Function at 0x1001baeb
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push edi
mov edi, ecx
mov dword [ebp - 0x28], edx
xor ebx, ebx
cmp dword [edi + 0x10], ebx
jne 0x1001bb06
xor al, al
jmp 0x1001bee2
mov dword [edx], ebx
mov dword [ebp - 0x24], 8
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001bb1f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001bb34
push ebx
push 0x1398
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
push esi
mov dword [ebp - 0xc], ebx
jmp 0x1001bc71
mov dword [ebp - 8], 0x5efa20bd
mov dword [ebp - 0x10], 0x5fec
mov dword [ebp - 0x14], ebx
jmp 0x1001bb64
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x34], 0x835357f4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001bb56
mov esi, dword [ebp - 8]
neg esi
sbb esi, esi
neg esi
cmp dword [ebp - 8], ebx
je 0x1001bb82
cmp dword [ebp - 0xc], ebx
je 0x1001bb82
xor ecx, ecx
inc ecx
jmp 0x1001bb84
mov ecx, ebx
mov eax, dword [ebp - 8]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 8]
setge dl
xor ecx, ecx
cmp esi, eax
setne cl
xor eax, eax
cmp ecx, edx
setg al
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x14], eax
jg 0x1001bc08
mov dword [ebp - 0x24], 0x415fb57a
mov dword [ebp - 0x1c], 0xe3bc
mov dword [ebp - 0x14], 0x1cc0e426
mov dword [ebp - 0x14], 0x7220b739
cmp dword [ebp - 0x1c], ebx
jne 0x1001bbd7
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x24]
cmp eax, 0x53bf
jne 0x1001bbed
cmp dword [ebp - 0x34], ebx
jne 0x1001bbed
mov ecx, ebx
jmp 0x1001bbf0
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 8]
imul eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], 1
jmp 0x1001bc68
mov dword [ebp - 0x24], 0x1d4d0043
mov dword [ebp - 0x10], ebx
jmp 0x1001bc62
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], 0xe
jmp 0x1001bc32
lea eax, [ebp - 2]
mov byte [ebp - 2], bl
push ebx
push eax
call fcn.1001e72a
dec dword [ebp - 8]
pop ecx
pop ecx
cmp dword [ebp - 8], 0xffffffe8
jle 0x1001bc20
cmp dword [ebp - 0x1c], ebx
jne 0x1001bc4c
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
sub ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x39
je 0x1001bc14
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xf
jge 0x1001bb43
mov dword [ebp - 0xc], 0xffffffea
jmp 0x1001bc96
lea eax, [ebp - 3]
mov byte [ebp - 3], bl
push ebx
push eax
call fcn.1001e857
inc dword [ebp - 0xc]
pop ecx
pop ecx
cmp dword [ebp - 0xc], 8
jge 0x1001bc84
mov dword [ebp - 0x10], 0x64f14790
mov dword [ebp - 0x24], 0xe468
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp - 0x14], ebx
jmp 0x1001bcc4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x18], 0xd435
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1001bcb6
imul eax, dword [ebp - 0x18], 0x63f9
xor ecx, ecx
push 4
pop esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, 1
setge cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setge dl
cmp edx, 0xd6a5
je 0x1001bd19
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 1
dec dword [ebp - 0x24]
jmp 0x1001bd57
mov dword [ebp - 0x14], ebx
jmp 0x1001bd28
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2c], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1001bd1e
mov dword [ebp - 0x10], ebx
jmp 0x1001bd3b
cmp dword [ebp - 0x2c], ebx
jne 0x1001bd41
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xb
jge 0x1001bd33
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001bd57
push 0xbbb
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CombineRgn]
cmp dword [edi + 0x14], 0x10
jb 0x1001bd61
mov eax, dword [edi]
jmp 0x1001bd63
mov eax, edi
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x20], eax
jb 0x1001bd70
mov edx, dword [edi]
jmp 0x1001bd72
mov edx, edi
mov ecx, dword [edi + 0x10]
add ecx, edx
cmp eax, ecx
je 0x1001be23
mov al, byte [eax]
cmp al, 0x30
jl 0x1001bda5
cmp al, 0x39
jg 0x1001bda5
push 0x2ea5
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1001bf26
mov eax, dword [ebp - 0x20]
add esp, 0x10
inc eax
jmp 0x1001bd63
push 0x49af
push ebx
call fcn.1001bff3
push ebx
lea eax, [ebp - 0x28]
push 0xba
push eax
call fcn.1001c158
mov dword [ebp - 0x24], 6
add esp, 0x14
mov dword [ebp - 0xc], ebx
jmp 0x1001bddc
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x60], 5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x1001bdce
mov dword [ebp - 0xc], ebx
jmp 0x1001bdf4
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x44], 0x43d837bc
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x1001bde6
push 0x2b09
push 0x3b35
lea eax, [ebp - 4]
mov byte [ebp - 4], bl
push eax
push ebx
push 0x58a5
call fcn.1001ec24
add esp, 0x14
inc dword [ebp - 0x24]
xor al, al
jmp 0x1001bee1
mov dword [ebp - 0x24], 0xbca6
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001be39
push ebx
call dword [sym.imp.USER32.dll_DestroyCursor]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001be49
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 0x14], ebx
jmp 0x1001be5c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x50], 1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001be4e
mov dword [ebp - 0x4c], 0xfffffff0
jmp 0x1001be91
mov dword [ebp - 0x14], ebx
jmp 0x1001be7e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3c], 0xea98
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001be70
cmp dword [ebp - 0x4c], ebx
jne 0x1001be97
cmp dword [ebp - 0x38], ebx
jne 0x1001be97
dec dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0xffffffe6
jge 0x1001be6b
mov dword [ebp - 0x14], 0x97f6af11
mov dword [ebp - 0x14], 0xfffffffe
jmp 0x1001bed9
mov dword [ebp - 0x10], ebx
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001bebf
push 0x1e48
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x10], 0xffffffec
jmp 0x1001bed0
cmp dword [ebp - 0x10], ebx
jne 0x1001bed6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xd
jge 0x1001bec8
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffd
jl 0x1001bea7
mov al, 1
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret