Function at 0x4c5a46
Capabilities:
Query service configuration
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5132f4
mov eax, dword fs:[0]
push eax
mov eax, 0x3168
call fcn.004f0e50
mov eax, dword [0xaba010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x30f0], ebx
mov dword [ebp - 0x30d8], ecx
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
cmp esi, edi
je 0x4c5a9f
mov ecx, esi
call fcn.004488ba
add esi, 0x30
cmp esi, edi
jne 0x4c5a8f
mov esi, dword [ebx]
push SysReAllocString
push 0
push 0
mov dword [ebx + 4], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, dword [ebp - 0x30d8]
xor esi, esi
mov dword [ebp - 0x3104], eax
mov dword [ebp - 0x310c], esi
mov ecx, dword [ebx + 4]
mov edx, dword [ebx]
sub ecx, edx
sar ecx, 2
test ecx, ecx
je 0x4c5d7f
or edi, 0xffffffff
test eax, eax
je 0x4c5d7f
mov ecx, dword [edx + esi*4]
sub ecx, 0x10
call fcn.004098e7
lea esi, [eax + 0x10]
mov dword [ebp - 0x30e0], esi
and dword [ebp - 4], 0
lea eax, [ebp - 0x30e0]
cmp dword [ebp + 8], 2
push eax
jne 0x4c5b38
mov ecx, 0xd5ae30
call fcn.0041aca5
test eax, eax
je 0x4c5b93
mov dword [ebp - 4], edi
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4c5d5a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4c5d5a
mov ecx, 0xd5ae38
call fcn.0041aca5
test eax, eax
jne 0x4c5b15
cmp dword [ebp + 8], eax
jne 0x4c5b93
push ecx
lea ebx, [esi - 0x10]
mov edi, esp
mov ecx, ebx
mov dword [ebp - 0x30dc], edi
call fcn.004098e7
add eax, 0x10
xor ecx, ecx
mov dword [edi], eax
call fcn.004c58e0
pop ecx
test eax, eax
je 0x4c5b8d
or edi, 0xffffffff
mov dword [ebp - 4], edi
mov eax, edi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x4c5d54
mov ecx, dword [ebx]
push ebx
jmp 0x4c5d4f
mov ebx, dword [ebp - 0x30d8]
xor eax, eax
mov dword [ebp - 0x30fc], eax
mov dword [ebp - 0x30f8], eax
mov dword [ebp - 0x30f4], eax
inc eax
lea ecx, [ebp - 0x3114]
push str.SYSTEMCurrentControlSetServices_
mov byte [ebp - 4], al
call fcn.004094e6
lea ecx, [ebp - 0x30e0]
mov byte [ebp - 4], 2
push ecx
mov edx, eax
lea ecx, [ebp - 0x3110]
call fcn.0040a740
mov dword [esp], 0x20019
lea ecx, [ebp - 0x30fc]
push dword [eax]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00407e8e
mov edx, dword [ebp - 0x3110]
mov edi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4c5c0c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
inc eax
mov byte [ebp - 4], al
or eax, 0xffffffff
mov edx, dword [ebp - 0x3114]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4c5c30
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x4c5c47
lea ecx, [ebp - 0x30fc]
call fcn.00408049
or edi, 0xffffffff
jmp 0x4c5b15
or edi, 0xffffffff
push edi
push ecx
mov ecx, esp
push str.Type
call fcn.004094e6
lea ecx, [ebp - 0x30fc]
call fcn.0041480f
push ecx
mov ecx, esp
mov ebx, eax
push str.ImagePath
call fcn.004094e6
lea eax, [ebp - 0x30e8]
push eax
lea ecx, [ebp - 0x30fc]
call fcn.00414568
push edi
push ecx
mov ecx, esp
mov byte [ebp - 4], 3
push str.Start
call fcn.004094e6
lea ecx, [ebp - 0x30fc]
call fcn.0041480f
push 0
push ecx
mov ecx, esp
