Function at 0x40142c
Capabilities:
Get system information on windows
Query service status

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x130
mov esi, esp
mov eax, 0x24
call fcn.004035e0
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov ecx, 0x14
mov dword [esi + 0xbc], eax
mov eax, ecx
mov dword [esi + 0xb8], ecx
call fcn.004035e0
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov ecx, 4
mov dword [esi + 0xb4], eax
mov eax, ecx
call fcn.004035e0
mov eax, esp
mov ecx, dword [esi + 0xb8]
mov dword [esi + 0xb0], eax
mov eax, ecx
call fcn.004035e0
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x5249af
mov ecx, dword [sym.imp.USER32.dll_GetMenuContextHelpId]
mov dword [esi + 0xac], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx], 0xfe990d
mov ecx, dword [sym.imp.USER32.dll_UnloadKeyboardLayout]
mov dword [esi + 0xa8], eax
call ecx
sub esp, 0x14
mov ecx, esp
lea edx, [esi + 0x118]
mov dword [ecx + 0x10], edx
mov dword [ecx + 0xc], 0x877
mov dword [ecx + 8], 0xce3
mov dword [ecx + 4], 0x769
mov dword [ecx], 0x75eeb4
mov ecx, dword [sym.imp.KERNEL32.dll_UnlockFileEx]
mov dword [esi + 0xa4], eax
call ecx
xor ecx, ecx
lea edx, [esi + 0xe0]
mov edi, dword [esi + 0xbc]
mov dword [esi + 0xa0], eax
mov dword [esi + 0x9c], edi
mov dword [esi + 0x98], edx
mov dword [esi + 0x94], ecx
jmp 0x401593
sub esp, 8
mov eax, esp
lea ecx, [esi + 0xc8]
mov dword [eax + 4], ecx
mov dword [eax], 0xb5a094
mov eax, dword [sym.imp.KERNEL32.dll_GetCommTimeouts]
call eax
mov dword [esi + 0x90], eax
xor eax, eax
xor ecx, ecx
mov edx, dword [esi + 0x8c]
sub edx, 7
mov dword [esi + 0x88], eax
mov dword [esi + 0x84], ecx
mov dword [esi + 0x80], edx
je 0x401751
jmp 0x401573
mov eax, dword [esi + 0x8c]
sub eax, 0x51
mov ecx, dword [esi + 0x84]
mov dword [esi + 0x7c], eax
mov dword [esi + 0x78], ecx
je 0x4016d1
jmp 0x4017fc
mov eax, dword [esi + 0x94]
sub esp, 8
mov ecx, esp
lea edx, [esi + 0xf8]
mov dword [ecx + 4], edx
mov dword [ecx], 0xbab275
mov ecx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [esi + 0x8c], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x937
mov ecx, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [esi + 0x74], eax
call ecx
xor ecx, ecx
mov edx, 0x14
sub esp, 0xc
mov edi, dword [esi + 0x98]
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x14
mov dword [esi + 0x70], eax
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x68], edx
call fcn.00403610
add esp, 0xc
sub esp, 0xc
mov eax, esp
mov ecx, dword [esi + 0x98]
mov dword [eax + 8], ecx
mov dword [eax + 4], 0xda5
mov dword [eax], 0x6b7282
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx], 0xe4d16
mov ecx, dword [sym.imp.USER32.dll_BringWindowToTop]
mov dword [esi + 0x64], eax
call ecx
xor ecx, ecx
mov dword [esi + 0x60], eax
mov dword [esi + 0x5c], ecx
mov eax, dword [esi + 0x5c]
mov ecx, 0x88888889
mov dword [esi + 0x58], eax
mul ecx
shr edx, 3
imul eax, edx, 0xf
mov ecx, dword [esi + 0x58]
sub ecx, eax
mov eax, ecx
sub eax, 0xa
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], eax
je 0x401690
jmp 0x40166c
mov eax, dword [esi + 0x54]
sub eax, 6
mov dword [esi + 0x4c], eax
jne 0x4016a5
jmp 0x401679
sub esp, 4
mov eax, esp
mov dword [eax], 0x1439bf
mov eax, dword [sym.imp.USER32.dll_IsIconic]
call eax
mov dword [esi + 0x48], eax
jmp 0x401690
sub esp, 4
mov eax, esp
mov dword [eax], 0xca2543
mov eax, dword [sym.imp.USER32.dll_DestroyMenu]
call eax
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x58]
add eax, 1
cmp eax, 0x1cc
sete cl
mov dword [esi + 0x40], eax
mov byte [esi + 0x3f], cl
mov al, byte [esi + 0x3f]
test al, 1
mov ecx, dword [esi + 0x40]
mov dword [esi + 0x5c], ecx
jne 0x40152b
jmp 0x401645
sub esp, 0xc
mov eax, esp
lea ecx, [esi + 0xc0]
mov dword [eax + 4], ecx
mov dword [eax + 8], 0xff1
mov dword [eax], 0x4a03e7
mov eax, dword [sym.imp.GDI32.dll_DPtoLP]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx], 0xb85
mov ecx, dword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov dword [esi + 0x38], eax
call ecx
xor ecx, ecx
mov edx, 0x24
sub esp, 0xc
mov edi, dword [esi + 0x9c]
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x24
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], ecx
mov dword [esi + 0x2c], edx
call fcn.00403610
add esp, 0xc
sub esp, 4
mov eax, esp
mov ecx, dword [esi + 0xbc]
mov dword [eax], ecx
mov eax, dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call eax
sub esp, 8
mov eax, esp
mov dword [eax + 4], 0x874
mov dword [eax], 0x774e9a
mov eax, dword [sym.imp.KERNEL32.dll_SetConsoleMode]
call eax
xor ecx, ecx
mov edx, 0x14
sub esp, 0xc
mov edi, dword [esi + 0xb4]
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x14
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], ecx
mov dword [esi + 0x20], edx
call fcn.00403610
add esp, 0xc
mov eax, dword [esi + 0xb0]
mov dword [eax], 0x4b1
sub esp, 0x14
mov ecx, esp
mov dword [ecx + 0x10], eax
mov edx, dword [esi + 0xb4]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], 0x4b0
mov dword [ecx + 4], 0xc55
mov dword [ecx], 0x5c91b1
mov ecx, dword [sym.imp.ADVAPI32.dll_QueryServiceObjectSecurity]
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0x231
mov dword [ecx], 0x62b40a
mov ecx, dword [sym.imp.GDI32.dll_GetCurrentObject]
mov dword [esi + 0x1c], eax
call ecx
mov dword [esi + 0x18], eax
jmp 0x40188d
mov eax, dword [esi + 0x78]
xor ecx, ecx
mov edx, 0x14
sub esp, 0xc
mov edi, dword [esi + 0xac]
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x14
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], ecx
mov dword [esi + 0xc], edx
call fcn.00403610
add esp, 0xc
sub esp, 0xc
mov eax, esp
mov ecx, dword [esi + 0xac]
mov dword [eax + 8], ecx
mov dword [eax + 4], 0x5bb
mov dword [eax], 0xba2c6f
mov eax, dword [sym.imp.ADVAPI32.dll_SetServiceObjectSecurity]
call eax
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0x641
mov dword [ecx], 0x29d098
mov ecx, dword [sym.imp.USER32.dll_GetAncestor]
mov dword [esi + 8], eax
call ecx
mov ecx, dword [esi + 0x14]
add ecx, 1
cmp ecx, 0xa
mov dword [esi + 4], eax
mov dword [esi + 0x78], ecx
jne 0x4017fc
sub esp, 0xc
mov eax, esp
mov dword [eax + 8], 0x5f
mov dword [eax + 4], 0xfd3469
mov dword [eax], 0x18a20b
mov eax, dword [sym.imp.USER32.dll_InvalidateRgn]
call eax
mov dword [esi], eax
mov eax, dword [esi + 0x8c]
add eax, 1
cmp eax, 0x3c
mov dword [esi + 0x94], eax
jne 0x401593
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret