Function at 0x10048fb0
Capabilities:
Query service status
Set registry value
Stop service

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x340
cmp dword [ebp + 0x7c], 0
je 0x10048fd4
mov eax, 2
imul ecx, eax, 0
mov edx, dword [ebp + 0x7c]
movzx eax, word [edx + ecx]
test eax, eax
jne 0x10048fdb
xor eax, eax
jmp 0x100493bf
mov byte [ebp + 0x73], 0
mov byte [ebp + 0x72], 0
call fcn.100402c0
mov dword [ebp + 0x1c], 0x19
mov byte [ebp + 0x34], 1
push 0
push 0
lea ecx, [ebp + 0x1c]
push ecx
push 0x22e008
mov edx, dword [ebp + 0x7c]
push edx
call fcn.10048770
add esp, 0x14
test eax, eax
je 0x10049019
mov dword [ebp + 0x50], 1
jmp 0x10049020
mov dword [ebp + 0x50], 0
mov al, byte [ebp + 0x50]
mov byte [ebp + 0x72], al
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp + 0x68], eax
cmp dword [ebp + 0x68], 0
jne 0x1004904d
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp + 0x68], eax
cmp dword [ebp + 0x68], 0
je 0x1004937b
push 0xf01ff
mov ecx, dword [ebp + 0x7c]
push ecx
mov edx, dword [ebp + 0x68]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp + 0x64], eax
cmp dword [ebp + 0x64], 0
je 0x100490bb
lea eax, [ebp]
push eax
push 1
mov ecx, dword [ebp + 0x64]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea edx, [ebp]
push edx
mov eax, dword [ebp + 0x64]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x100490a4
cmp dword [ebp + 4], 1
jne 0x100490a4
mov dword [ebp + 0x4c], 1
jmp 0x100490ab
mov dword [ebp + 0x4c], 0
mov cl, byte [ebp + 0x4c]
mov byte [ebp + 0x73], cl
mov edx, dword [ebp + 0x64]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp + 0x68]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx ecx, byte [ebp + 0x73]
test ecx, ecx
jne 0x1004937b
lea edx, [ebp - 0x2cc]
push edx
push 0x40
lea eax, [ebp - 0x40]
push eax
push 0x1007d290
call fcn.1004ae20
push eax
call fcn.1004a5d0
lea ecx, [ebp + 0x5c]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0x2cc]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004937b
lea eax, [ebp + 0x60]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0x7c]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10049341
push 0
lea edx, [ebp + 0x60]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, dword [ebp + 0x7c]
push eax
mov ecx, dword [ebp + 0x5c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1004933f
mov dword [ebp + 0x38], 1
lea edx, [ebp - 0xc0]
push edx
push 0x40
lea eax, [ebp - 0x40]
push eax
push 0x1007d264
call fcn.1004ae20
push eax
call fcn.1004a5d0
push 4
lea ecx, [ebp + 0x38]
push ecx
push 4
push 0
lea edx, [ebp - 0xc0]
push edx
mov eax, dword [ebp + 0x60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10049312
mov ecx, 2
imul edx, ecx, 0
mov eax, 0x5c
mov word [ebp + edx - 0x2cc], ax
mov ecx, 2
shl ecx, 0
xor edx, edx
mov word [ebp + ecx - 0x2cc], dx
lea eax, [ebp - 0xc0]
push eax
push 0x40
lea ecx, [ebp - 0x40]
push ecx
push str.02____t846__0U
call fcn.1004ae20
push eax
call fcn.1004a5d0
lea edx, [ebp - 0xc0]
push edx
push 0x105
lea eax, [ebp - 0x2cc]
push eax
call fcn.10051f45
add esp, 0xc
push 0x10086b34
push 0x105
lea ecx, [ebp - 0x2cc]
push ecx
call fcn.10051f45
add esp, 0xc
lea edx, [ebp - 0xc0]
push edx
push 0x40
lea eax, [ebp - 0x40]
push eax
push 0x1007d290
call fcn.1004ae20
push eax
call fcn.1004a5d0
lea ecx, [ebp - 0xc0]
push ecx
push 0x105
lea edx, [ebp - 0x2cc]
push edx
call fcn.10051f45
add esp, 0xc
push 0x10086b34
push 0x105
lea eax, [ebp - 0x2cc]
push eax
call fcn.10051f45
add esp, 0xc
mov ecx, dword [ebp + 0x7c]
push ecx
push 0x105
lea edx, [ebp - 0x2cc]
push edx
call fcn.10051f45
add esp, 0xc
lea eax, [ebp - 0x2cc]
mov dword [ebp + 0x44], eax
lea ecx, [ebp - 0x2cc]
push ecx
call fcn.10055cec
add esp, 4
movzx edx, ax
shl edx, 1
mov word [ebp + 0x40], dx
movzx eax, word [ebp + 0x40]
add eax, 2
mov word [ebp + 0x42], ax
push 0
push 0x1007d23c
call fcn.1004ba60
mov dword [ebp + 0x58], eax
cmp dword [ebp + 0x58], 0
je 0x10049312
lea ecx, [ebp + 0x40]
push ecx
call dword [ebp + 0x58]
mov dword [ebp + 0x48], eax
cmp dword [ebp + 0x48], 0
jl 0x100492e0
mov dword [ebp + 0x54], 1
jmp 0x100492e7
mov dword [ebp + 0x54], 0
mov dl, byte [ebp + 0x54]
mov byte [ebp + 0x73], dl
movzx eax, byte [ebp + 0x73]
test eax, eax
je 0x100492ff
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10049312
mov ecx, dword [ebp + 0x48]
push ecx
call fcn.10047500
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x6c], eax
mov edx, dword [ebp + 0x60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x7c]
push eax
mov ecx, dword [ebp + 0x5c]
push ecx
call fcn.100484c0
add esp, 8
mov edx, dword [ebp + 0x6c]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1004935e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x60]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x6c], eax
mov edx, dword [ebp + 0x5c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
movzx ecx, byte [ebp + 0x73]
test ecx, ecx
jne 0x100493bb
movzx edx, byte [ebp + 0x72]
test edx, edx
je 0x100493bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3c], eax
mov byte [ebp + 0x34], 0
push 0
push 0
lea eax, [ebp + 0x1c]
push eax
push 0x22e008
mov ecx, dword [ebp + 0x7c]
push ecx
call fcn.10048770
add esp, 0x14
mov edx, dword [ebp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, byte [ebp + 0x73]
add ebp, 0x74
mov esp, ebp
pop ebp
ret 4