mov esi, eax
push str.WOW64
call fcn.004094e6
lea ecx, [ebp - 0x30fc]
call fcn.0041480f
mov dword [ebp - 0x30dc], eax
lea eax, [ebp - 0x30e0]
push dword [ebp - 0x30f0]
push eax
push ecx
and ebx, 3
je 0x4c5ce3
lea eax, [ebp - 0x3158]
mov ecx, 0xd5ae38
jmp 0x4c5cee
lea eax, [ebp - 0x3160]
mov ecx, 0xd5ae30
push eax
call fcn.0044fd66
cmp dword [ebp + 8], 2
mov eax, dword [ebp - 0x30e8]
jne 0x4c5da2
test ebx, ebx
jne 0x4c5db3
xor ecx, ecx
lea edx, [eax - 0x10]
inc ecx
mov byte [ebp - 4], cl
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4c5d29
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x30fc]
call fcn.00408049
mov dword [ebp - 4], edi
mov eax, edi
mov edx, dword [ebp - 0x30e0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4c5d54
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x30d8]
mov eax, dword [ebx + 4]
mov esi, dword [ebp - 0x310c]
mov edx, dword [ebx]
inc esi
sub eax, edx
mov dword [ebp - 0x310c], esi
sar eax, 2
cmp esi, eax
mov eax, dword [ebp - 0x3104]
jb 0x4c5ada
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004efcea
mov esp, ebp
pop ebp
ret
test ebx, ebx
jne 0x4c5d0c
cmp dword [eax - 0xc], ebx
je 0x4c5d0c
cmp dword [ebp + 8], 0
jne 0x4c5dee
cmp esi, 2
je 0x4c5dee
cmp esi, 3
jne 0x4c5d0c
push ecx
mov ecx, esp
push str.AnVirDisabled
call fcn.004094e6
lea ecx, [ebp - 0x30fc]
call fcn.0041484f
test eax, eax
jne 0x4c5dee
mov eax, dword [ebp - 0x30e8]
jmp 0x4c5d0c
mov esi, dword [ebp - 0x30e0]
push 5
push esi
push dword [ebp - 0x3104]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
mov dword [ebp - 0x30e4], edi
test edi, edi
jne 0x4c5e64
push dword [ebp - 0x30f0]
lea eax, [ebp - 0x30e0]
push eax
push ecx
lea eax, [ebp - 0x3168]
mov ecx, 0xd5ae30
push eax
call fcn.0044fd66
push dword [ebp - 0x30f0]
lea eax, [ebp - 0x30e0]
push eax
push ecx
lea eax, [ebp - 0x3170]
mov ecx, 0xd5ae38
push eax
call fcn.0044fd66
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov edx, dword [ebp - 0x30e8]
add edx, 0xfffffff0
or edi, 0xffffffff
jmp 0x4c5d15
push 0x2000
lea eax, [ebp - 0x2014]
push 0
push eax
call fcn.004f1a90
and dword [ebp - 0x30ec], 0
lea eax, [ebp - 0x30ec]
add esp, 0xc
push eax
push 0x2000
lea eax, [ebp - 0x2014]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x4c63b3
cmp dword [ebp - 0x2008], 0
je 0x4c63b3
mov eax, dword [ebp - 0x1ff4]
test eax, eax
je 0x4c63b3
cmp byte [eax], 0
je 0x4c63b3
lea ecx, [ebp - 0x3150]
call fcn.004c49e0
mov byte [ebp - 4], 4
mov edi, dword [ebp - 0x2008]
test edi, edi
jne 0x4c5ee4
xor eax, eax
jmp 0x4c5eeb
push edi
call fcn.004f5d90
pop ecx
push eax
push edi
lea ecx, [ebp - 0x3140]
call fcn.0040942f
test ebx, ebx
jne 0x4c615c
push dword [ebp - 0x2008]
lea ecx, [ebp - 0x3100]
call fcn.004094e6
mov byte [ebp - 4], 5
cmp dword [0xd5b274], ebx
jne 0x4c5f65
xor eax, eax
mov dword [ebp - 0x30d4], 0x94
inc eax
push 0x90
mov dword [0xd5b274], eax
lea eax, [ebp - 0x30d0]
push ebx
push eax
call fcn.004f1a90
add esp, 0xc
lea eax, [ebp - 0x30d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
imul eax, dword [ebp - 0x30d0], 0xa
add eax, dword [ebp - 0x30cc]
mov dword [0xd5b270], eax
jmp 0x4c5f6a
mov eax, dword [0xd5b270]
cmp eax, 0x3c
jl 0x4c5feb
cmp dword [ebp - 0x30dc], 0
je 0x4c5feb
lea ecx, [ebp - 0x311c]
call fcn.0042391c
mov edi, eax
lea ecx, [ebp - 0x3118]
mov byte [ebp - 4], 6
call fcn.00423842
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x3100]
push dword [edi]
push dword [eax]
call fcn.00413698
mov byte [ebp - 4], 6
or eax, 0xffffffff
mov edx, dword [ebp - 0x3118]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4c5fc9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
or eax, 0xffffffff
mov edx, dword [ebp - 0x311c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4c5feb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x3100]
mov edi, esp
mov dword [ebp - 0x30dc], edi
lea ecx, [ecx - 0x10]
call fcn.004098e7
add eax, 0x10
lea ecx, [ebp - 0x3120]
xor edx, edx
mov dword [edi], eax
call fcn.00419c70
pop ecx
mov byte [ebp - 4], 8
mov edx, dword [eax]
mov edi, dword [ebp - 0x313c]
add edi, 0xfffffff0
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x4c6078
lea ebx, [edi + 0xc]
cmp dword [ebx], 0
jl 0x4c6069
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x4c6069
call fcn.004098e7
mov dword [ebp - 0x30dc], eax
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x4c605e
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x30dc]
add eax, 0x10
mov dword [ebp - 0x313c], eax
jmp 0x4c6078
push dword [edx - 0xc]
lea ecx, [ebp - 0x313c]
push edx
call fcn.0040942f
mov byte [ebp - 4], 5
or eax, 0xffffffff
mov edx, dword [ebp - 0x3120]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4c609a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp + 8], 0
jne 0x4c613a
push ecx
lea ebx, [esi - 0x10]
mov edi, esp
mov ecx, ebx
mov dword [ebp - 0x30dc], edi
call fcn.004098e7
mov ecx, dword [ebp - 0x313c]
add eax, 0x10
mov dword [edi], eax
call fcn.004c58e0
pop ecx
test eax, eax
je 0x4c613a
push dword [ebp - 0x30e4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov byte [ebp - 4], 4
or edi, 0xffffffff
mov edx, dword [ebp - 0x3100]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4c60fc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x3150]
call fcn.004488ba
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov eax, edi
mov edx, dword [ebp - 0x30e8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4c612a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x30fc]
call fcn.00408049
jmp 0x4c5b72
mov byte [ebp - 4], 4
or eax, 0xffffffff
mov edx, dword [ebp - 0x3100]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4c615c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x3038]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x30ec]
push eax
push 0x24
lea eax, [ebp - 0x3038]
push eax
push 0
push dword [ebp - 0x30e4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov edi, dword [ebp - 0x3150]
lea ebx, [esi - 0x10]
add edi, 0xfffffff0
mov dword [ebp - 0x30dc], ebx
cmp ebx, edi
je 0x4c61e9
lea ebx, [edi + 0xc]
cmp dword [ebx], 0
jl 0x4c61d4
lea ecx, [esi - 0x10]
