Function at 0x4026e0
Capabilities:
Query service status
Stop service

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xf003f
push 0
push 0
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x3c], esi
test esi, esi
jne 0x402836
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40], 0x7d2d1c7b
mov dword [ebp - 0x3c], 0x396f84da
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x40], 0xc69c0dd3
mov dword [ebp - 0x3c], 0xfbab5ee0
mov ecx, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x40], 0x10800d0a
mov dword [ebp - 0x3c], 0xfbf2a015
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x40], 0x8f53b9c0
mov dword [ebp - 0x3c], 0x77e68d14
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], 0x11447d3d
mov dword [ebp - 0x3c], 0x4b4fe0bf
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], 0xaff263a6
mov dword [ebp - 0x3c], 0xdb91398e
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x7c], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], 0x108a692f
mov dword [ebp - 0x3c], 0xfbf2a015
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x74], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x40], 0x8f53b9c0
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x3c], 0x77e68d14
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
movaps xmm1, xmmword [ebp - 0x80]
xorps xmm1, xmmword [ebp - 0x60]
movaps xmmword [ebp - 0x60], xmm1
movaps xmm1, xmmword [ebp - 0x50]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x64], ecx
xorps xmm1, xmmword [ebp - 0x70]
push eax
movaps xmmword [ebp - 0x50], xmm1
call fcn.00401990
add esp, 8
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406232
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x24
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x402852
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x402c2c
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
lea eax, [ebp - 8]
push eax
push 0x24
lea eax, [ebp - 0x2c]
push eax
push 0
push edi
call esi
test eax, eax
jne 0x40298d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x38], 0x7d2d1c7b
mov dword [ebp - 0x34], 0x396f84da
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x38], 0xc69c0dd3
mov dword [ebp - 0x34], 0xfbab5ee0
mov ecx, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x38], 0x10800d0a
mov dword [ebp - 0x34], 0xfbf2a015
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x38], 0x8f53b9c0
mov dword [ebp - 0x34], 0x77e68d14
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x38], 0x11447d3d
mov dword [ebp - 0x34], 0x4b4fe0bf
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], 0xaff263a6
mov dword [ebp - 0x34], 0xdb91398e
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x7c], ecx
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], 0x108a692f
mov dword [ebp - 0x34], 0xfbf2a015
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x74], ecx
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x38], 0x8f53b9c0
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x34], 0x77e68d14
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
movaps xmm1, xmmword [ebp - 0x80]
xorps xmm1, xmmword [ebp - 0x60]
movaps xmmword [ebp - 0x60], xmm1
movaps xmm1, xmmword [ebp - 0x50]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x64], ecx
xorps xmm1, xmmword [ebp - 0x70]
push eax
movaps xmmword [ebp - 0x50], xmm1
call fcn.00401990
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 8
push edi
call esi
push dword [ebp - 0x3c]
call esi
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406232
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
cmp dword [ebp - 0x28], 1
je 0x402c1e
lea eax, [ebp - 0x2c]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x402aca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x38], 0x7d2d1c7b
mov dword [ebp - 0x34], 0x396f84da
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x38], 0xc69c0dd3
mov dword [ebp - 0x34], 0xfbab5ee0
mov ecx, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x38], 0x10800d0a
mov dword [ebp - 0x34], 0xfbf2a015
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x38], 0x8f53b9c0
mov dword [ebp - 0x34], 0x77e68d14
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x38], 0x11447d3d
mov dword [ebp - 0x34], 0x4b4fe0bf
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], 0xaff263a6
mov dword [ebp - 0x34], 0xdb91398e
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x7c], ecx
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], 0x108a692f
mov dword [ebp - 0x34], 0xfbf2a015
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x74], ecx
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x38], 0x8f53b9c0
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x34], 0x77e68d14
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
movaps xmm1, xmmword [ebp - 0x60]
xorps xmm1, xmmword [ebp - 0x80]
movaps xmmword [ebp - 0x60], xmm1
movaps xmm1, xmmword [ebp - 0x50]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x64], ecx
xorps xmm1, xmmword [ebp - 0x70]
push eax
movaps xmmword [ebp - 0x50], xmm1
call fcn.00401990
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esp, 8
push edi
call esi
push dword [ebp - 0x3c]
call esi
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406232
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov dword [ebp - 0x38], 0x752a186d
mov dword [ebp - 0x34], 0x65288ed6
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x38], 0xaff84d88
mov dword [ebp - 0x34], 0xdb91398e
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x38], 0x11447d3d
mov dword [ebp - 0x34], 0x4b4fe0bf
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x38], 0xaff263a6
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x34], 0xdb91398e
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x90]
mov dword [ebp - 0x64], ecx
movaps xmm1, xmmword [ebp - 0x70]
xorps xmm1, xmmword [ebp - 0x90]
push eax
movaps xmmword [ebp - 0x90], xmm1
call fcn.00401990
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x28], 1
je 0x402b9e
lea eax, [ebp - 8]
push eax
push 0x24
lea eax, [ebp - 0x2c]
push eax
push 0
push edi
call esi
test eax, eax
je 0x402c41
cmp dword [ebp - 0x28], 1
je 0x402b9e
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x28], 1
jne 0x402b70
mov dword [ebp - 0x38], 0x6637137c
mov dword [ebp - 0x34], 0x6b7592da
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x38], 0xca8711d2
mov dword [ebp - 0x34], 0xdb913984
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x38], 0x11447d3d
mov dword [ebp - 0x34], 0x4b4fe0bf
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x38], 0xaff263a6
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x34], 0xdb91398e
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x64], ecx
movaps xmm1, xmmword [ebp - 0x70]
xorps xmm1, xmmword [ebp - 0x50]
push eax
movaps xmmword [ebp - 0x50], xmm1
call fcn.00401990
add esp, 4
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push dword [ebp - 0x3c]
call esi
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00406232
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x38], 0x6637137c
mov dword [ebp - 0x34], 0x2e6f92da
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x38], 0xdd9d11d4
mov dword [ebp - 0x34], 0xbfb419b4
mov ecx, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x38], 0x108a6925
jmp 0x4028b1