Function at 0x439dd0
Capabilities:
Enumerate services
Query service configuration
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x25468
call fcn.0046b3f0
push edi
push 4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x439dfa
xor eax, eax
jmp 0x43a099
mov dword [ebp - 8], 0x24000
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x24020]
push ecx
push 1
push 0x30
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x439e5b
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x43a099
mov dword [ebp - 4], 0
jmp 0x439e6d
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x18]
jae 0x43a08d
push 0x35
mov eax, dword [ebp - 4]
imul eax, eax, 0x24
mov ecx, dword [ebp + eax - 0x24020]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x24424], eax
cmp dword [ebp - 0x24424], 0
jne 0x439ea4
jmp 0x439e64
mov al, byte [0x4978df]
mov byte [ebp - 0x24828], al
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x24827]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x4978e0]
mov byte [ebp - 0x25428], cl
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x25427]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0x4978e1]
mov byte [ebp - 0x24420], dl
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x2441f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x4978e2]
mov byte [ebp - 0x24c28], al
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x24c27]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x4978e3]
mov byte [ebp - 0x25028], cl
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x25027]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x24828]
mov dword [ebp - 0x2545c], edx
lea eax, [ebp - 0x24420]
mov dword [ebp - 0x25450], eax
lea ecx, [ebp - 0x25428]
mov dword [ebp - 0x25458], ecx
lea edx, [ebp - 0x24c28]
mov dword [ebp - 0x2544c], edx
lea eax, [ebp - 0x25028]
mov dword [ebp - 0x25448], eax
lea ecx, [ebp - 0x10]
push ecx
push 0x1424
lea edx, [ebp - 0x25468]
push edx
mov eax, dword [ebp - 0x24424]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x439fa7
mov ecx, dword [ebp - 0x24424]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x439e64
lea edx, [ebp - 0x25444]
push edx
mov eax, dword [ebp - 0x24424]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x25440], 4
je 0x439fd6
mov ecx, dword [ebp - 0x24424]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x439e64
mov edx, dword [ebp + 8]
push edx
call fcn.0046b430
add esp, 4
push eax
mov eax, dword [ebp - 0x2545c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0046dee1
add esp, 0xc
test eax, eax
je 0x43a00c
mov edx, dword [ebp - 0x24424]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x439e64
lea eax, [ebp - 0x25444]
push eax
push 1
mov ecx, dword [ebp - 0x24424]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea edx, [ebp - 0x25444]
push edx
mov eax, dword [ebp - 0x24424]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x43a054
cmp dword [ebp - 0x25440], 3
jne 0x43a050
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43a052
jmp 0x43a054
jmp 0x43a022
cmp dword [ebp - 0x25440], 1
je 0x43a06f
mov ecx, dword [ebp - 0x24424]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x439e64
mov edx, dword [ebp - 0x24424]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x43a099
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret