Function at 0x4a4380
Capabilities:
Query service status
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x270
mov eax, dword [0x596fb8]
xor eax, esp
mov dword [esp + 0x26c], eax
cmp dword [0x597e70], 0
push edi
jne 0x4a4482
mov eax, dword [esp + 0x278]
mov dword [0x5981b0], eax
call fcn.0048ed30
call fcn.004b49f0
call fcn.0051ade0
call fcn.00408060
call fcn.00496c30
call fcn.004a16d0
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
mov edi, eax
push edi
push str.ole_initialize:__08x_n
push 0xffffff00
call fcn.0048f0f0
add esp, 0xc
call fcn.004a25f0
mov ecx, dword [0x598188]
mov eax, dword [ecx]
test eax, 0x2000
je 0x4a4426
mov edx, dword [ecx + 0x44]
push edx
mov edx, dword [ecx + 0x40]
mov ecx, dword [ecx + 4]
push edx
mov edx, eax
and ecx, 0x40000
push ecx
and edx, 0x1000000
push edx
and eax, 8
push eax
call fcn.004bd7c0
jmp 0x4a4945
test eax, 0x20000
je 0x4a4454
call fcn.00404180
test eax, eax
je 0x4a4945
xor eax, eax
pop edi
mov ecx, dword [esp + 0x26c]
xor ecx, esp
call fcn.00549750
add esp, 0x270
ret 8
test eax, 0x4000
je 0x4a4486
call fcn.004aed30
test eax, eax
jne 0x4a4486
xor edi, edi
call fcn.004a3970
test eax, eax
jne 0x4a4945
mov dword [0x598184], 1
jmp 0x4a4945
mov edi, dword [esp + 4]
push 0
push 0
push 0
push 0
call dword [0x597dbc]
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 8
mov dword [esp + 0xc], 0x42ff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.00409370
mov eax, dword [0x598188]
cmp dword [eax + 0x38], 0
je 0x4a44c8
mov ecx, dword [eax + 0x38]
push ecx
call fcn.00409350
push esi
mov esi, dword [0x58a698]
test esi, esi
jle 0x4a4512
mov ecx, dword [0x58def4]
imul ecx, esi
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [0x58def8]
sar edx, 4
imul ecx, esi
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [0x58def4], eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov dword [0x58def8], ecx
cmp byte [0x598018], 0
je 0x4a4542
call fcn.004aed30
test eax, eax
jne 0x4a4542
xor edi, edi
call fcn.004a3970
test eax, eax
jne 0x4a4944
mov dword [0x598184], 1
jmp 0x4a4944
cmp byte [0x598017], 0
je 0x4a4555
mov dword [0x598128], 1
cmp byte [0x598016], 0
jne 0x4a456c
mov edx, dword [0x598188]
test dword [edx], 0x1000000
je 0x4a4573
push 0
call fcn.0048f560
cmp byte [0x598015], 0
je 0x4a4583
push 1
call fcn.0048f450
call fcn.0048f110
push str.load_localization_n
push 0xffffff00
call fcn.0048f0f0
mov eax, dword [0x598188]
mov eax, dword [eax + 0x58]
add esp, 8
cmp eax, 0xffffffff
jne 0x4a45ac
mov eax, dword [0x597eb0]
push eax
call fcn.004a1740
mov eax, dword [0x598188]
test byte [eax], 8
je 0x4a45c8
push 1
call fcn.0048f450
mov eax, dword [0x598188]
mov ecx, 0x40000
test dword [eax + 4], ecx
je 0x4a45de
mov dword [0x598128], 1
jmp 0x4a45ed
test dword [eax + 8], ecx
je 0x4a45ed
mov dword [0x598128], 0
push edi
push str.ole_initialize:__08x_n
push 0xffffff00
call fcn.0048f0f0
mov ecx, dword [0x598188]
add esp, 0xc
test dword [ecx], 0x1000
je 0x4a4613
call fcn.0040d120
mov edx, dword [0x598188]
push ebx
mov ebx, 4
cmp dword [edx + 0x64], ebx
push ebp
jne 0x4a4715
call fcn.004aed30
test eax, eax
jne 0x4a4715
push ebx
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
xor esi, esi
xor edi, edi
test ebp, ebp
je 0x4a46a4
lea eax, [esp + 0x78]
push eax
call fcn.004ba120
push ebx
lea ecx, [esp + 0x7c]
push ecx
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x4a46a4
lea edx, [esp + 0x10]
push edx
push 0x24
lea eax, [esp + 0x3c]
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4a46a4
mov eax, dword [esp + 0x50]
test eax, eax
je 0x4a4697
push eax
push edi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
jmp 0x4a46a4
mov ecx, dword [0x598188]
mov dword [ecx + 0x64], 5
mov edx, dword [0x598188]
cmp dword [edx + 0x64], ebx
jne 0x4a46ee
push 0
push 0
push 0x4fd3f0
call fcn.004b9d90
mov ebx, eax
test ebx, ebx
je 0x4a46e1
push ebx
call fcn.004b9d50
test eax, eax
je 0x4a46d9
mov eax, dword [0x598188]
mov dword [eax + 0x64], 5
push ebx
call fcn.004b8d30
jmp 0x4a46ee
mov ecx, dword [0x598188]
mov dword [ecx + 0x64], 5
test edi, edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4a4707
push 0xea60
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call ebx
test esi, esi
je 0x4a470e
push esi
call ebx
test ebp, ebp
je 0x4a4715
push ebp
call ebx
call fcn.004a3f70
call fcn.004a2b20
test eax, eax
jne 0x4a4942
mov edx, dword [0x598188]
cmp dword [edx + 0x78], eax
je 0x4a4768
call fcn.004b3210
call fcn.004ae890
push str.load_everything_icon_n
push 0xffffff00
call fcn.0048f0f0
add esp, 8
call fcn.004a24d0
mov eax, dword [0x598188]
mov ecx, dword [eax + 0x78]
push ecx
push 0
call fcn.00516450
jmp 0x4a4942
push str.create_mutex_n
push 0xffffff00
call fcn.0048f0f0
mov esi, dword [esp + 0x290]
add esp, 8
cmp byte [0x597e95], 0
jne 0x4a47a6
push esi
call fcn.004a3da0
test eax, eax
jne 0x4a47a6
push str.mutex_exists_n
call fcn.0048f0d0
add esp, 4
jmp 0x4a4942
mov edx, dword [0x598188]
test byte [edx], 4
je 0x4a47be
call fcn.004a3ad0
test eax, eax
jne 0x4a4942
call fcn.004b3210
call fcn.004ae890
push str.load_everything_icon_n
push 0xffffff00
call fcn.0048f0f0
add esp, 8
call fcn.004a24d0
push str.bookmarks_n
push 0xffffff00
call fcn.0048f0f0
add esp, 8
call fcn.00403690
push str.filters_n
push 0xffffff00
call fcn.0048f0f0
add esp, 8
call fcn.00499ea0
push str.search_history_n
push 0xffffff00
call fcn.0048f0f0
add esp, 8
call fcn.004b8920
push str.set_hook_n
push 0xffffff00
call fcn.0048f0f0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x4a3d20
push 0xffffffffffffffff
call dword [0x597e48]
push str.create_tray_n
push 0xffffff00
mov dword [esp + 0x18], eax
call fcn.0048f0f0
add esp, 8
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x38], 0x44
call dword [0x597d44]
test byte [esp + 0x60], 1
jne 0x4a4881
mov word [esp + 0x64], si
movzx ecx, word [esp + 0x64]
push ecx
call fcn.004c1b40
push str.enter_main_loop_n
push 0xffffff00
call fcn.0048f0f0
mov edi, dword [0x597e18]
mov ebx, dword [0x597de8]
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
add esp, 8
push 0
push 0
push 0
push 0
lea edx, [esp + 0x28]
push edx
call edi
test eax, eax
je 0x4a4927
cmp dword [0x598128], 0
je 0x4a48f2
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
push str.MSG:__p__04x__p__p_n
push 0xff00ff00
call fcn.0048f0f0
add esp, 0x18
cmp dword [esp + 0x1c], 0x12
je 0x4a4937
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
test eax, eax
jle 0x4a4937
lea esi, [esp + 0x18]
call fcn.004a38a0
test eax, eax
jne 0x4a48b0
mov edx, esi
push edx
call ebp
mov eax, esi
push eax
call dword [0x597dc4]
jmp 0x4a48b0
call fcn.004c7770
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x4a48b0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
pop ebp
pop ebx
pop esi
call fcn.004a36b0
cmp byte [0x59817c], 0
je 0x4a4958
call fcn.004a3790
call fcn.004a3700
mov ecx, dword [esp + 0x270]
mov eax, dword [0x598184]
pop edi
xor ecx, esp
call fcn.00549750
add esp, 0x270
ret 8