Function at 0x40ec30
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
test esi, esi
jne 0x40ec45
lea eax, [esi + 1]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x8414]
and eax, 0x100
or eax, 0x10
mov dword [esi + 0x8414], eax
mov eax, dword [esi + 0x8400]
sub eax, 2
je 0x40ec79
dec eax
je 0x40ec70
mov dword [ebp - 0xc], 2
jmp 0x40ec80
mov dword [ebp - 0xc], 4
jmp 0x40ec80
mov dword [ebp - 0xc], 3
cmp word [esi + 0x202], 0
lea eax, [esi + 0x202]
jne 0x40eca9
lea ecx, [esi + 2]
push ecx
push 0x4200a8
push 0xffffffffffffffff
push 0x100
push eax
call fcn.004149b0
add esp, 0x14
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], ebx
cmp dword [esi + 0x8408], ebx
je 0x40edce
mov ebx, dword [esi + 0x8404]
lea ecx, [esi + 2]
mov eax, ebx
call fcn.004018b0
test eax, eax
je 0x40eda3
mov edx, dword [esi + 0x8408]
lea eax, [edx + edx + 2]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x40ed21
push str.edit_service__
push 0x41fcbc
push 0xc00001fa
call fcn.004147fb
add eax, 0x40
push eax
call fcn.00402220
add esp, 0x10
mov eax, 5
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x8408]
lea edx, [ecx + ecx + 2]
push edx
push ebx
push edi
call fcn.00414290
add esp, 0xc
cmp dword [esi + 0x4040c], 0
mov eax, 0x4201bc
je 0x40ed46
xor eax, eax
mov edx, dword [ebp - 8]
lea ecx, [esi + 0x202]
push ecx
mov ecx, dword [esi + 0x8414]
push edx
mov edx, dword [esi + 0x704b0]
push edi
push eax
mov eax, dword [ebp - 0xc]
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x40ee38
cmp edi, ebx
je 0x40ed8e
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.00402080
push eax
push 0x4000020b
jmp 0x40ee1c
lea eax, [ebp - 4]
push eax
push ebx
call fcn.004015d0
add esp, 8
test eax, eax
jne 0x40ed16
cmp dword [esi + 0x8410], edi
mov edi, dword [ebp - 4]
je 0x40edda
mov ecx, dword [esi + 0x840c]
mov dword [ebp - 8], ecx
jmp 0x40edda
cmp byte [ebp + 8], bl
je 0x40edda
mov edi, str.LocalSystem
mov ebx, edi
mov eax, edi
call fcn.00401940
test eax, eax
je 0x40edf1
mov dword [ebp - 8], 0x4201bc
jmp 0x40ed36
push edi
call fcn.004019a0
add esp, 4
test eax, eax
je 0x40ed36
cmp edi, ebx
je 0x40ee16
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push 0x40000205
call fcn.004147fb
add eax, 0x40
push eax
call fcn.00402220
add esp, 0xc
mov eax, 5
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, ebx
je 0x40ee4c
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esi + 0x4040c], 0
je 0x40ee72
mov eax, dword [esi + 0x704b0]
mov ecx, dword [esi + 0x40408]
push eax
call fcn.0040cf90
add esp, 4
test eax, eax
jne 0x40ed16
cmp word [esi + 0x402], 0
lea eax, [esi + 0x402]
jne 0x40ee88
cmp byte [ebp + 8], 0
je 0x40ee9a
lea ecx, [esi + 2]
push ecx
mov ecx, dword [esi + 0x704b0]
call fcn.0040d6e0
add esp, 4
mov ecx, dword [esi + 0x704b0]
xor edx, edx
cmp dword [esi + 0x8400], 1
lea eax, [ebp - 0x10]
sete dl
push eax
push 3
push ecx
mov dword [ebp - 0x10], edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x40eee8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7c
je 0x40eee8
push 0
mov edi, eax
call fcn.00402080
push eax
lea edx, [esi + 2]
push edx
push 0x40000429
push 1
call fcn.004021b0
add esp, 0x14
cmp byte [esi], 0
jne 0x40ef27
mov eax, dword [ebp + 8]
push eax
mov ecx, esi
call fcn.00409b90
add esp, 4
test eax, eax
je 0x40ef20
push 0x4000021d
call fcn.004147fb
add eax, 0x40
push eax
call fcn.00402220
add esp, 8
mov eax, 6
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
call fcn.0040f850
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret