Function at 0x100a328
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], 0x24
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov eax, dword [0x1019080]
mov ebx, 0x1019080
cmp eax, ebx
je 0x100a5d4
test byte [eax + 0x1c], 0x10
je 0x100a5d4
cmp byte [eax + 0x19], 4
jb 0x100a5d4
mov edi, 0x100a640
push edi
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100130b
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.API_MS_Win_Core_Profile_L1_1_0.dll_QueryPerformanceFrequency]
mov eax, dword [ebp - 0x18]
mov dword [section.RT_BSS], eax
mov eax, dword [ebp - 0x14]
push 4
push esi
mov dword [0x1018004], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
xor eax, eax
cmp esi, eax
jl 0x100c28d
mov esi, dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_CreateEventW]
push eax
push eax
push 1
push eax
call esi
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x44], eax
xor ecx, ecx
cmp eax, ecx
je 0x100c2c2
push ecx
push ecx
push 1
push ecx
call esi
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x48], eax
test eax, eax
je 0x100c2c2
push 0
push 0x100a61c
push 0xa
push 0x100a60c
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
mov esi, eax
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100a419
test byte [eax + 0x1c], 0x10
je 0x100a419
cmp byte [eax + 0x19], 4
jb 0x100a419
push esi
push edi
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001331
test esi, esi
jne 0x100a5f0
push 0x100a29d
push 0x4d2
push 0x21
push esi
push esi
push dword [0x1019610]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
mov esi, eax
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100a461
test byte [eax + 0x1c], 0x10
je 0x100a461
cmp byte [eax + 0x19], 4
jb 0x100a461
push esi
push edi
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001331
test esi, esi
jne 0x100a5f0
xor eax, eax
inc eax
push eax
push esi
push esi
mov dword [0x10190b0], eax
call dword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_OpenSCManagerW]
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x100c2df
push 4
push 0x100a5f8
push eax
call dword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x100c31f
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100a4c1
test byte [eax + 0x1c], 0x10
je 0x100a4c1
cmp byte [eax + 0x19], 4
jb 0x100a4c1
push edi
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100130b
lea eax, [ebp - 0x10]
push eax
push 0x24
lea eax, [ebp - 0x3c]
push eax
push esi
push dword [ebp - 8]
call dword [sym.imp.API_MS_WIN_Service_Management_L2_1_0.dll_QueryServiceStatusEx]
test eax, eax
je 0x100c35f
cmp dword [ebp - 0x38], 1
je 0x100a5de
cmp dword [ebp - 0x38], 3
je 0x100a5de
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100a517
test byte [eax + 0x1c], 0x10
je 0x100a517
cmp byte [eax + 0x19], 4
jb 0x100a517
push dword [ebp - 0x20]
push edi
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001331
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 4]
push eax
push 0
push 0x100000
mov dword [esi + 0x50], eax
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_OpenProcess]
mov dword [esi + 0x4c], eax
test eax, eax
je 0x100c394
push 0x3020
push 2
push 4
mov ecx, esi
call fcn.0100b33d
mov esi, eax
test esi, esi
jl 0x100a58e
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor eax, eax
mov edi, 0x1019120
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0100a655
mov esi, eax
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100a58e
test byte [eax + 0x1c], 0x10
je 0x100a58e
cmp byte [eax + 0x19], 4
jb 0x100a58e
push esi
push 0x100a640
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001331
cmp dword [ebp - 0xc], 0
mov edi, dword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_CloseServiceHandle]
je 0x100a59f
push dword [ebp - 0xc]
call edi
cmp dword [ebp - 8], 0
je 0x100a5aa
push dword [ebp - 8]
call edi
mov edi, 0x100a640
mov eax, dword [ebp - 4]
mov dword [eax + 0x40], esi
mov eax, dword [eax + 0x48]
test eax, eax
je 0x100a5c3
push eax
call dword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
test esi, esi
jl 0x100c409
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
mov edi, 0x100a640
jmp 0x100a37e
mov eax, dword [0x1019080]
cmp eax, ebx
jne 0x100c3d4
jmp 0x100c3ee
jle 0x100a5af
jmp 0x100c3f8
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100a5af
test byte [eax + 0x1c], 0x10
je 0x100a5af
cmp byte [eax + 0x19], 4
jb 0x100a5af
push esi
push edi
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001331
jmp 0x100a5af
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
test eax, eax
jg 0x100c2d3
mov esi, eax
jmp 0x100a5af
and eax, 0xffff
or eax, 0x80070000
jmp 0x100c2cc
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, esi
jle 0x100c2f3
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100a58e
test byte [eax + 0x1c], 0x10
je 0x100a58e
cmp byte [eax + 0x19], 4
jb 0x100a58e
push esi
push edi
push 0xf
jmp 0x100a583
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, esi
jle 0x100c333
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100a58e
test byte [eax + 0x1c], 0x10
je 0x100a58e
cmp byte [eax + 0x19], 4
jb 0x100a58e
push esi
push edi
push 0x10
jmp 0x100a583
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov esi, eax
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100c38b
test byte [eax + 0x1c], 0x10
je 0x100c38b
cmp byte [eax + 0x19], 4
jb 0x100c38b
push esi
push edi
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001331
test esi, esi
jg 0x100c3f8
jmp 0x100a58e
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
test eax, eax
jle 0x100c3a8
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100a58e
test byte [eax + 0x1c], 0x10
je 0x100a58e
cmp byte [eax + 0x19], 4
jb 0x100a58e
push esi
push edi
push 0x15
jmp 0x100a583
test byte [eax + 0x1c], 0x10
je 0x100c3ee
cmp byte [eax + 0x19], 4
jb 0x100c3ee
push edi
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100130b
mov esi, 0x80004005
jmp 0x100a58e
and esi, 0xffff
or esi, 0x80070000
jmp 0x100a58e
mov eax, dword [0x1019080]
cmp eax, ebx
je 0x100a5cb
test dword [eax + 0x1c], 0x40000
je 0x100a5cb
cmp byte [eax + 0x19], 2
jb 0x100a5cb
push esi
push edi
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001331
jmp 0x100a5cb