Sleep]
jmp 0x1102d5fb
mov esi, dword [ebp - 0x134]
mov edi, dword [ebp - 0x130]
test edi, edi
je 0x1102d665
mov ecx, dword [0x111ee308]
mov edx, dword [ecx]
mov eax, dword [edx + 0x90]
push 0
push 0
call eax
push edi
call dword [sym.imp.KeRneL32.DLl_CloseHandle]
mov eax, dword [ebp - 0x14c]
test eax, eax
je 0x1102d672
mov byte [eax], 0x2f
test esi, esi
je 0x1102d725
cmp dword [ebp - 0x154], 0
je 0x1102d697
mov ecx, dword [0x111ee100]
mov edx, dword [ecx + 0x30]
push 0
push edx
call fcn.11062220
add esp, 8
mov edi, 0x111972dc
call fcn.11143a20
cmp eax, 0x37
jne 0x1102d6ad
mov edi, 0x1119b318
jmp 0x1102d6bb
call fcn.1102a6d0
test al, al
je 0x1102d6bb
mov edi, 0x1119b310
push 1
push edi
call fcn.11145990
mov ebx, eax
mov dword [ebp - 0x138], ebx
push 0
push ebx
mov dword [ebp - 4], 0
call fcn.11143e00
add esp, 0x10
test eax, eax
je 0x1102d700
mov eax, dword [ebp - 0x150]
mov ecx, dword [0x111ee100]
push edi
push eax
push 0
push 8
call fcn.11063880
mov dword [ebp - 0x134], eax
mov esi, eax
mov ecx, dword [0x111ee100]
push 0
push ecx
call fcn.1102b140
push ebx
call fcn.11162777
mov edx, dword [ebp - 0x148]
add esp, 0xc
mov dword [0x111ee45c], edx
jmp 0x1102d730
mov eax, dword [ebp - 0x148]
mov dword [0x111ee45c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret