Function at 0x437229
Capabilities:
Enumerate services
Query service configuration
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x25460
call fcn.00465440
push edi
push 4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x437253
xor eax, eax
jmp 0x437513
mov dword [ebp - 0x2401c], 0x24000
mov dword [ebp - 8], 0
mov dword [ebp - 0x24018], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x24014], 0
mov byte [ebp - 4], 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x24018]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x2401c]
push eax
lea ecx, [ebp - 0x24010]
push ecx
push 1
push 0x30
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x4372c3
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x437513
mov dword [ebp - 0x24014], 0
jmp 0x4372de
mov ecx, dword [ebp - 0x24014]
add ecx, 1
mov dword [ebp - 0x24014], ecx
mov edx, dword [ebp - 0x24014]
cmp edx, dword [ebp - 0x24018]
jae 0x437507
push 0x35
mov eax, dword [ebp - 0x24014]
imul eax, eax, 0x24
mov ecx, dword [ebp + eax - 0x24010]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x24860], eax
cmp dword [ebp - 0x24860], 0
jne 0x43731e
jmp 0x4372cf
mov al, byte [0x4b0084]
mov byte [ebp - 0x2485c], al
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x2485b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x4b0088]
mov byte [ebp - 0x24438], cl
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x24437]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0x4b008c]
mov byte [ebp - 0x24c60], dl
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x24c5f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x4b0090]
mov byte [ebp - 0x25460], al
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x2545f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x4b0094]
mov byte [ebp - 0x25060], cl
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x2505f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x2485c]
mov dword [ebp - 0x24450], edx
lea eax, [ebp - 0x24c60]
mov dword [ebp - 0x24444], eax
lea ecx, [ebp - 0x24438]
mov dword [ebp - 0x2444c], ecx
lea edx, [ebp - 0x25460]
mov dword [ebp - 0x24440], edx
lea eax, [ebp - 0x25060]
mov dword [ebp - 0x2443c], eax
lea ecx, [ebp - 8]
push ecx
push 0x1424
lea edx, [ebp - 0x2445c]
push edx
mov eax, dword [ebp - 0x24860]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x437421
mov ecx, dword [ebp - 0x24860]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4372cf
lea edx, [ebp - 0x24038]
push edx
mov eax, dword [ebp - 0x24860]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x24034], 4
je 0x437450
mov ecx, dword [ebp - 0x24860]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4372cf
mov edx, dword [ebp + 8]
push edx
call fcn.00465470
add esp, 4
push eax
mov eax, dword [ebp - 0x24450]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004681f0
add esp, 0xc
test eax, eax
je 0x437486
mov edx, dword [ebp - 0x24860]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4372cf
lea eax, [ebp - 0x24038]
push eax
push 1
mov ecx, dword [ebp - 0x24860]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea edx, [ebp - 0x24038]
push edx
mov eax, dword [ebp - 0x24860]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4374ce
cmp dword [ebp - 0x24034], 3
jne 0x4374ca
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4374cc
jmp 0x4374ce
jmp 0x43749c
cmp dword [ebp - 0x24034], 1
je 0x4374e9
mov ecx, dword [ebp - 0x24860]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4372cf
mov edx, dword [ebp - 0x24860]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x437513
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret