Function at 0x545180
Capabilities:
Check if file exists
Enumerate services

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f8d5c
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0xe0], 0
jne 0x5451c0
xor eax, eax
jmp 0x545748
push str.Resetting_Windows_protected_services...
push 0xffffffffffffffff
call fcn.0057b610
push 0
push 1
mov ecx, edi
call fcn.005494d0
test eax, eax
je 0x5451e3
or eax, 0xffffffff
jmp 0x545748
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
call fcn.005d6aa0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
call fcn.005d6aa0
xorps xmm0, xmm0
movlpd qword [ebp - 0xc0], xmm0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push SysReAllocString
push 0
push 0
mov byte [ebp - 4], 3
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0xc4], esi
test esi, esi
je 0x5452c4
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 3
push 0x30
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x5452bd
mov esi, dword [ebp - 0x20]
push esi
call fcn.0041e7cf
add esp, 4
mov dword [ebp - 0xbc], esi
mov ebx, eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc0], ebx
push 0
push 0
push eax
lea eax, [ebp - 0x20]
push eax
push esi
mov esi, dword [ebp - 0xc4]
push ebx
push 3
push 0x30
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
jne 0x5452c4
xor ebx, ebx
jmp 0x54571c
xorps xmm0, xmm0
mov dword [ebp - 0x78], 0
lea ecx, [ebp - 0x80]
movq qword [ebp - 0x80], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x30]
movq qword [ebp - 0x30], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x3c]
movq qword [ebp - 0x3c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x58]
movq qword [ebp - 0x58], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x74]
movq qword [ebp - 0x74], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x4c]
movq qword [ebp - 0x4c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x60], 0
lea ecx, [ebp - 0x68]
movq qword [ebp - 0x68], xmm0
call fcn.005dc5e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov byte [ebp - 4], 0xa
mov ecx, dword [edi + 0xe0]
push str._svcstates.ini
call fcn.005dc190
push eax
lea ecx, [ebp - 0x3c]
call fcn.005dc200
movsd xmm0, qword [edi]
sub esp, 0xc
mulsd xmm0, qword [0x6edb08]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.WIN.
call fcn.005e9c20
push edx
push eax
lea ecx, [ebp - 0x58]
call fcn.005db580
mov ecx, eax
call fcn.005da510
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x545407
lea ecx, [ebp - 0x3c]
call fcn.005dc190
mov ecx, eax
call fcn.005e0e70
push ecx
mov ecx, dword [edi + 0x20]
mov esi, eax
mov ebx, edx
call fcn.005c65c0
cmp esi, eax
jne 0x545407
test ebx, ebx
je 0x545418
push dword [edi + 0x20]
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
call fcn.005c65f0
push 0
push 1
mov ecx, edi
call fcn.005494d0
test eax, eax
je 0x54542f
or ebx, 0xffffffff
jmp 0x5456da
push 0x38
xor ebx, ebx
lea eax, [ebp - 0xb8]
push ebx
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xb8]
call fcn.005dd680
mov byte [ebp - 4], 0xb
mov dword [ebp - 0xc8], ebx
cmp dword [ebp - 0x1c], ebx
jbe 0x545670
mov esi, dword [ebp - 0xc0]
push 0
push 1
mov ecx, edi
call fcn.005494d0
test eax, eax
jne 0x545670
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [esi]
lea ecx, [ebp - 0x80]
push str.HKLMSYSTEMCurrentControlSetServices_
call fcn.005dc200
lea eax, [ebp - 0x30]
push eax
push str.ServiceDll
lea ecx, [ebp - 0x80]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x18]
call fcn.005d65d0
test al, al
je 0x5454c6
lea ecx, [ebp - 0x30]
call fcn.005dbeb0
test al, al
je 0x545506
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Parameters
push dword [esi]
lea ecx, [ebp - 0x68]
push str.HKLMSYSTEMCurrentControlSetServices_
call fcn.005dc200
lea eax, [ebp - 0x30]
push eax
push str.ServiceDll
lea ecx, [ebp - 0x68]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x24]
call fcn.005d65d0
lea ecx, [ebp - 0x30]
call fcn.005dbeb0
test al, al
je 0x54552a
mov eax, ecx
lea ecx, [ebp - 0x18]
push eax
push str.ImagePath
call fcn.005d6740
test al, al
je 0x545657
lea ecx, [ebp - 0x30]
call fcn.005dbeb0
test al, al
jne 0x545657
push 3
lea edx, [edi + 0x3c]
call fcn.005e88c0
lea ecx, [ebp - 0x30]
call fcn.005dc190
push eax
push 0
call dword [sym.imp.sfc.dll_SfcIsFileProtected]
test eax, eax
je 0x545657
test byte [ebp + 8], 1
je 0x545657
lea eax, [ebp - 0x5c]
push eax
push str.Start
lea ecx, [ebp - 0x18]
call fcn.005d66b0
test al, al
je 0x545657
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..STT
push dword [esi]
lea ecx, [ebp - 0x4c]
call fcn.005dc200
push 6
lea ecx, [ebp - 0x4c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x58]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xb8]
call fcn.005dd290
mov dword [ebp - 0xcc], eax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x40]
push eax
push str.DelayedAutostart
call fcn.005d66b0
test al, al
jne 0x5455e4
mov dword [ebp - 0x40], 0xffffffff
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str..DAS
push dword [esi]
lea ecx, [ebp - 0x4c]
call fcn.005dc200
push 0xffffffffffffffff
lea ecx, [ebp - 0x4c]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x58]
call fcn.005dc190
push eax
lea ecx, [ebp - 0xb8]
call fcn.005dd290
mov ecx, dword [ebp - 0xcc]
cmp ecx, 6
jae 0x545636
cmp ecx, dword [ebp - 0x5c]
jne 0x545640
cmp eax, 0xffffffff
je 0x545657
cmp eax, dword [ebp - 0x40]
je 0x545657
movsd xmm3, qword [edi]
mov edx, ecx
mov ecx, dword [esi]
push eax
call fcn.0058f7a0
xor ecx, ecx
test al, al
setne cl
add ebx, ecx
mov eax, dword [ebp - 0xc8]
add esi, 0x2c
inc eax
mov dword [ebp - 0xc8], eax
cmp eax, dword [ebp - 0x1c]
jb 0x545470
push 2
lea ecx, [ebp - 0x3c]
call fcn.005dc190
push eax
call fcn.005771e0
test dword [ebp + 8], 4
je 0x5456cf
test ebx, ebx
jne 0x545698
xor eax, eax
mov esi, str.Reset_Windows_services_result:_No_hijacked_services_found.
xor ecx, ecx
jmp 0x5456c3
cmp ebx, 1
jne 0x5456a8
xor eax, eax
mov esi, str.Reset_Windows_services_result:_One_hijacked_service_repaired.
xor ecx, ecx
jmp 0x5456c3
push ebx
lea ecx, [ebp - 0x74]
call fcn.005db320
lea ecx, [ebp - 0x74]
mov esi, str.Reset_Windows_services_result:
call fcn.005dc190
mov ecx, str._hijacked_services_repaired.
push 0
push ecx
push eax
push esi
mov ecx, edi
call fcn.0057b7e0
lea ecx, [ebp - 0xb8]
call fcn.005dd5d0
lea ecx, [ebp - 0x68]
call fcn.005dc430
lea ecx, [ebp - 0x4c]
call fcn.005dc430
lea ecx, [ebp - 0x74]
call fcn.005dc430
lea ecx, [ebp - 0x58]
call fcn.005dc430
lea ecx, [ebp - 0x3c]
call fcn.005dc430
lea ecx, [ebp - 0x30]
call fcn.005dc430
lea ecx, [ebp - 0x80]
call fcn.005dc430
mov esi, dword [ebp - 0xc4]
test esi, esi
je 0x545723
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0xc0]
test eax, eax
je 0x545736
push eax
call fcn.0041e1c3
add esp, 4
lea ecx, [ebp - 0x24]
call fcn.005d69e0
lea ecx, [ebp - 0x18]
call fcn.005d69e0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4