Function at 0x429a60
Capabilities:
Query service status
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x468670
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x8940
call fcn.0045ed20
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov dword [eax], 0
mov dword [ecx], 0
mov dword [ebp - 0x10], esp
xor eax, eax
push eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x54]
push edx
mov ecx, 0x188
lea edi, [ebp - 0xcd0]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
push 0x7a80
lea eax, [ebp - 0x8950]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x429b3f
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x429b3f
mov ebx, dword [0x4902e8]
test dword [0x4900e8], ebx
je 0x429afb
push str.NamePipeServiceInstanceThread:_Read_from_Pipe_Success
call fcn.0040aac0
mov ebx, dword [0x4902e8]
add esp, 4
mov ecx, dword [ebp - 0x54]
mov edx, ecx
shr ecx, 2
lea esi, [ebp - 0x8950]
lea edi, [ebp - 0xcd0]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0xcd0], 0x8001
jne 0x429b30
cmp dword [ebp - 0xccc], 0x620
je 0x429b60
test dword [0x4900e8], ebx
je 0x429b60
push str.NamePipeServiceInstanceThread:_Pipe_read_msg_contents_error__something_wrong
jmp 0x429b52
mov ebx, dword [0x4902e8]
test dword [0x4900e8], ebx
je 0x429b60
push str.NamePipeServiceInstanceThread:_Read_from_Pipe_Failed
call fcn.0040aac0
mov ebx, dword [0x4902e8]
add esp, 4
mov esi, dword [ebp - 0xcc8]
lea eax, [esi - 9]
cmp eax, 0x37
mov dword [ebp - 0x44], esi
ja case.0x429b7c.10
movzx eax, byte [eax + 0x42b344]
jmp dword [eax*4 + 0x42b2d8]
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x429bad
test dword [0x4900e8], ebx
je 0x42b28b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_FEATUREUPDATE._ulSessionId___d__out_of_range
call fcn.0040aac0
add esp, 8
jmp 0x42b28b
mov ecx, 0x491a60
call fcn.00431330
mov ecx, dword [0x4900e8]
test dword [0x4902e8], ecx
je 0x42b28b
push str.finish_feature_update
call fcn.0040aac0
add esp, 4
jmp 0x42b28b
mov eax, dword [0x491098]
xor edi, edi
cmp eax, 7
ja 0x429ca5
mov esi, dword [ebp - 0xcc0]
cmp esi, 0x14
jae 0x429cb0
cmp dword [0x49039c], edi
je 0x429c0d
mov dword [0x49039c], edi
mov edi, 1
push 0
push esi
call fcn.00429120
add esp, 8
cmp eax, 0xffffffff
je 0x429cf2
push esi
lea eax, [eax + eax*8]
shl eax, 5
push str..pipeExtEventPipe
lea edx, [eax + 0x493d0c]
push str._s_s_d
push edx
mov dword [eax + 0x493e10], 1
mov dword [eax + 0x493d08], esi
call fcn.0045e4c9
mov eax, dword [0x491164]
mov ecx, dword [0x49109c]
add esp, 0x10
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], edi
mov edx, dword [0x4900e8]
test dword [0x4902e8], edx
je 0x42b28b
push str.Send_RegOption_to_Client
call fcn.0040aac0
add esp, 4
jmp 0x42b28b
mov esi, dword [ebp - 0xcc4]
cmp esi, 0x14
jb 0x429ccf
test dword [0x4900e8], ebx
je 0x42b28b
push esi
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_SETUP._ulSessionId___d__out_of_range
call fcn.0040aac0
add esp, 8
jmp 0x42b28b
cmp dword [0x49039c], edi
je 0x429ce2
mov dword [0x49039c], edi
mov edi, 1
push 0
push esi
call fcn.00429120
add esp, 8
cmp eax, 0xffffffff
jne 0x429d1d
test dword [0x4900e8], ebx
je 0x42b2c6
push esi
push str.NamePipeServiceInstance:__d_not_enough_session_slot_to_assign_this_setup_session
call fcn.0040aac0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [eax + eax*8]
shl eax, 5
push esi
push str..pipeExtEventPipe
mov dword [eax + 0x493e10], 1
mov dword [eax + 0x493d08], esi
lea eax, [eax + 0x493d0c]
push str._s_s_d
push eax
call fcn.0045e4c9
mov ecx, dword [ebp - 0xcb8]
mov edx, dword [0x49109c]
mov eax, dword [ebp - 0xcbc]
mov ebx, dword [ebp - 0xcc0]
or edx, ecx
mov ecx, dword [0x491160]
mov dword [0x49109c], edx
mov edx, dword [ebp - 0xcb4]
and edx, 0x8000
add esp, 0x10
cmp ecx, 1
mov esi, eax
mov dword [0x4910d0], edx
jne 0x429d97
mov dword [0x4929e8], ebx
mov dword [0x4929ec], eax
push eax
mov ecx, 0x491a60
call fcn.0042d280
push esi
mov ecx, 0x491a60
mov dword [eax + 0x15c], 1
call fcn.0042d280
mov dword [eax + 0x44], ebx
mov ecx, dword [0x491160]
mov eax, dword [0x491164]
mov edx, dword [0x4929e8]
mov dword [ebp - 0x34], ecx
mov ecx, dword [0x4910c4]
mov dword [ebp - 0x40], eax
mov eax, dword [0x4929ec]
push ecx
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edi
call fcn.0040f9a0
add esp, 4
jmp 0x429c81
mov edi, dword [ebp - 0xcc0]
cmp edi, 0x14
mov dword [ebp - 0x14], edi
jb 0x429e35
test dword [0x4900e8], ebx
je 0x42b28b
push edi
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_READY._ulSessionId___d__out_of_range
call fcn.0040aac0
add esp, 8
jmp 0x42b28b
push 1
push edi
call fcn.00429120
add esp, 8
cmp eax, 0xffffffff
je 0x42a0dc
lea edi, [eax + eax*8]
shl edi, 5
mov eax, dword [edi + 0x493e10]
mov ecx, 3
cmp eax, ecx
je 0x429e77
cmp eax, 5
je 0x429e77
cmp esi, 0xb
jne 0x429e77
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
mov ebx, dword [0x4902e8]
cmp dword [edi + 0x493e10], ecx
jne 0x429e97
cmp dword [0x493d04], 1
jne 0x429e97
mov edx, dword [ebp + 0xc]
mov dword [edx], 1
mov ebx, dword [0x4902e8]
cmp esi, 0x1e
jne 0x429eb2
mov dword [edi + 0x493e10], 2
mov dword [0x493d04], 1
jmp 0x429ecb
cmp dword [edi + 0x493e10], 5
je 0x429ecb
mov dword [edi + 0x493e10], ecx
mov dword [0x493d04], 0
cmp dword [edi + 0x493e10], 2
jne 0x429f18
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
mov eax, dword [0x4910b8]
test eax, eax
je 0x429f12
xor esi, esi
jmp 0x429ef0
mov ecx, dword [0x4910b8]
push esi
call fcn.004020a0
mov ecx, dword [0x4910b8]
push esi
mov dword [ebp + esi*4 - 0x34], eax
call fcn.00402040
inc esi
cmp esi, 5
jb 0x429ef0
mov ebx, dword [0x4902e8]
cmp dword [edi + 0x493d08], 0xffffffff
jne 0x429f4a
mov eax, dword [ebp - 0x14]
push eax
push str..pipeExtEventPipe
lea ecx, [edi + 0x493d0c]
push str._s_s_d
push ecx
mov dword [edi + 0x493d08], eax
call fcn.0045e4c9
mov ebx, dword [0x4902e8]
add esp, 0x10
test dword [0x4900e8], ebx
je 0x429f69
mov edx, dword [ebp - 0x14]
push edx
push str.NamePipeServiceInstance._Got_EXTEVENT_REQTYPE_SESSION_READY_from_session__d
call fcn.0040aac0
mov ebx, dword [0x4902e8]
add esp, 8
mov eax, dword [0x493d00]
cmp eax, dword [ebp - 0x14]
mov edi, eax
je 0x429fa7
test dword [0x4900e8], ebx
je 0x429f8f
mov ecx, dword [ebp - 0x14]
push ecx
push eax
push str.NamePipeServiceInstance._Active_session_has_changed_from__d_to__d
call fcn.0040aac0
add esp, 0xc
cmp dword [ebp - 0x44], 0xb
mov edx, dword [ebp - 0x14]
mov dword [0x493d00], edx
jne 0x429fa7
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
mov ecx, dword [0x4910d8]
test ecx, ecx
je 0x42b28b
cmp dword [ebp - 0x44], 0xb
jne 0x42b28b
call fcn.004177f0
cmp dword [0x491098], 6
je 0x42b28b
push 1
push edi
call fcn.00429120
mov ecx, dword [ebp - 0x14]
add esp, 8
cmp edi, ecx
je 0x42b28b
cmp edi, 0xffffffff
je 0x42b28b
cmp eax, 0xffffffff
jne 0x42a026
mov ecx, dword [0x4900e8]
test dword [0x4902e8], ecx
je 0x42b2c6
push edi
push str.NamePipeServiceInstance:_BUG__d_notin_list
call fcn.0040aac0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [eax + eax*8]
shl edx, 5
cmp dword [edx + 0x493e10], 5
jne 0x42b28b
xor eax, eax
push 1
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov eax, dword [0x491164]
push 0
lea ecx, [ebp - 0x6b0]
lea esi, [edx + 0x493d0c]
push ecx
push esi
mov dword [ebp - 0x6a8], 0x1b
mov dword [ebp - 0x6a0], eax
call fcn.00409c00
add esp, 0x10
test eax, eax
jne 0x42b28b
mov edx, dword [0x4900e8]
test dword [0x4902e8], edx
je 0x42b28b
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_CLIENTSETUNLOCKEVENT_on_pipe__s_.
