Function at 0x10049353
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push edi
push 3
pop edi
mov ebx, ecx
lea ecx, [ebp - 0x28]
push edi
call fcn.10015a80
xor edx, edx
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x14], edx
jmp 0x10049387
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov dword [eax + ecx*4], 0x313dd33a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10049377
mov dword [ebp - 0x14], edx
jmp 0x100493a7
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x100493a4
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor edx, edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x10049391
push esi
lea ecx, [ebp - 0x28]
call fcn.10015b02
push 0xc3e
push ebx
push 0x55e5
push 0x121c
xor esi, esi
inc esi
push esi
push 0x935
push 0x3810
call fcn.10043bb2
mov dword [ebp - 8], 9
add esp, 0x1c
mov dword [ebp - 0x14], edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], edx
jmp 0x10049401
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc], 0x40d7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100493f3
mov dword [ebp - 8], edx
jmp 0x1004956e
mov dword [ebp - 0x10], 0x25b3b9da
mov dword [ebp - 0x14], esi
inc dword [ebp - 0x10]
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0xc], edx
jne 0x1004948a
mov eax, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xc]
test eax, eax
mov eax, dword [ebp - 0xc]
setne cl
xor edx, edx
cmp ecx, 7
setne dl
xor ecx, ecx
cmp eax, edx
setg cl
dec ecx
jne 0x1004944c
cmp dword [ebp - 0x10], ecx
je 0x1004944e
mov ecx, esi
mov eax, dword [ebp - 8]
shl ecx, 3
mov eax, dword [ebp + eax*4 - 0xc]
sub ecx, eax
neg ecx
mov eax, 0xfff9
sbb ecx, ecx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 8]
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
cmp dword [ebp - 0xc], ecx
jne 0x1004947b
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0x10], 3
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0xc], 0xffffffff
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x10]
je 0x100494fd
cmp dword [ebp - 0xc], edx
je 0x100494fd
mov dword [ebp - 0x18], 0x792891f4
cmp dword [ebp - 0x10], edx
jne 0x100494b8
mov ecx, edx
cmp dword [ebp - 0x14], edx
je 0x100494ba
mov ecx, esi
xor eax, eax
cmp ecx, 0xffffffff
setne al
test eax, eax
jle 0x100494cd
mov edi, edx
cmp dword [ebp - 0xc], edx
je 0x100494cf
mov edi, esi
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0xc]
mov eax, dword [ebp - 8]
sub edi, eax
mov eax, dword [ebp - 0xc]
cmp edi, edx
setne cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setl dl
sub edx, dword [ebp - 8]
imul edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
jmp 0x10049569
mov dword [ebp - 0x18], 0x783d
mov dword [ebp - 0x1c], 0x5a5285b5
mov dword [ebp - 0x10], edx
jmp 0x10049525
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x10049522
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edx, edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x10049510
mov dword [ebp - 0x14], 0x16
cmp dword [ebp - 0x14], 0x10
jne 0x1004956b
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x1c], 0xffff
jae 0x1004954a
cmp dword [ebp - 0x10], edx
je 0x1004954a
mov edx, esi
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
add eax, edx
push 0
pop edx
lea eax, [eax + ecx*4]
add eax, 0x7dc46221
mov dword [ebp - 0x10], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x10
je 0x10049537
xor edx, edx
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jle 0x1004940e
push ebx
call fcn.1002dfe3
mov dword [ebp - 8], 0x9464
xor ebx, ebx
mov dword [ebp - 0x14], 0xa59c1763
mov edi, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0xdeb2
pop ecx
mov dword [ebp - 0x14], ebx
jmp 0x100495ad
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x34], 0x580eb60f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1004959f
mov eax, dword [ebp - 8]
sub eax, 0xffff
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
je 0x100495db
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
cmp eax, ecx
setne dl
lea eax, [edx - 0x59fc2d31]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 8], eax
jg 0x1004960c
cmp dword [ebp - 0x10], ebx
jne 0x1004960c
mov esi, ebx
mov eax, dword [ebp - 8]
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
cmp esi, eax
mov eax, dword [ebp - 0x10]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
pop esi
setle dl
shl edx, 2
sub eax, edx
cmp dword [ebp - 0x14], eax
jg 0x100496d1
mov dword [ebp - 0x14], 5
cmp dword [ebp - 0x14], ebx
je 0x100496ad
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0xffffffe7
jmp 0x100496a5
mov dword [ebp - 8], ebx
jmp 0x1004969c
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x10049699
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10049684
push 0xe71
push 0x265b
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10049694
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
dec dword [ebp - 0x14]
jns 0x10049664
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xe
je 0x10049658
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x2c
jle 0x10049653
jmp 0x100496c9
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x100496c9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x100496d4
mov dword [ebp - 0x14], ebx
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x100496e2
call dword [sym.imp.USER32.dll_GetMessageTime]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret