Function at 0x404e88
Capabilities:
Enumerate services
Query service configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9e8
push ebx
push esi
push edi
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 4], 0x9999
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x94], 0
push 0x4607b0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0xb61490], eax
cmp dword [0xb61490], 0xffffffff
jne 0x404f03
mov dword [0xb61490], 0
jmp 0x404f3c
push 0x4607c0
mov eax, dword [0xb61490]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x45e058], eax
cmp dword [0x45e058], 0
jne 0x404f3c
mov eax, dword [0xb61490]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0xb61490], 0
mov dword [ebp - 0x3f8], 0
mov dword [ebp - 0x3e4], 0
mov dword [ebp - 0x3f0], 0
push bind
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0
jne 0x405035
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x404fa5
push str.Listing_Services_requires_a_Windows_NT_2000_or_later_workstation.__This_function_is_not_supported_on_Windows_9x_Me_workstations.
lea eax, [ebp - 0x3dc]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
jmp 0x405012
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6ba
jne 0x404fd7
lea eax, [ebp - 0x1c0]
push eax
push str.Either_your_account_has_insufficient_privileges_or_the_server___s__is_unavailable.
lea eax, [ebp - 0x3dc]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x405012
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, str._local_machine_
lea ecx, [ebp - 0x1c0]
xor edx, edx
cmp dword [ebp - 0x94], 0
setne dl
dec edx
sub ecx, eax
and edx, ecx
add edx, eax
push edx
push str.Error_SC_Manager__s::__d_
lea eax, [ebp - 0x3dc]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
cmp dword [ebp + 8], 0
je 0x405030
lea eax, [ebp - 0x3dc]
push eax
push str.ERROR_LIST_SERVICES___s__r_n
call fcn.00452380
add esp, 8
jmp 0x40560b
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0x3f8]
push eax
lea eax, [ebp - 0x3e4]
push eax
push 0
push 0
push 3
push 0x30
mov eax, dword [ebp - 0x3f4]
push eax
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
mov dword [ebp - 0x3e0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x40508d
cmp dword [ebp + 8], 0
je 0x40508d
push str._r_nError__moredata_not_returned_from_ESS_call_1_r_n
call fcn.00452380
add esp, 4
mov eax, dword [ebp - 0x3e4]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x3ec], eax
mov dword [ebp - 0x3f0], 0
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0x3f8]
push eax
lea eax, [ebp - 0x3e4]
push eax
mov eax, dword [ebp - 0x3e4]
push eax
mov eax, dword [ebp - 0x3ec]
push eax
push 3
push 0x30
mov eax, dword [ebp - 0x3f4]
push eax
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 0
jne 0x40510a
cmp dword [ebp + 8], 0
je 0x40510a
push str._r_nError__not_successful_on_ESS_call_2
call fcn.00452380
add esp, 4
mov dword [ebp - 0x3e8], 0
jmp 0x40511f
inc dword [ebp - 0x3e8]
mov eax, dword [ebp - 0x3f8]
cmp dword [ebp - 0x3e8], eax
jae 0x4055f1
push str.SISIDSSERVICE
mov eax, dword [ebp - 0x3e8]
shl eax, 2
lea eax, [eax + eax*8]
mov ecx, dword [ebp - 0x3ec]
mov eax, dword [eax + ecx]
push eax
call fcn.00452540
add esp, 8
test eax, eax
jne 0x405189
mov dword [0x46220c], 1
mov eax, dword [ebp - 0x3e8]
shl eax, 2
lea eax, [eax + eax*8]
mov ecx, dword [ebp - 0x3ec]
mov eax, dword [eax + ecx]
push eax
push str._r_nSERVICE:_s__critical__r_n
call fcn.00452380
add esp, 8
cmp dword [ebp + 8], 0
je 0x4051b6
mov eax, dword [ebp - 0x3e8]
shl eax, 2
lea eax, [eax + eax*8]
mov ecx, dword [ebp - 0x3ec]
mov eax, dword [eax + ecx]
push eax
push str._r_nSERVICE:_s_r_n
call fcn.00452380
add esp, 8
mov byte [ebp - 0x84], 0
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x3e8]
shl eax, 2
lea eax, [eax + eax*8]
mov ecx, dword [ebp - 0x3ec]
mov eax, dword [eax + ecx + 0xc]
push eax
call fcn.00403b35
add esp, 8
cmp dword [ebp + 8], 0
je 0x405201
lea eax, [ebp - 0x84]
push eax
push str.__State__s
call fcn.00452380
add esp, 8
mov byte [ebp - 0x84], 0
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x3e8]
shl eax, 2
lea eax, [eax + eax*8]
mov ecx, dword [ebp - 0x3ec]
mov eax, dword [eax + ecx + 8]
push eax
call fcn.004039e6
add esp, 8
cmp dword [ebp + 8], 0
je 0x40524c
lea eax, [ebp - 0x84]
push eax
push str.__Type__s
call fcn.00452380
add esp, 8
mov dword [ebp - 0x9c], 0xb615a0
cmp dword [ebp - 0x9c], 0
je 0x4055ec
push 1
mov eax, dword [ebp - 0x3e8]
shl eax, 2
lea eax, [eax + eax*8]
mov ecx, dword [ebp - 0x3ec]
mov eax, dword [eax + ecx]
push eax
mov eax, dword [ebp - 0x3f4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x4055ec
mov dword [ebp - 0x8c], 0x1e78
lea eax, [ebp - 0x8c]
push eax
push 0x1e78
mov eax, dword [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0x90]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x405532
mov byte [ebp - 0x84], 0
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax + 4]
push eax
call fcn.004038fc
add esp, 8
cmp dword [ebp + 8], 0
je 0x40530b
lea eax, [ebp - 0x84]
push eax
push str.__Startup__s
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x9c]
cmp dword [eax + 0xc], 0
je 0x405501
cmp dword [ebp + 8], 0
je 0x40533c
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax + 0xc]
push eax
push str._r_n__Path__s
call fcn.00452380
add esp, 8
push str.N_able
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax + 0xc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x40536a
mov dword [0x462204], 0x79
jmp 0x405479
push str.AVDEFENDER
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax + 0xc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x405398
mov dword [0x462204], 0x79
jmp 0x405479
push str.Trend_Mi
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax + 0xc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x4053c6
mov dword [0x462204], 0x79
jmp 0x405479
push str.BitDefender
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax + 0xc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x4053f4
mov dword [0x462204], 0x79
jmp 0x405479
push str.Endpoint_Security
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax + 0xc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x405422
mov dword [0x462204], 0x79
jmp 0x405479
push str.McAfee
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax + 0xc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x405450
mov dword [0x462204], 0x79
jmp 0x405479
push str.Panda
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax + 0xc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x405479
mov dword [0x462204], 0x79
push 0x460a14
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax + 0xc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x40549e
inc dword [0x462210]
push str.cyserver.exe
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax + 0xc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x405501
push str.Traps
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax + 0xc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x405501
push str.Palo_Alto_Networks
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax + 0xc]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x405501
inc dword [0x462214]
mov eax, dword [ebp - 0x9c]
cmp dword [eax + 0x1c], 0
je 0x405532
cmp dword [ebp + 8], 0
je 0x405532
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax + 0x1c]
push eax
push str._r_n__Start_Name__s
call fcn.00452380
add esp, 8
cmp dword [0x45e058], 0
je 0x4055df
mov dword [ebp - 0x8c], 0x5eb
lea eax, [ebp - 0x9e8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
lea eax, [ebp - 0x8c]
push eax
mov eax, dword [ebp - 0x8c]
push eax
lea eax, [ebp - 0x9e8]
push eax
push 1
mov eax, dword [ebp - 0x90]
push eax
call dword [0x45e058]
mov byte [ebp - 0x3fc], al
xor eax, eax
mov al, byte [ebp - 0x3fc]
test eax, eax
je 0x4055df
movsx eax, byte [ebp - 0x9e8]
test eax, eax
je 0x4055df
mov byte [ebp - 0x3fe], 0
cmp dword [ebp + 8], 0
je 0x4055df
lea eax, [ebp - 0x9e4]
push eax
push str._n_r__Comment___s_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x90]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x405119
mov eax, dword [ebp - 0x3ec]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x3f4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x405612
pop edi
pop esi
pop ebx
leave
ret