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x4c61d4
call fcn.004098e7
mov esi, eax
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x4c61c9
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
lea eax, [esi + 0x10]
mov dword [ebp - 0x3150], eax
jmp 0x4c61e3
push dword [esi - 0xc]
lea ecx, [ebp - 0x3150]
push esi
call fcn.0040942f
mov ebx, dword [ebp - 0x30dc]
mov eax, dword [ebp - 0x2014]
mov esi, dword [ebp - 0x1ff4]
mov dword [ebp - 0x314c], eax
mov eax, dword [ebp - 0x2010]
mov dword [ebp - 0x3148], eax
mov eax, dword [ebp - 0x301c]
mov dword [ebp - 0x3124], eax
mov eax, dword [ebp - 0x3034]
mov dword [ebp - 0x3128], eax
test esi, esi
jne 0x4c6227
xor eax, eax
jmp 0x4c622e
push esi
call fcn.004f5d90
pop ecx
push eax
push esi
lea ecx, [ebp - 0x3138]
call fcn.0040942f
mov esi, dword [ebp - 0x2004]
test esi, esi
jne 0x4c6249
xor eax, eax
jmp 0x4c6250
push esi
call fcn.004f5d90
pop ecx
push eax
push esi
lea ecx, [ebp - 0x312c]
call fcn.0040942f
lea eax, [ebp - 0x15]
push eax
push dword [ebp - 0x1ffc]
lea ecx, [ebp - 0x3150]
push dword [ebp - 0x3104]
call fcn.004c4fc5
mov esi, 0x1000
lea eax, [ebp - 0x3014]
push esi
push 0
push eax
call fcn.004f1a90
add esp, 0xc
lea eax, [ebp - 0x30ec]
push eax
push esi
mov esi, dword [ebp - 0x30e4]
lea eax, [ebp - 0x3014]
push eax
xor eax, eax
inc eax
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfig2A]
test eax, eax
je 0x4c62e5
cmp dword [ebp - 0x30ec], 0
je 0x4c62e5
mov esi, dword [ebp - 0x3014]
test esi, esi
je 0x4c62df
cmp byte [esi], 0
je 0x4c62df
push esi
call fcn.004f5d90
pop ecx
push eax
push esi
lea ecx, [ebp - 0x3134]
call fcn.0040942f
mov esi, dword [ebp - 0x30e4]
cmp dword [0xd5b274], 0
jne 0x4c6337
xor eax, eax
mov dword [ebp - 0x30d4], 0x94
inc eax
push 0x90
mov dword [0xd5b274], eax
lea eax, [ebp - 0x30d0]
push 0
push eax
call fcn.004f1a90
add esp, 0xc
lea eax, [ebp - 0x30d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
imul eax, dword [ebp - 0x30d0], 0xa
add eax, dword [ebp - 0x30cc]
mov dword [0xd5b270], eax
jmp 0x4c633c
mov eax, dword [0xd5b270]
cmp eax, 0x3c
jl 0x4c6387
cmp dword [ebp - 0x3148], 2
jne 0x4c6387
and dword [ebp - 0x3108], 0
lea eax, [ebp - 0x30ec]
push eax
push 4
lea eax, [ebp - 0x3108]
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfig2A]
test eax, eax
je 0x4c6387
mov eax, dword [ebp - 0x3144]
cmp dword [ebp - 0x3108], 0
push 1
pop ecx
cmovne eax, ecx
mov dword [ebp - 0x3144], eax
mov ecx, dword [ebp - 0x30f0]
lea eax, [ebp - 0x3150]
push eax
call fcn.004c65d4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [ebp - 0x3150]
call fcn.004488ba
or edi, 0xffffffff
jmp 0x4c6107
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
or edi, 0xffffffff
inc eax
mov byte [ebp - 4], al
mov eax, edi
mov edx, dword [ebp - 0x30e8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4c63e0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x30fc]
call fcn.00408049
mov dword [ebp - 4], edi
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4c5d54
mov ecx, dword [esi]
push esi
jmp 0x4c5d4f