Function at 0x8471520
Capabilities:
Contain obfuscated stackstrings
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1134
call fcn.0849e740
mov eax, dword [0x184002c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
mov ebx, ecx
mov dword [ebp - 0x1024], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x8471ec7
push 1
add ebx, 0x2c
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x8471583
push eax
mov dword [ebp - 0x1024], 1
call esi
push edi
call esi
cmp dword [ebp - 0x1024], 0
je 0x8471ec7
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x1024], eax
test eax, eax
jne 0x84718df
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0xd80a
call fcn.084498e0
add esp, 0xc
test eax, eax
jne 0x84718ba
sub esp, 0xc
mov dword [ebp - 0x1120], 0x77417947
mov ecx, esp
mov dword [ebp - 0x111c], 0x695a4350
mov dword [ebp - 0x1118], 0x6959544a
mov dword [ebp - 0x1114], 0x69595364
push dword [ebp - 0x1024]
mov dword [ebp - 0x1110], 0x315a694e
mov dword [ebp - 0x110c], 0x36516a45
mov dword [ebp - 0x1108], 0x7663534a
mov dword [ebp - 0x1104], 0x6355324a
mov dword [ebp - 0x1100], 0x6c347a4e
mov dword [ebp - 0x10fc], 0x2b77794e
mov dword [ebp - 0x10f8], 0x64637a48
mov dword [ebp - 0x10f4], 0x53514859
mov dword [ebp - 0x10f0], 0x3830434c
mov dword [ebp - 0x10ec], 0x78346e49
mov dword [ebp - 0x10e8], 0x33386e42
mov dword [ebp - 0x10e4], 0x684d5365
mov dword [ebp - 0x10e0], 0x3534484f
mov dword [ebp - 0x10dc], 0x46514447
mov dword [ebp - 0x10d8], 0x71595441
mov dword [ebp - 0x10d4], 0x374e7948
mov dword [ebp - 0x10d0], 0x526f414d
mov dword [ebp - 0x10cc], 0x7a526759
mov dword [ebp - 0x10c8], 0x6d677948
mov dword [ebp - 0x10c4], 0x4e775342
mov dword [ebp - 0x10c0], 0x6a786a61
mov dword [ebp - 0x10bc], 0x6e497745
mov dword [ebp - 0x10b8], 0x2f4e6941
mov dword [ebp - 0x10b4], 0x4577434e
mov dword [ebp - 0x10b0], 0x30426d48
mov dword [ebp - 0x10ac], 0x46556948
mov dword [ebp - 0x10a8], 0x78685441
mov dword [ebp - 0x10a4], 0x31455150
mov dword [ebp - 0x10a0], 0x454d6945
mov dword [ebp - 0x109c], 0x3967444f
mov dword [ebp - 0x1098], 0x7470794f
mov dword [ebp - 0x1094], 0x476b544b
mov dword [ebp - 0x1090], 0x67737a59
mov dword [ebp - 0x108c], 0x6d634347
mov dword [ebp - 0x1088], 0x306f784f
mov dword [ebp - 0x1084], 0x6f6f7a41
mov dword [ebp - 0x1080], 0x38355243
mov dword [ebp - 0x107c], 0x70513344
mov dword [ebp - 0x1078], 0x79346843
mov dword [ebp - 0x1074], 0x7a6b6a4a
mov dword [ebp - 0x1070], 0x2f417847
mov dword [ebp - 0x106c], 0x73676963
mov dword [ebp - 0x1068], 0x2b707842
mov dword [ebp - 0x1064], 0x6b64534d
mov dword [ebp - 0x1060], 0x4a597844
mov dword [ebp - 0x105c], 0x4f55794f
mov dword [ebp - 0x1058], 0x74735262
mov dword [ebp - 0x1054], 0x6f495861
mov dword [ebp - 0x1050], 0x6e466765
mov dword [ebp - 0x104c], 0x59416e41
mov dword [ebp - 0x1048], 0x50636749
mov dword [ebp - 0x1044], 0x73386a45
mov dword [ebp - 0x1040], 0x576f514f
mov dword [ebp - 0x103c], 0x5a6b4149
mov dword [ebp - 0x1038], 0x39396842
mov dword [ebp - 0x1034], 0x46515761
mov dword [ebp - 0x1030], 0x546f5246
mov dword [ebp - 0x102c], 0x41414141
mov word [ebp - 0x1028], 0x516d
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x1026]
push eax
lea eax, [ebp - 0x1120]
push eax
push 0
call fcn.08405280
lea eax, [ebp - 0x1130]
push eax
call fcn.0844ba20
add esp, 0x10
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
sar eax, 1
je 0x8471edd
push ecx
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.0849f088
push eax
call fcn.0840d760
mov eax, dword [ebp - 0x1130]
add esp, 0x10
test eax, eax
je 0x84718ba
push eax
call fcn.0849b460
add esp, 4
lea eax, [ebp - 0x804]
push 0
push ebx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0849cd1e
mov esp, ebp
pop ebp
ret
push 0xf01ff
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x8471b50
push dword [ebp - 0x1024]
call esi
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0xd80c
call fcn.084498e0
add esp, 0xc
test eax, eax
jne 0x84718ba
push eax
sub esp, 0xc
mov dword [ebp - 0x10e0], 0x77417947
mov ecx, esp
mov dword [ebp - 0x10dc], 0x695a4350
mov dword [ebp - 0x10d8], 0x6959544a
mov dword [ebp - 0x10d4], 0x69595364
push dword [ebp - 0x1024]
mov dword [ebp - 0x10d0], 0x315a694e
mov dword [ebp - 0x10cc], 0x36516a4d
mov dword [ebp - 0x10c8], 0x7663534a
mov dword [ebp - 0x10c4], 0x6839784a
mov dword [ebp - 0x10c0], 0x704a6841
mov dword [ebp - 0x10bc], 0x4f30534b
mov dword [ebp - 0x10b8], 0x4c674349
mov dword [ebp - 0x10b4], 0x4a415348
mov dword [ebp - 0x10b0], 0x504d5348
mov dword [ebp - 0x10ac], 0x6c30514f
mov dword [ebp - 0x10a8], 0x486f334a
mov dword [ebp - 0x10a4], 0x47514365
mov dword [ebp - 0x10a0], 0x6874514a
mov dword [ebp - 0x109c], 0x4c556e4b
mov dword [ebp - 0x1098], 0x384e5350
mov dword [ebp - 0x1094], 0x2f557959
mov dword [ebp - 0x1090], 0x71454161
mov dword [ebp - 0x108c], 0x68346947
mov dword [ebp - 0x1088], 0x6942324c
mov dword [ebp - 0x1084], 0x716b5462
mov dword [ebp - 0x1080], 0x626f6e41
mov dword [ebp - 0x107c], 0x68456741
mov dword [ebp - 0x1078], 0x57514245
mov dword [ebp - 0x1074], 0x30415248
mov dword [ebp - 0x1070], 0x41735246
mov dword [ebp - 0x106c], 0x45735359
mov dword [ebp - 0x1068], 0x71777a43
mov dword [ebp - 0x1064], 0x62593346
mov dword [ebp - 0x1060], 0x7a386765
mov dword [ebp - 0x105c], 0x69317941
mov dword [ebp - 0x1058], 0x69466a49
mov dword [ebp - 0x1054], 0x6751774e
mov dword [ebp - 0x1050], 0x68677a48
mov dword [ebp - 0x104c], 0x68686764
mov dword [ebp - 0x1048], 0x39705159
mov dword [ebp - 0x1044], 0x30595249
mov dword [ebp - 0x1040], 0x446f4345
mov dword [ebp - 0x103c], 0x7a6c5366
mov dword [ebp - 0x1038], 0x6a4e4341
mov dword [ebp - 0x1034], 0x6d4a674a
mov dword [ebp - 0x1030], 0x41735348
mov dword [ebp - 0x102c], 0x77424141
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x1028]
push eax
lea eax, [ebp - 0x10e0]
push eax
push edi
call fcn.08405280
lea eax, [ebp - 0x1130]
push eax
call fcn.0844ba20
add esp, 0x10
mov ecx, eax
call fcn.08417430
push eax
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.0849f088
push eax
call fcn.0840d760
add esp, 0x10
lea ecx, [ebp - 0x1130]
call fcn.0840b0f0
jmp 0x84718ba
lea eax, [ebp - 0x1020]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x8471cee
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x8471cee
cmp eax, 0x425
jne 0x8471b8d
cmp dword [ebp - 0x101c], 3
je 0x8471cee
push 0x400
lea eax, [ebp - 0x804]
push eax
push 0xd80e
call fcn.084498e0
add esp, 0xc
test eax, eax
jne 0x8471cdc
push eax
sub esp, 0xc
mov dword [ebp - 0x107c], 0x77417947
mov ecx, esp
mov dword [ebp - 0x1078], 0x695a4350
lea eax, [ebp - 0x1121]
mov dword [ebp - 0x1074], 0x6959544a
lea edx, [ebp - 0x1028]
mov dword [ebp - 0x1070], 0x6d6f5464
push eax
push edx
lea esi, [ebp - 0x107c]
mov dword [ebp - 0x106c], 0x31684450
push esi
mov dword [ebp - 0x1068], 0x36516a4d
mov dword [ebp - 0x1064], 0x7663534a
mov dword [ebp - 0x1060], 0x4467794a
mov dword [ebp - 0x105c], 0x55414149
mov dword [ebp - 0x1058], 0x6c41425a
mov dword [ebp - 0x1054], 0x7a6f6a47
mov dword [ebp - 0x1050], 0x7974444a
mov dword [ebp - 0x104c], 0x6538524d
mov dword [ebp - 0x1048], 0x35456e49
mov dword [ebp - 0x1044], 0x45347750
mov dword [ebp - 0x1040], 0x3470684b
mov dword [ebp - 0x103c], 0x2b394141
mov dword [ebp - 0x1038], 0x44416e64
mov dword [ebp - 0x1034], 0x7a346a4c
mov dword [ebp - 0x1030], 0x416b6a5a
mov dword [ebp - 0x102c], 0x6c414141
call fcn.08409550
lea eax, [ebp - 0x1130]
push eax
call fcn.0844ba20
add esp, 0x10
mov ecx, eax
call fcn.08417430
push eax
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.0849f088
push eax
call fcn.0840d760
add esp, 0x10
lea ecx, [ebp - 0x1130]
call fcn.0840b0f0
push 0
push ebx
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor esi, esi
cmp dword [ebp - 0x101c], 1
je 0x8471d2e
lea esp, [esp]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
inc esi
cmp eax, 0x3c
jae 0x8471d2e
lea eax, [ebp - 0x1020]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x8471d2e
cmp dword [ebp - 0x101c], 1
jne 0x8471d00
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
call edi
push dword [ebp - 0x1024]
call edi
test esi, esi
jne 0x8471ec7
push 0x400
lea eax, [ebp - 0x1004]
push eax
push 0xd80d
call fcn.084498e0
add esp, 0xc
test eax, eax
jne 0x8471ebc
push eax
sub esp, 0xc
mov dword [ebp - 0x1084], 0x77417947
mov ecx, esp
mov dword [ebp - 0x1080], 0x695a4350
lea eax, [ebp - 0x1121]
mov dword [ebp - 0x107c], 0x6959544a
lea edx, [ebp - 0x1026]
mov dword [ebp - 0x1078], 0x33305364
push eax
push edx
lea esi, [ebp - 0x1084]
mov dword [ebp - 0x1074], 0x68307950
push esi
mov dword [ebp - 0x1070], 0x3745484a
mov dword [ebp - 0x106c], 0x36776a4e
mov dword [ebp - 0x1068], 0x3059794b
mov dword [ebp - 0x1064], 0x32565145
mov dword [ebp - 0x1060], 0x44384343
mov dword [ebp - 0x105c], 0x786b5362
mov dword [ebp - 0x1058], 0x764d434f
mov dword [ebp - 0x1054], 0x5a557a44
mov dword [ebp - 0x1050], 0x66417a46
mov dword [ebp - 0x104c], 0x6d74794b
mov dword [ebp - 0x1048], 0x504d6d42
mov dword [ebp - 0x1044], 0x67595159
mov dword [ebp - 0x1040], 0x4763434a
mov dword [ebp - 0x103c], 0x3851794d
mov dword [ebp - 0x1038], 0x48347a44
mov dword [ebp - 0x1034], 0x5467784b
mov dword [ebp - 0x1030], 0x6a414848
mov dword [ebp - 0x102c], 0x41414141
mov word [ebp - 0x1028], 0x674b
call fcn.08409550
lea eax, [ebp - 0x1130]
push eax
call fcn.0844ba20
add esp, 0x10
mov ecx, eax
call fcn.08417430
push eax
lea eax, [ebp - 0x1004]
push 0x400
push eax
call fcn.0849f088
push eax
call fcn.0840d760
add esp, 0x10
lea ecx, [ebp - 0x1130]
call fcn.0840b0f0
lea eax, [ebp - 0x1004]
jmp 0x84718c0
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0849cd1e
mov esp, ebp
pop ebp
ret
push str.invalid_vector_T__subscript
call fcn.0847ecf2
int3