Function at 0x422b00
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c660
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
push eax
xor eax, eax
pop eax
je 0x422b26
invalid
mov edi, 0x4c05e4
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [ebp + 8]
repne scasb al, byte es:[edi]
mov eax, dword [esi + 8]
not ecx
dec ecx
push ecx
push 0x4c05e4
push eax
push 0
mov ecx, esi
call fcn.00414a80
test eax, eax
jne 0x422b64
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x2000
mov byte [ebp + 0xb], 0
mov dword [ebp - 0x14], 0
call fcn.004867df
add esp, 4
mov ebx, eax
mov dword [ebp - 0x10], ebx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
mov dword [ebp - 0x1c], eax
je 0x422d80
mov esi, dword [esi + 4]
test esi, esi
jne 0x422ba7
mov esi, 0x48e810
push 0xf01ff
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
mov dword [ebp - 0x14], eax
je 0x422d80
mov edi, 0x4c05e4
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [ebp + 0xc]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esi + 8]
push 0x4c05e4
push ecx
push eax
mov ecx, esi
call fcn.00414a80
test eax, eax
je 0x422dc5
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push edx
push 0x2000
push ebx
push eax
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x422d80
mov edi, dword [ebx + 0xc]
test edi, edi
je 0x422d80
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x422d80
mov cl, byte [esi]
push eax
mov byte [ebp - 0x3c], cl
lea ecx, [ebp - 0x3c]
call fcn.004017b0
mov edx, dword [0x492cd4]
lea ecx, [ebp - 0x3c]
push edx
push 0
push esi
call fcn.004094e0
mov al, byte [ebp + 0xb]
mov esi, dword [ebx + 0xc]
push 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
mov byte [ebp - 0x2c], al
call fcn.004017b0
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
lea ecx, [ebp - 0x2c]
push ebx
call fcn.00401850
test al, al
je 0x422c9c
mov edi, dword [ebp - 0x28]
mov ecx, ebx
mov edx, ecx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x2c]
call fcn.004099d0
mov eax, dword [ebp - 0x38]
xor esi, esi
cmp eax, esi
mov byte [ebp - 4], 1
mov bl, 0xff
je 0x422cd0
mov cl, byte [eax - 1]
test cl, cl
je 0x422cc6
cmp cl, bl
je 0x422cc6
mov eax, dword [ebp - 0x34]
push esi
push eax
lea ecx, [ebp - 0x3c]
call fcn.00401850
mov eax, dword [ebp - 0x38]
cmp eax, esi
je 0x422cd0
mov byte [eax - 1], bl
mov eax, dword [ebp - 0x38]
push eax
call fcn.0042b6a0
mov eax, dword [ebp - 0x28]
add esp, 4
cmp eax, esi
je 0x422d05
mov cl, byte [eax - 1]
test cl, cl
je 0x422cfb
cmp cl, bl
je 0x422cfb
mov ecx, dword [ebp - 0x24]
push esi
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00401850
mov eax, dword [ebp - 0x28]
cmp eax, esi
je 0x422d05
mov byte [eax - 1], bl
mov eax, dword [ebp - 0x28]
push eax
call fcn.0042b6a0
mov eax, dword [ebp - 0x38]
add esp, 4
cmp eax, esi
mov ecx, 0x48e810
je 0x422d1c
mov ecx, eax
mov eax, dword [ebp - 0x28]
cmp eax, esi
jne 0x422d28
mov eax, 0x48e810
push ecx
push eax
call fcn.0042c9f0
add esp, 8
test eax, eax
je 0x422d3a
mov byte [ebp + 0xb], 1
mov ecx, dword [ebp - 0x28]
cmp ecx, esi
je 0x422d5d
mov al, byte [ecx - 1]
test al, al
je 0x422d53
cmp al, bl
je 0x422d53
dec al
mov byte [ecx - 1], al
jmp 0x422d5d
dec ecx
push ecx
call fcn.00486808
add esp, 4
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x28], esi
cmp ecx, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
je 0x422d7d
mov al, byte [ecx - 1]
test al, al
je 0x422db9
cmp al, bl
je 0x422db9
dec al
mov byte [ecx - 1], al
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.00486808
mov eax, dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 4
test eax, eax
je 0x422d99
push eax
call esi
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x422da3
push eax
call esi
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + 0xb]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
dec ecx
push ecx
call fcn.00486808
add esp, 4
jmp 0x422d7d
mov byte [ebp + 0xb], 1
jmp 0x422d80