call fcn.0040aac0
add esp, 8
jmp 0x42b28b
mov edi, dword [ebp - 0xcc0]
cmp edi, 0x14
jb 0x42a0cc
test dword [0x4900e8], ebx
je 0x42b28b
push edi
push esi
push str.NamePipeServiceInstance._WARNING_reqtype_d._ulSessionId___d__out_of_range
call fcn.0040aac0
add esp, 0xc
jmp 0x42a144
push 1
push edi
call fcn.00429120
add esp, 8
cmp eax, 0xffffffff
jne 0x42a107
test dword [0x4900e8], ebx
je 0x42b2c6
push edi
push str.NamePipeServiceInstance:_BUG__d_notin_list
call fcn.0040aac0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [eax + eax*8]
shl eax, 5
mov dword [eax + 0x493e10], 4
cmp dword [0x493d00], edi
jne 0x42a14a
mov ecx, dword [0x4910d8]
test ecx, ecx
mov dword [0x493d00], 0xffffffff
mov dword [0x493d04], 1
je 0x42a14a
push 0
call fcn.00417830
mov ebx, dword [0x4902e8]
test dword [0x4900e8], ebx
je 0x42b28b
mov ecx, dword [ebp - 0x44]
push edi
push ecx
push str.NamePipeServiceInstance._reqtype_d_called_from_session__d
jmp 0x42b283
mov esi, dword [ebp - 0xcc0]
cmp esi, 0x14
mov dword [ebp - 0x14], esi
jb 0x42a18a
test dword [0x4900e8], ebx
je 0x42b28b
push esi
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_READYBUTLOCKED._ulSessionId___d__out_of_range
jmp 0x42a24a
push 1
push esi
call fcn.00429120
add esp, 8
cmp eax, 0xffffffff
je 0x42a3f5
lea eax, [eax + eax*8]
shl eax, 5
mov ecx, dword [eax + 0x493e10]
cmp ecx, 5
lea eax, [eax + 0x493e10]
je 0x42a1bb
mov dword [eax], 3
cmp dword [0x493d00], esi
jne 0x42a258
mov ecx, dword [0x4910d8]
test ecx, ecx
mov dword [0x493d04], 1
je 0x42a258
push 0
call fcn.00417830
call fcn.00409d70
mov esi, eax
cmp dword [0x491098], 6
jne 0x42a252
test esi, esi
je 0x42a252
mov edx, dword [0x491164]
xor eax, eax
push 1
push eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x6b0]
push eax
push esi
mov dword [ebp - 0x6a8], 0xd
mov dword [ebp - 0x6a0], edx
call fcn.00409c00
add esp, 0x10
test eax, eax
jne 0x42a252
mov ebx, dword [0x4902e8]
test dword [0x4900e8], ebx
je 0x42b28b
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_SCREENSAVERSTOP_on_pipe__s_.
call fcn.0040aac0
add esp, 8
mov ebx, dword [0x4902e8]
test dword [0x4900e8], ebx
je 0x42b28b
mov ecx, dword [ebp - 0x14]
push ecx
push str.NamePipeServiceInstance._EXTEVENT_REQTYPE_CLT_READYBUTLOCKED_called_from_session__d
call fcn.0040aac0
add esp, 8
jmp 0x42b28b
mov eax, dword [ebp - 0xcc0]
cmp eax, 0x14
mov esi, eax
jb 0x42a29f
test dword [0x4900e8], ebx
je 0x42a2cf
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_LOGGEDOFF._ulSessionId___d__out_of_range
call fcn.0040aac0
add esp, 8
jmp 0x42a2c9
mov ecx, dword [0x493d00]
cmp ecx, eax
je 0x42a2c0
test dword [0x4900e8], ebx
je 0x42a2c0
push eax
push ecx
push str.NamePipeServiceInstance._WARNING._EXTEVENT_REQTYPE_CLT_LOGGEDOFF_m_SessionClients.ulActiveSessionId___d____ulSessionId___d_
call fcn.0040aac0
add esp, 0xc
push esi
call fcn.00429170
add esp, 4
mov ebx, dword [0x4902e8]
test dword [0x4900e8], ebx
je 0x42b28b
push esi
push str.NamePipeServiceInstance._EXTEVENT_REQTYPE_CLT_LOGGEDOFF_called_from_session__d
call fcn.0040aac0
add esp, 8
jmp 0x42b28b
mov eax, dword [ebp - 0xcc0]
cmp eax, 0x14
mov esi, eax
jb 0x42a319
test dword [0x4900e8], ebx
je 0x42a36d
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_IN_RESUME._ulSessionId___d__out_of_range
call fcn.0040aac0
mov ebx, dword [0x4902e8]
add esp, 8
jmp 0x42a36d
mov ecx, dword [0x493d00]
cmp ecx, eax
je 0x42a340
test dword [0x4900e8], ebx
je 0x42a340
push eax
push ecx
push str.NamePipeServiceInstance._WARNING._EXTEVENT_REQTYPE_CLT_IN_RESUME_m_SessionClients.ulActiveSessionId___d____ulSessionId___d_
call fcn.0040aac0
mov ebx, dword [0x4902e8]
add esp, 0xc
push 1
push esi
call fcn.00429120
add esp, 8
cmp eax, 0xffffffff
je 0x42a3f5
lea eax, [eax + eax*8]
shl eax, 5
cmp dword [eax + 0x493d08], 0xffffffff
je 0x42a36d
mov dword [eax + 0x493e10], 5
test dword [0x4900e8], ebx
je 0x42b28b
push esi
push str.NamePipeServiceInstance._EXTEVENT_REQTYPE_CLT_IN_RESUME_called_from_session__d
call fcn.0040aac0
add esp, 8
jmp 0x42b28b
mov eax, dword [ebp - 0xcc0]
cmp eax, 0x14
mov esi, eax
jb 0x42a3be
test dword [0x4900e8], ebx
je 0x42a442
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_OUTOF_RESUME._ulSessionId___d__out_of_range
call fcn.0040aac0
mov ebx, dword [0x4902e8]
add esp, 8
jmp 0x42a442
mov ecx, dword [0x493d00]
cmp ecx, eax
je 0x42a3e5
test dword [0x4900e8], ebx
je 0x42a3e5
push eax
push ecx
push str.NamePipeServiceInstance._WARNING._EXTEVENT_REQTYPE_CLT_OUTOF_RESUME_m_SessionClients.ulActiveSessionId___d____ulSessionId___d_
call fcn.0040aac0
mov ebx, dword [0x4902e8]
add esp, 0xc
push 1
push esi
call fcn.00429120
add esp, 8
cmp eax, 0xffffffff
jne 0x42a420
test dword [0x4900e8], ebx
je 0x42b2c6
push esi
push str.NamePipeServiceInstance:_BUG__d_notin_list
call fcn.0040aac0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [eax + eax*8]
shl eax, 5
cmp dword [eax + 0x493d08], 0xffffffff
je 0x42a442
cmp dword [eax + 0x493e10], 5
jne 0x42a442
mov dword [eax + 0x493e10], 3
test dword [0x4900e8], ebx
je 0x42b28b
push esi
push str.NamePipeServiceInstance._EXTEVENT_REQTYPE_CLT_OUTOF_RESUME_called_from_session__d
call fcn.0040aac0
add esp, 8
jmp 0x42b28b
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42a48b
test dword [0x4900e8], ebx
je 0x42b28b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_SAFEESCAPEREGISTRATIONQUERY._ulSessionId___d__out_of_range
call fcn.0040aac0
add esp, 8
jmp 0x42b28b
mov ecx, 0x491a60
call fcn.0042fa10
mov ecx, dword [0x4902e8]
mov edx, dword [0x491164]
mov dword [ebp - 0x34], eax
mov eax, dword [0x4900e8]
test eax, ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x38], 0x24
je 0x42b28b
push str.Finish_Safe_Escape_Registration_Status_Query_n
call fcn.0040aac0
add esp, 4
jmp 0x42b28b
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42a505
test dword [0x4900e8], ebx
je 0x42b28b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_SAFEESCAPEREGISTRATIONUPDATE._ulSessionId___d__out_of_range
call fcn.0040aac0
add esp, 8
jmp 0x42b28b
test dword [0x4900e8], ebx
mov ecx, dword [0x491164]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x38], 0x25
je 0x42b28b
push str.Finish_Safe_Escape_Registration_Status_Update_n
call fcn.0040aac0
add esp, 4
jmp 0x42b28b
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42a56b
test dword [0x4900e8], ebx
je 0x42b28b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_SAVEPROFILEATSHUTDOWN_FINISHES._ulSessionId___d__out_of_range
call fcn.0040aac0
add esp, 8
jmp 0x42b28b
mov ecx, 0x492e78
call fcn.00415a10
mov eax, dword [0x4900e8]
test dword [0x4902e8], eax
mov edx, dword [0x491164]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x38], 0x27
je 0x42b28b
push str.Finish_EXTEVENT_REQTYPE_CLT_SAVEPROFILEATSHUTDOWN_FINISHES_n
call fcn.0040aac0
add esp, 4
jmp 0x42b28b
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42a5e0
test dword [0x4900e8], ebx
je 0x42b28b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_STOPSCREENSAVEREVENT._ulSessionId___d__out_of_range
call fcn.0040aac0
add esp, 8
jmp 0x42b28b
mov eax, dword [0x4910cc]
test eax, eax
je 0x42a65f
call fcn.00409d70
mov esi, eax
cmp dword [0x493d00], 0xffffffff
je 0x42a65f
test esi, esi
je 0x42a65f
xor eax, eax
push 1
push eax
lea edx, [ebp - 0x6b0]
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov ecx, dword [0x491164]
push edx
push esi
mov dword [ebp - 0x6a8], 0x29
mov dword [ebp - 0x6a0], ecx
call fcn.00409c00
mov ebx, dword [0x4902e8]
add esp, 0x10
test eax, eax
jne 0x42a65f
test dword [0x4900e8], ebx
je 0x42b28b
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_SCREENSAVERSTOP_on_pipe__s_.
call fcn.0040aac0
mov ebx, dword [0x4902e8]
add esp, 8
test dword [0x4900e8], ebx
je 0x42b28b
push str.Finish_EXTEVENT_REQTYPE_CLT_STOPSCREENSAVEREVENT_n
call fcn.0040aac0
add esp, 4
jmp 0x42b28b
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42a6a7
test dword [0x4900e8], ebx
je 0x42b28b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_STARTSCREENSAVEREVENT._ulSessionId___d__out_of_range
call fcn.0040aac0
add esp, 8
jmp 0x42b28b
mov eax, dword [0x4910cc]
test eax, eax
je 0x42a726
call fcn.00409d70
mov esi, eax
cmp dword [0x493d00], 0xffffffff
je 0x42a726
test esi, esi
je 0x42a726
xor eax, eax
push 1
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov eax, dword [0x491164]
push 0
lea ecx, [ebp - 0x6b0]
push ecx
push esi
mov dword [ebp - 0x6a8], 0x2b
mov dword [ebp - 0x6a0], eax
call fcn.00409c00
mov ebx, dword [0x4902e8]
add esp, 0x10
test eax, eax
jne 0x42a726
test dword [0x4900e8], ebx
je 0x42b28b
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_SCREENSAVERSTART_on_pipe__s_.
call fcn.0040aac0
mov ebx, dword [0x4902e8]
add esp, 8
test dword [0x4900e8], ebx
je 0x42b28b
push str.Finish_EXTEVENT_REQTYPE_CLT_STARTSCREENSAVEREVENT_n
call fcn.0040aac0
add esp, 4
jmp 0x42b28b
mov eax, dword [ebp - 0xcc4]
cmp eax, 0x14
jb 0x42a76e
test dword [0x4900e8], ebx
je 0x42b28b
push eax
push str.NamePipeServiceInstance._WARNING_EXTEVENT_REQTYPE_CLT_WRITEEVENTLOGMSG._ulSessionId___d__out_of_range
call fcn.0040aac0
add esp, 8
jmp 0x42b28b
mov ecx, dword [0x491298]
test ecx, ecx
mov eax, dword [ebp - 0xcbc]
mov dword [ebp + 0xc], eax
je 0x42b28b
mov edx, dword [ebp - 0xcc0]
push 0
push 0
push 0
push eax
push edx
mov dword [ebp - 4], 0
call fcn.00411160
cmp dword [ebp + 0xc], 0x8000006e
mov dword [ebp - 4], 0xffffffff
jne 0x42b28b
push 0xc
call fcn.004234a0
add esp, 4
jmp 0x42b28b
test dword [0x4900e8], ebx
je 0x42a7f7
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_REGISTERCOMOBJECT_is_called
call fcn.0040aac0
add esp, 4
mov ecx, dword [0x493d00]
push 1
push ecx
call fcn.00429120
add esp, 8
cmp eax, 0xffffffff
je 0x42b28b
mov edx, dword [0x485f04]
lea ebx, [eax + eax*8]
shl ebx, 5
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0xcc0]
mov dword [ebp + 0x10], ebx
lea ebx, [ebx + 0x493e14]
push ecx
mov ecx, ebx
mov dword [ebp - 0x18], 1
mov dword [ebp + 0xc], edx
call fcn.004294b0
mov edx, dword [ebp + 0xc]
cmp edx, dword [0x485f04]
jne 0x42b28b
push 0x30
call fcn.0045e556
mov edx, eax
add esp, 4
xor eax, eax
test edx, edx
je 0x42a86e
mov ecx, 0xc
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, edx
lea edi, [eax + 8]
mov ecx, 0xa
lea esi, [ebp - 0xcc0]
rep movsd dword es:[edi], dword [esi]
mov dword [eax], 0
mov dword [eax + 4], 0
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x42a89c
mov dword [eax + 4], ecx
mov ecx, dword [ebx + 8]
mov dword [ecx], eax
jmp 0x42a89f
mov dword [ebx + 4], eax
mov edx, dword [ebx + 0xc]
mov dword [ebx + 8], eax
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
inc edx
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov dword [ebx + 0xc], edx
push 1
mov dword [ebp - 0x6a8], 0x2d
mov ecx, 0xa
lea esi, [ebp - 0xcc0]
lea edi, [ebp - 0x6a0]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x10]
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x6b0]
push eax
lea esi, [esi + 0x493d0c]
push esi
call fcn.00409c00
add esp, 0x10
test eax, eax
jne 0x42aff0
mov ecx, dword [0x4900e8]
test dword [0x4902e8], ecx
je 0x42a922
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_CLT_REGISTERCOMOBJECT_on_pipe__s_.
call fcn.0040aac0
add esp, 8
mov dword [ebp - 0x18], 1
jmp 0x42b25c
test dword [0x4900e8], ebx
je 0x42a943
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_UNREGISTERCOMOBJECT_is_called
call fcn.0040aac0
add esp, 4
mov eax, dword [0x493d00]
push 1
push eax
call fcn.00429120
add esp, 8
cmp eax, 0xffffffff
je 0x42b28b
lea ebx, [eax + eax*8]
xor edi, edi
shl ebx, 5
lea esi, [ebx + 0x493e14]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x50], vtable.Eeu::LinkedListIterator_struct_tagComCallbacks_.0
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], edi
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0xcc0]
push edx
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.004298e0
test al, al
je 0x42aa46
cmp esi, dword [ebp - 0x4c]
jne 0x42a9b5
mov eax, dword [ebp - 0x48]
cmp eax, edi
je 0x42a9b5
push edi
push edi
push eax
mov ecx, esi
call fcn.00429950
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
push 1
mov dword [ebp - 0x6a8], 0x36
mov ecx, 0xa
lea esi, [ebp - 0xcc0]
lea edi, [ebp - 0x6a0]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x6b0]
push ecx
lea esi, [ebx + 0x493d0c]
push esi
call fcn.00409c00
add esp, 0x10
test eax, eax
jne 0x42aa30
mov edx, dword [0x4900e8]
test dword [0x4902e8], edx
je 0x42aa27
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_CLT_UNREGISTERCOMOBJECT_on_pipe__s_.
call fcn.0040aac0
add esp, 8
mov dword [ebp - 0x18], 1
jmp 0x42aa37
mov dword [ebp - 0x18], 2
mov eax, dword [0x491164]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 4], 0xffffffff
jmp 0x42b28b
mov esi, dword [0x4900e8]
test ebx, esi
je 0x42aa75
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_GETCOMCALLBACKS_is_called
call fcn.0040aac0
mov ebx, dword [0x4902e8]
mov esi, dword [0x4900e8]
add esp, 4
mov edx, dword [ebp - 0xcc4]
cmp edx, 0x14
jb 0x42aa9b
test ebx, esi
je 0x42b28b
push edx
push str.NamePipeInstance_warning_EXTEVENT_REQTYPE_CLT_GETCOMCALLBACKS_ulSessionId___u__out_of_range
call fcn.0040aac0
add esp, 8
jmp 0x42b28b
xor eax, eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
push 1
rep stosd dword es:[edi], eax
push edx
mov dword [ebp - 0x18], 2
call fcn.00429120
add esp, 8
cmp eax, 0xffffffff
jne 0x42aaeb
test ebx, esi
je 0x42b2c6
mov ecx, dword [0x493d00]
push ecx
push str.NamePipeServiceInstance:_BUG_activesession__d_notin_list
call fcn.0040aac0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea esi, [eax + eax*8]
shl esi, 5
mov ebx, dword [esi + 0x493e18]
lea eax, [esi + 0x493e14]
mov dword [ebp - 0x50], vtable.Eeu::LinkedListIterator_struct_tagComCallbacks_.0
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], ebx
test ebx, ebx
mov dword [ebp - 4], 3
je 0x42abad
lea esp, [esp]
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
lea edx, [ebp - 0x6a0]
rep stosd dword es:[edi], eax
push edx
lea ecx, [ebp - 0x50]
call fcn.004293e0
test al, al
je 0x42ab6c
push 1
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x6b0]
push ecx
lea edx, [esi + 0x493d0c]
push edx
mov dword [ebp - 0x6a8], 0x2d
call fcn.00409c00
add esp, 0x10
test eax, eax
je 0x42ab85
test ebx, ebx
je 0x42abad
mov ebx, dword [ebx]
test ebx, ebx
mov dword [ebp - 0x48], ebx
jne 0x42ab20
mov dword [ebp - 4], 0xffffffff
jmp 0x42b25c
mov eax, dword [0x4900e8]
test dword [0x4902e8], eax
je 0x42aba6
lea ecx, [esi + 0x493d0c]
push ecx
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_CLT_GETCOMCALLBACKS_on_pipe__s_.
call fcn.0040aac0
add esp, 8
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0xffffffff
jmp 0x42b25c
test dword [0x4900e8], ebx
je 0x42abce
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_APPLYADCBYSELECTED.._is_called
call fcn.0040aac0
add esp, 4
mov eax, dword [0x493d00]
push 1
push eax
call fcn.00429120
mov edx, eax
add esp, 8
cmp edx, 0xffffffff
je 0x42b28b
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x6a8], 0x2f
mov ecx, 0xa
lea esi, [ebp - 0xcc0]
lea edi, [ebp - 0x6a0]
rep movsd dword es:[edi], dword [esi]
lea esi, [edx + edx*8]
push 1
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x6b0]
shl esi, 5
push edx
lea esi, [esi + 0x493d0c]
push esi
call fcn.00409c00
add esp, 0x10
test eax, eax
jne 0x42ac60
mov eax, dword [0x4900e8]
test dword [0x4902e8], eax
je 0x42ac60
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_APPLYADCBYSELECTED_on_pipe__s_.
call fcn.0040aac0
add esp, 8
mov ecx, dword [0x491164]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
jmp 0x42b28b
test dword [0x4900e8], ebx
je 0x42ac8a
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_APPLYADCBYSELECTED.._is_called
call fcn.0040aac0
add esp, 4
mov edx, dword [0x493d00]
push 1
push edx
call fcn.00429120
mov edx, eax
add esp, 8
cmp edx, 0xffffffff
je 0x42b28b
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x6a8], 0x3d
mov ecx, 0x27
lea esi, [ebp - 0xcc0]
lea edi, [ebp - 0x6a0]
rep movsd dword es:[edi], dword [esi]
push 1
lea esi, [edx + edx*8]
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x6b0]
shl esi, 5
push ecx
lea esi, [esi + 0x493d0c]
push esi
call fcn.00409c00
add esp, 0x10
test eax, eax
jne 0x42ad1e
mov edx, dword [0x4900e8]
test dword [0x4902e8], edx
je 0x42ad1e
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_APPLYADCBYSELECTED_on_pipe__s_.
call fcn.0040aac0
add esp, 8
mov eax, dword [0x491164]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x2c
jmp 0x42b28b
test dword [0x4900e8], ebx
je 0x42ad47
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_APPLYADCBY.._is_called
call fcn.0040aac0
add esp, 4
mov ecx, dword [0x493d00]
push 1
push ecx
call fcn.00429120
mov edx, eax
add esp, 8
cmp edx, 0xffffffff
je 0x42b28b
xor eax, eax
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x6a8], 0x38
mov ecx, 0x185
lea esi, [ebp - 0xcc4]
lea edi, [ebp - 0x6a4]
rep movsd dword es:[edi], dword [esi]
lea esi, [edx + edx*8]
push 1
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x6b0]
shl esi, 5
push eax
lea esi, [esi + 0x493d0c]
push esi
call fcn.00409c00
add esp, 0x10
test eax, eax
jne 0x42b25c
mov ecx, dword [0x4900e8]
test dword [0x4902e8], ecx
je 0x42a922
push esi
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_SVR_APPLYADCBYCONNECTED_on_pipe__s_.
call fcn.0040aac0
add esp, 8
mov dword [ebp - 0x18], 1
jmp 0x42b25c
test dword [0x4900e8], ebx
je 0x42ae04
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_PRPCESSPENDINGHPD_is_called
call fcn.0040aac0
add esp, 4
cmp dword [0x493d00], 0xffffffff
je 0x42b28b
mov eax, dword [0x4910b8]
test eax, eax
je 0x42aea1
mov ecx, dword [eax + 0x128]
test ecx, ecx
je 0x42aea1
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov eax, dword [eax + 0x128]
lea edx, [ebp - 0x70]
push edx
mov ecx, eax
call fcn.00406870
test eax, eax
je 0x42ae9a
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x24], edx
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x34], ecx
mov ecx, dword [0x491164]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
jmp 0x42b28b
mov dword [ebp - 0x18], 1
mov ecx, dword [0x491164]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
jmp 0x42b28b
test dword [0x4900e8], ebx
mov esi, dword [ebp - 0xcc4]
mov dword [ebp - 0x44], esi
je 0x42aeda
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_KILLCLIENTPROCESS_is_called
call fcn.0040aac0
mov ebx, dword [0x4902e8]
add esp, 4
cmp esi, 0x14
jb 0x42af04
cmp esi, 0xffffffff
je 0x42af0e
test dword [0x4900e8], ebx
je 0x42b28b
push 0xffffffffffffffff
push str.NamePipeInstance_warning_EXTEVENT_REQTYPE_CLT_KILLCLIENTPROCESS_ulSessionId___u__out_of_range
call fcn.0040aac0
add esp, 8
jmp 0x42b28b
cmp esi, 0xffffffff
je 0x42af0e
mov dword [ebp + 0xc], esi
jmp 0x42af1a
mov dword [ebp + 0xc], 0
mov esi, 0x14
mov ebx, 0x493d0c
mov dword [ebp + 0x10], 0x14
mov eax, dword [ebp + 0xc]
cmp eax, esi
ja 0x42af8a
mov ecx, dword [ebx - 4]
cmp ecx, eax
je 0x42af3b
inc eax
cmp eax, esi
jbe 0x42af30
jmp 0x42af8a
xor eax, eax
push 1
mov ecx, 0x188
lea edi, [ebp - 0x6b0]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x6b0]
push eax
push ebx
mov dword [ebp - 0x6a8], 0x35
call fcn.00409c00
add esp, 0x10
test eax, eax
jne 0x42af8a
mov ecx, dword [0x4900e8]
test dword [0x4902e8], ecx
je 0x42af8a
push ebx
push str.NamePipeServiceInstance_failed_CallAtiNamedPipe_EXTEVENT_REQTYPE_CLT_KILLCLIENTPROCESS_on_pipe__s_.
call fcn.0040aac0
add esp, 8
mov eax, dword [ebp + 0x10]
add ebx, 0x120
dec eax
mov dword [ebp + 0x10], eax
jne 0x42af26
cmp dword [ebp - 0x44], 0xffffffff
jne 0x42afb2
mov edx, dword [0x4910b0]
push 0
push 0
push 0x12
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
mov ecx, 0xb
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov eax, dword [0x491164]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x2c
jmp 0x42b28b
test dword [0x4900e8], ebx
je 0x42afe7
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_SVR_ISTMMHANDLEDBYADC_is_called
call fcn.0040aac0
add esp, 4
mov ecx, dword [0x4910d0]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x18], 2
jmp 0x42b25c
mov eax, dword [ebp - 0xcc0]
mov ecx, dword [ebp - 0xcbc]
mov edx, dword [ebp - 0xcb8]
mov dword [0x491084], eax
mov eax, dword [ebp - 0xcb4]
mov dword [0x491088], ecx
mov ecx, dword [ebp - 0xcb0]
mov dword [0x49107c], 1
mov dword [0x49108c], edx
mov dword [0x491090], eax
mov dword [0x491094], ecx
jmp 0x42b28b
mov eax, dword [0x49107c]
test eax, eax
je 0x42b28b
test dword [0x4900e8], ebx
mov dword [0x49107c], 0
je 0x42b071
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_SVR_ISTMMHANDLEDBYADC_is_called
call fcn.0040aac0
add esp, 4
mov edx, dword [0x491084]
mov eax, dword [0x491088]
mov ecx, dword [0x49108c]
mov dword [ebp - 0x34], edx
mov edx, dword [0x491090]
mov dword [ebp - 0x30], eax
mov eax, dword [0x491094]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [0x491164]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], 0x2c
jmp 0x42b28b
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0xed0]
rep stosd dword es:[edi], eax
test dword [0x4900e8], ebx
mov dword [ebp + 0xc], 0
je 0x42b0e3
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_ENABLESTOPSERVICE_is_called
call fcn.0040aac0
add esp, 4
push 4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x42b121
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0xed0]
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_ENABLESTOPSERVICE._failed_to_open_SCM._err_d
push edx
call fcn.0045e4c9
lea eax, [ebp - 0xed0]
push eax
call fcn.00411060
add esp, 0x10
jmp 0x42b24c
cmp dword [0x491098], 7
mov eax, str.Ati_HotKey_Poller
jbe 0x42b134
mov eax, str.Ati_External_Event_Utility
push 4
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x42b177
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0xed0]
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_ENABLESTOPSERVICE._failed_to_OpenService._err_d
push ecx
call fcn.0045e4c9
lea edx, [ebp - 0xed0]
push edx
call fcn.00411060
add esp, 0x10
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x42b24c
mov esi, dword [0x49368c]
xor eax, eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x80], eax
push ecx
mov dword [ebp - 0x7c], eax
push edi
mov dword [ebp - 0x78], eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x42b1e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0xed0]
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_ENABLESTOPSERVICE._failed_to_QueryServiceStatus._err_d
push edx
call fcn.0045e4c9
lea eax, [ebp - 0xed0]
push eax
call fcn.00411060
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 0x10
push edi
call esi
push ebx
call esi
jmp 0x42b24c
or dword [ebp - 0x88], 1
mov edx, dword [esi + 0x4c]
lea ecx, [ebp - 0x90]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x42b22f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xed0]
push str.NamePipeServiceInstance_EXTEVENT_REQTYPE_CLT_ENABLESTOPSERVICE._failed_to_SetServiceStatus._err_d
push eax
call fcn.0045e4c9
lea ecx, [ebp - 0xed0]
push ecx
call fcn.00411060
mov esi, dword [ebp + 0xc]
add esp, 0x10
jmp 0x42b234
mov esi, 1
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push ebx
call edi
cmp esi, 1
mov dword [ebp - 0x18], 2
je 0x42b253
mov dword [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x34], eax
mov edx, dword [0x491164]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0x2c
jmp 0x42b28b
test dword [0x4900e8], ebx
je 0x42b28b
mov eax, dword [ebp - 0xcc0]
push eax
push esi
push str.NamePipeServiceInstance._request__d_not_supported_for_data__d
call fcn.0040aac0
add esp, 0xc
mov eax, dword [ebp + 8]
push 0
lea ecx, [ebp - 0x74]
push ecx
push 0x2c
lea edx, [ebp - 0x40]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42b2ab
cmp dword [ebp - 0x74], 0x2c
je 0x42b2c6
mov ecx, dword [0x4900e8]
test dword [0x4902e8], ecx
je 0x42b2c6
push str.Write_to_Pipe_Failed
call fcn.0040aac0
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret