Function at 0x415f00
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2060
call fcn.0042b0f0
mov eax, dword [0x446044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.FltLib.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FilterConnectCommunicationPort
push eax
mov dword [0xc97510], eax
call esi
mov dword [0xc97508], eax
mov eax, dword [0xc97510]
push str.FilterSendMessage
push eax
call esi
xor ecx, ecx
push 0x1ffe
push ecx
lea edx, [ebp - 0x2022]
push edx
mov dword [0xc9750c], eax
mov dword [ebp - 0x2048], 0xffffffff
mov word [ebp - 0x2024], cx
call fcn.00426670
add esp, 0xc
lea eax, [ebp - 0x2048]
push eax
push 0
push 0
push 0
push 0
push str.SMRPort
call dword [0xc97508]
and eax, 0x80000000
cmp eax, 0x80000000
jne 0x415fac
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e7be
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x2048]
push ebx
push edi
push str.MiniSpy_shut_down
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
lea ecx, [ebp - 0x204c]
push ecx
push 0x1000
lea edx, [ebp - 0x2024]
push edx
push 0xb
push str.WPOFF
mov edi, eax
push esi
mov dword [ebp - 0x2050], edi
call dword [0xc9750c]
mov ecx, eax
and ecx, 0x80000000
cmp ecx, 0x80000000
jne 0x4160c8
push 0
push 0
lea edx, [ebp - 0x2044]
push edx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov ecx, 8
mov esi, str.hudriver2.dll:
lea edi, [ebp - 0x24]
lea eax, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416035
sub eax, edx
sar eax, 1
mov edx, eax
mov eax, dword [ebp - 0x2044]
lea esi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416050
sub eax, esi
sar eax, 1
lea esi, [edx + eax]
lea esi, [esi + esi + 0x14]
push esi
call fcn.0041ea1c
add esp, 4
mov ebx, eax
test esi, esi
je 0x41608e
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, esi
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, dword [ebp - 0x2044]
push eax
lea ecx, [ebp - 0x24]
push ecx
push 0x434c14
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
test ebx, ebx
je 0x4160b5
push ebx
call fcn.0041e9e2
add esp, 4
mov edx, dword [ebp - 0x2044]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [ebp - 0x2050]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x4160d5
push edi
call esi
mov eax, dword [ebp - 0x2048]
cmp eax, 0xffffffff
je 0x4160e3
push eax
call esi
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x416133
push 0xf01ff
push str.WM7F
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x416130
lea eax, [ebp - 0x2040]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call ebx
push edi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop ebx
xor ecx, ebp
mov al, 1
pop esi
call fcn.0041e7be
mov esp, ebp
pop ebp
ret