Function at 0x416c30
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2060
call fcn.0042bca0
mov eax, dword [0x447044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.FltLib.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FilterConnectCommunicationPort
push eax
mov dword [0x10814b0], eax
call esi
mov dword [0x10814a8], eax
mov eax, dword [0x10814b0]
push str.FilterSendMessage
push eax
call esi
xor ecx, ecx
push 0x1ffe
push ecx
lea edx, [ebp - 0x2022]
push edx
mov dword [0x10814ac], eax
mov dword [ebp - 0x2048], 0xffffffff
mov word [ebp - 0x2024], cx
call fcn.004272d0
add esp, 0xc
lea eax, [ebp - 0x2048]
push eax
push 0
push 0
push 0
push 0
push str.SMRPort
call dword [0x10814a8]
and eax, 0x80000000
cmp eax, 0x80000000
jne 0x416cdc
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041f53e
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x2048]
push ebx
push edi
push str.MiniSpy_shut_down
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
lea ecx, [ebp - 0x204c]
push ecx
push 0x1000
lea edx, [ebp - 0x2024]
push edx
push 0xb
push str.WPOFF
mov edi, eax
push esi
mov dword [ebp - 0x2050], edi
call dword [0x10814ac]
mov ecx, eax
and ecx, 0x80000000
cmp ecx, 0x80000000
jne 0x416df8
push 0
push 0
lea edx, [ebp - 0x2044]
push edx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov ecx, 8
mov esi, str.hudriver2.dll:
lea edi, [ebp - 0x24]
lea eax, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416d65
sub eax, edx
sar eax, 1
mov edx, eax
mov eax, dword [ebp - 0x2044]
lea esi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416d80
sub eax, esi
sar eax, 1
lea esi, [edx + eax]
lea esi, [esi + esi + 0x14]
push esi
call fcn.0041f79c
add esp, 4
mov ebx, eax
test esi, esi
je 0x416dbe
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, esi
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, dword [ebp - 0x2044]
push eax
lea ecx, [ebp - 0x24]
push ecx
push 0x434c24
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
test ebx, ebx
je 0x416de5
push ebx
call fcn.0041f762
add esp, 4
mov edx, dword [ebp - 0x2044]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [ebp - 0x2050]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x416e05
push edi
call esi
mov eax, dword [ebp - 0x2048]
cmp eax, 0xffffffff
je 0x416e13
push eax
call esi
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x416e63
push 0xf01ff
push str.WM7F
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x416e60
lea eax, [ebp - 0x2040]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call ebx
push edi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop ebx
xor ecx, ebp
mov al, 1
pop esi
call fcn.0041f53e
mov esp, ebp
pop ebp
ret