Function at 0x4cc460
Capabilities:
Check for time delay via gettickcount
Delete service
Modify service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5975ae
mov eax, dword fs:[0]
push eax
mov eax, 0x2280
call fcn.00540100
mov eax, dword [0x5fae30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
push 0xf003f
xor ebx, ebx
push ebx
push ebx
mov edi, ecx
mov dword [ebp - 0x2278], eax
mov byte [eax], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x4cc4dd
push 1
add edi, 0x30
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x4cc4d2
push eax
mov ebx, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
jne 0x4cc4e7
mov eax, 1
jmp 0x4ccb95
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
xor ebx, ebx
mov dword [ebp - 0x227c], esi
cmp esi, ebx
jne 0x4cc563
push 0x1d
push str.Couldnt_open_service_manager
lea ecx, [ebp - 0x21d4]
mov dword [ebp - 0x21c0], 0xf
mov dword [ebp - 0x21c4], ebx
mov byte [ebp - 0x21d4], bl
call fcn.00402a36
push 1
lea eax, [ebp - 0x21d4]
push eax
mov ecx, 0x5fda4c
mov dword [ebp - 4], ebx
call fcn.005383c0
cmp dword [ebp - 0x21c0], 0x10
jb 0x4ccb93
mov ecx, dword [ebp - 0x21d4]
push ecx
call fcn.0053ed60
add esp, 4
jmp 0x4ccb93
push 0xf01ff
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
xor edi, edi
mov dword [ebp - 0x2274], ebx
cmp ebx, edi
jne 0x4cc5e9
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x15
push str.Couldnt_open_service
lea ecx, [ebp - 0x21d4]
mov dword [ebp - 0x21c0], 0xf
mov dword [ebp - 0x21c4], edi
mov byte [ebp - 0x21d4], 0
call fcn.00402a36
push 1
lea edx, [ebp - 0x21d4]
push edx
mov ecx, 0x5fda4c
mov dword [ebp - 4], 1
call fcn.005383c0
cmp dword [ebp - 0x21c0], 0x10
jb 0x4ccb93
mov eax, dword [ebp - 0x21d4]
push eax
call fcn.0053ed60
add esp, 4
jmp 0x4ccb93
lea ecx, [ebp - 0x2268]
push ecx
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2280], edi
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0x1388
jae 0x4cc64d
lea edx, [ebp - 0x2280]
push edx
push 0x24
lea eax, [ebp - 0x224c]
push eax
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4cc64d
cmp dword [ebp - 0x2248], 1
je 0x4cc64d
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
sub eax, edi
cmp eax, 0x1388
jb 0x4cc614
cmp byte [ebp + 8], 0
mov dword [ebp - 0x2270], 1
je 0x4cc6ea
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
lea ecx, [ebp - 0x226c]
push ecx
push 0
push 0
push ebx
mov dword [ebp - 0x226c], 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4cc767
call esi
cmp eax, 0x7a
je 0x4cc767
call esi
push eax
lea edx, [ebp - 0x21f0]
push edx
call fcn.004080a8
push eax
lea eax, [ebp - 0x21d4]
push str.Couldnt_call_QueryServiceConfig_with_error:
push eax
mov dword [ebp - 4], 2
call fcn.0040367f
add esp, 0x14
push 1
push eax
mov ecx, 0x5fda4c
mov byte [ebp - 4], 3
call fcn.005383c0
lea ecx, [ebp - 0x21d4]
call fcn.0040583f
lea ecx, [ebp - 0x21f0]
call fcn.0040583f
or edi, 0xffffffff
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 0x2270], eax
xor eax, eax
mov dword [ebp - 0x228c], eax
mov dword [ebp - 0x2288], eax
mov dword [ebp - 0x2284], eax
push 0x20006
push 0x5bb3fc
mov ebx, 0x10
push reloc.WS2_32.dll_bind
lea ecx, [ebp - 0x228c]
mov dword [ebp - 4], ebx
call fcn.00403d5f
test eax, eax
je 0x4cc9e7
push eax
lea eax, [ebp - 0x21f0]
push eax
call fcn.004080a8
push eax
lea ecx, [ebp - 0x220c]
push 0x5bb3d0
push ecx
mov byte [ebp - 4], 0x11
call fcn.0040367f
add esp, 0x14
mov byte [ebp - 4], 0x12
jmp 0x4cca25
mov edx, dword [ebp - 0x226c]
lea ecx, [ebp - 0x226c]
push ecx
push edx
lea eax, [ebp - 0x21b8]
push eax
push ebx
call edi
test eax, eax
jne 0x4cc7d5
call esi
push eax
lea ecx, [ebp - 0x21d4]
push ecx
call fcn.004080a8
push eax
lea edx, [ebp - 0x21f0]
push str.Couldnt_call_second_QueryServiceConfig_with_error:
push edx
mov dword [ebp - 4], 4
call fcn.0040367f
add esp, 0x14
push 1
push eax
mov ecx, 0x5fda4c
mov byte [ebp - 4], 5
call fcn.005383c0
lea ecx, [ebp - 0x21f0]
call fcn.0040583f
lea ecx, [ebp - 0x21d4]
jmp 0x4cc6e5
push 0x208
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword [ebp - 0x21ac]
push ecx
lea ecx, [ebp - 0x21d4]
call fcn.00406802
lea edx, [ebp - 0x21d4]
push edx
lea eax, [ebp - 0x220c]
push eax
mov dword [ebp - 4], 6
call fcn.00406569
push eax
lea ecx, [ebp - 0x21f0]
push str.Detected_service_path:
push ecx
mov byte [ebp - 4], 7
call fcn.0040367f
add esp, 0x14
push 0
push eax
mov ecx, 0x5fda4c
mov byte [ebp - 4], 8
call fcn.005383c0
lea ecx, [ebp - 0x21f0]
call fcn.0040583f
lea ecx, [ebp - 0x220c]
call fcn.0040583f
or edi, 0xffffffff
lea ecx, [ebp - 0x21d4]
mov dword [ebp - 4], edi
call fcn.00406dfc
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x21d4]
call fcn.00406802
lea eax, [ebp - 0x21d4]
push eax
lea ecx, [ebp - 0x21f0]
push ecx
mov dword [ebp - 4], 9
call fcn.00406569
push eax
lea edx, [ebp - 0x220c]
push str.Binary_path:
push edx
mov byte [ebp - 4], 0xa
call fcn.0040367f
add esp, 0x14
push 0
push eax
mov ecx, 0x5fda4c
mov byte [ebp - 4], 0xb
call fcn.005383c0
lea ecx, [ebp - 0x220c]
call fcn.0040583f
lea ecx, [ebp - 0x21f0]
call fcn.0040583f
lea ecx, [ebp - 0x21d4]
mov dword [ebp - 4], edi
call fcn.00406dfc
mov eax, dword [ebp - 0x21ac]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.00543260
add esp, 8
test eax, eax
je 0x4cc9a1
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x218]
push edx
push edi
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x4cc976
call esi
push eax
lea eax, [ebp - 0x21f0]
push eax
call fcn.004080a8
push eax
lea ecx, [ebp - 0x220c]
push str.Couldnt_call_second_QueryServiceConfig_with_error:
push ecx
mov dword [ebp - 4], 0xc
call fcn.0040367f
add esp, 0x14
push 1
push eax
mov ecx, 0x5fda4c
mov byte [ebp - 4], 0xd
call fcn.005383c0
lea ecx, [ebp - 0x220c]
call fcn.0040583f
lea ecx, [ebp - 0x21f0]
call fcn.0040583f
jmp 0x4cc6ed
mov edx, dword [ebp - 0x2278]
push str.Path_modified
lea ecx, [ebp - 0x21d4]
mov byte [edx], 1
call fcn.00403dfa
push 0
lea eax, [ebp - 0x21d4]
mov dword [ebp - 4], 0xe
push eax
jmp 0x4cc9ca
mov ecx, dword [ebp - 0x2278]
mov byte [ecx], 1
push str.Pathes_are_indentical
lea ecx, [ebp - 0x21d4]
call fcn.00403dfa
push 0
lea edx, [ebp - 0x21d4]
mov dword [ebp - 4], 0xf
push edx
mov ecx, 0x5fda4c
call fcn.005383c0
lea ecx, [ebp - 0x21d4]
mov dword [ebp - 4], edi
call fcn.0040583f
jmp 0x4ccb3f
push 0x5bb32c
lea ecx, [ebp - 0x228c]
call fcn.00401c62
test eax, eax
je 0x4cca4b
push eax
lea edx, [ebp - 0x21f0]
push edx
call fcn.004080a8
push eax
lea eax, [ebp - 0x220c]
push str.Failed_to_delete_sub_SafeBoot_with_error:
push eax
mov byte [ebp - 4], 0x13
call fcn.0040367f
add esp, 0x14
mov byte [ebp - 4], 0x14
push 1
push eax
mov ecx, 0x5fda4c
call fcn.005383c0
lea ecx, [ebp - 0x220c]
call fcn.0040583f
lea ecx, [ebp - 0x21f0]
mov byte [ebp - 4], bl
call fcn.0040583f
call fcn.0040623a
push eax
call fcn.00407a81
add esp, 4
test al, al
je 0x4ccb25
push str.Trying_to_remove_category
lea ecx, [ebp - 0x2228]
call fcn.00403dfa
push 0
lea ecx, [ebp - 0x2228]
push ecx
mov ecx, 0x5fda4c
mov byte [ebp - 4], 0x15
call fcn.005383c0
lea ecx, [ebp - 0x2228]
mov byte [ebp - 4], bl
call fcn.0040583f
lea edx, [ebp - 0x21d4]
push 0
push edx
call fcn.00408391
add esp, 8
cmp dword [ebp - 0x21c4], 0
mov byte [ebp - 4], 0x16
jne 0x4ccae3
push str.Category_removed
lea ecx, [ebp - 0x2228]
call fcn.00403dfa
push 0
lea eax, [ebp - 0x2228]
push eax
mov ecx, 0x5fda4c
mov byte [ebp - 4], 0x17
call fcn.005383c0
lea ecx, [ebp - 0x2228]
jmp 0x4ccb15
lea ecx, [ebp - 0x21d4]
push ecx
lea edx, [ebp - 0x220c]
push str.Error_removing_category:
push edx
call fcn.00408a0d
add esp, 0xc
push 1
push eax
mov ecx, 0x5fda4c
mov byte [ebp - 4], 0x18
call fcn.005383c0
lea ecx, [ebp - 0x220c]
call fcn.0040583f
lea ecx, [ebp - 0x21d4]
call fcn.0040583f
mov eax, dword [ebp - 0x228c]
mov dword [ebp - 4], edi
test eax, eax
je 0x4ccb39
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x2274]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
mov eax, dword [ebp - 0x227c]
push eax
call esi
cmp dword [ebp - 0x2270], 0
jne 0x4cc4dd
push str.Service_could_not_be_deleted_
lea ecx, [ebp - 0x2228]
call fcn.00403dfa
push 1
lea ecx, [ebp - 0x2228]
push ecx
mov ecx, 0x5fda4c
mov dword [ebp - 4], 0x19
call fcn.005383c0
lea ecx, [ebp - 0x2228]
call fcn.0040583f
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053fd20
mov esp, ebp
pop ebp
ret 8