Function at 0x10001240
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x180
mov esi, esp
mov eax, 0x6c
call fcn.1000f3d0
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov dword [esi + 0x178], 0
mov dword [esi + 0x64], eax
jmp 0x10001378
sub esp, 4
mov eax, esp
lea ecx, [esi + 0xc8]
mov dword [eax], ecx
mov eax, dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
call eax
mov dword [esi + 0x60], eax
sub esp, 0x10
mov eax, esp
mov dword [eax + 0xc], 0xdab
mov dword [eax + 8], 0xdab
mov dword [eax + 4], 0xeea30c
mov dword [eax], 0xeea30c
mov eax, dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
call eax
mov dword [esi + 0xc4], 0
mov dword [esi + 0x5c], eax
jmp 0x10001394
sub esp, 0x10
mov eax, esp
lea ecx, [esi + 0xb0]
mov dword [eax], ecx
mov dword [eax + 0xc], 0xd68
mov dword [eax + 8], 0xacc
mov dword [eax + 4], 0x177
mov eax, dword [sym.imp.USER32.dll_AdjustWindowRectEx]
call eax
mov dword [esi + 0x58], eax
jmp 0x100013df
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0xc4]
add eax, 1
mov dword [esi + 0xc4], eax
jmp 0x10001394
mov eax, dword [esi + 0x178]
add eax, 1
mov dword [esi + 0x178], eax
jmp 0x10001378
xor eax, eax
mov ecx, 0x6c
mov edx, dword [esi + 0x64]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0x6c
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], ecx
call fcn.1000f400
add esp, 0xc
sub esp, 0xc
mov eax, esp
mov ecx, dword [esi + 0x64]
mov dword [eax + 8], ecx
mov dword [eax + 4], 0xd39
mov dword [eax], 0xa72ef1
mov eax, dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
call eax
mov dword [esi + 0x4c], eax
jmp 0x10001313
mov eax, dword [esi + 0x178]
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x48]
cmp eax, 0xa
jne 0x10001274
jmp 0x100012f5
cmp dword [esi + 0xc4], 0x61
je 0x1000145a
mov eax, dword [esi + 0xc4]
mov ecx, 0x4ec4ec4f
mov dword [esi + 0x44], eax
mul ecx
shr edx, 2
imul eax, edx, 0xd
mov ecx, dword [esi + 0x44]
sub ecx, eax
mov eax, ecx
sub eax, 5
mov dword [esi + 0x40], ecx
mov dword [esi + 0x3c], eax
je 0x100012c4
jmp 0x100013d2
mov eax, dword [esi + 0x40]
sub eax, 0xa
mov dword [esi + 0x38], eax
jne 0x10001455
jmp 0x100013df
xor eax, eax
mov ecx, 0x14
lea edx, [esi + 0x98]
mov edi, edx
mov ebx, edx
sub esp, 0xc
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x14
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], edx
call fcn.1000f400
add esp, 0xc
mov dword [esi + 0x94], 0x635
sub esp, 0x14
mov eax, esp
lea ecx, [esi + 0x94]
mov dword [eax + 0x10], ecx
mov ecx, dword [esi + 0x28]
mov dword [eax + 8], ecx
mov edx, dword [esi + 0x2c]
mov dword [eax], edx
mov dword [eax + 0xc], 0x635
mov dword [eax + 4], 0x849
mov eax, dword [sym.imp.ADVAPI32.dll_GetPrivateObjectSecurity]
call eax
mov dword [esi + 0x24], eax
jmp 0x100012fd
sub esp, 0x10
mov eax, esp
mov dword [eax + 0xc], 0xc13
mov dword [eax + 8], 0x914552
mov dword [eax + 4], 0x914552
mov dword [eax], 0x914552
mov eax, dword [sym.imp.GDI32.dll_CombineRgn]
call eax
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x178]
mov ecx, 0xcc29786d
mov dword [esi + 0x1c], eax
mul ecx
shr edx, 8
imul eax, edx, 0x141
mov ecx, dword [esi + 0x1c]
sub ecx, eax
mov eax, ecx
sub eax, 0x12
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
je 0x100014c0
jmp 0x100014b1
mov eax, dword [esi + 0x18]
sub eax, 0x31
mov dword [esi + 0x10], eax
jne 0x10001529
jmp 0x100014be
jmp 0x100014c0
mov byte [esi + 0x93], 5
sub esp, 0x1c
mov eax, esp
lea ecx, [esi + 0x93]
mov dword [eax + 8], ecx
mov dword [eax + 0x18], 0x374d35
mov dword [eax + 0x14], 0x3ec
mov dword [eax + 0x10], 0xb80
mov dword [eax + 0xc], 0x10012308
mov dword [eax + 4], 0x3ec
mov dword [eax], 0xed0
mov eax, dword [sym.imp.USER32.dll_ToUnicodeEx]
call eax
sub esp, 8
mov ecx, esp
lea edx, [esi + 0x70]
mov dword [ecx + 4], edx
mov dword [ecx], 0xe7381a
mov ecx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [esi + 0xc], eax
call ecx
mov dword [esi + 8], eax
jmp 0x10001326
mov dword [esi + 0x6c], 0
cmp dword [esi + 0x6c], 0xa
setne al
mov byte [esi + 7], al
mov al, byte [esi + 7]
test al, 1
jne 0x10001546
jmp 0x10001567
sub esp, 4
mov eax, esp
mov dword [eax], 0x81803a
mov eax, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call eax
mov dword [esi], eax
mov eax, dword [esi + 0x6c]
add eax, 1
mov dword [esi + 0x6c], eax
jmp 0x10001530
jmp 0x10001326