Function at 0x40af90
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
mov eax, dword [0x4703d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov bl, 1
push str.Verifying_Mfenlfk.sys_is_installed_and_running..._n
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xcd], 0
mov byte [ebp - 0xce], bl
call fcn.0040ef30
add esp, 4
push 0xa0000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
mov dword [ebp - 0xd8], edi
jne 0x40b01a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR:_Could_not_open_SCManager._GetLastError___u_n
call fcn.0040ef30
add esp, 8
push str.mfenlfk.sys_is_not_installed_properly_n
call fcn.0040ef30
add esp, 4
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c015
mov esp, ebp
pop ebp
ret 0xc
push esi
push 0x64
lea ecx, [ebp - 0xcc]
push ecx
push str.mfenlfk.sys
call fcn.00408d10
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x14
lea edx, [ebp - 0xcc]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x40b070
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR:_Could_not_open_mfenlfk.sys_service._GetLastError___u_n
call fcn.0040ef30
add esp, 8
jmp 0x40b11c
call fcn.0040ef30
add esp, 4
push 0x64
call esi
nop
lea eax, [ebp - 0xf4]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40b11c
mov ecx, dword [ebp - 0xf0]
lea eax, [ecx - 1]
cmp eax, 6
ja case.default.0x40b094
jmp dword [eax*4 + 0x40b218]
push str.mfenlfk.sys_service_reports_STOPPED._n
call fcn.0040ef30
add esp, 4
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x40b10f
push str.started_mfenlfk.sys_service._n
call fcn.0040ef30
add esp, 4
jmp 0x40b070
push str.mfenlfk.sys_service_reports_CONTINUE_PENDING._n
jmp 0x40b063
push str.mfenlfk.sys_service_reports_PAUSE_PENDING._n
jmp 0x40b063
push str.mfenlfk.sys_service_reports_START_PENDING._n
jmp 0x40b063
push str.mfenlfk.sys_service_reports_PENDING._n
jmp 0x40b063
push ecx
push str.mfenlfk.sys_service_reports__x__n
call fcn.0040ef30
add esp, 8
jmp 0x40b06b
push str.mfenlfk.sys_service_reports_RUNNING._n
call fcn.0040ef30
mov byte [ebp - 0xcd], 1
jmp 0x40b119
push str.mfenlfk.sys_service_reports_PAUSED._n
jmp 0x40b114
push str.Could_not_start_mfenlfk.sys_service_n
call fcn.0040ef30
add esp, 4
test edi, edi
je 0x40b129
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edi, edi
cmp byte [ebp - 0xcd], 0
jne 0x40b1ba
push str.mfenlfk.sys_service_is_not_running._n
call fcn.0040ef30
add esp, 4
cmp byte [ebp - 0xce], 0
je 0x40b1ba
push str.Uninstall_mfenlfk.sys_service_n
call fcn.0040ef30
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xd4]
add esp, 4
push 0
push ecx
push edx
push eax
push str.mfenlfk.sys
call fcn.0040adf0
mov bl, al
test bl, bl
je 0x40b1ba
push str.Install_mfenlfk.sys_service_n
call fcn.0040ef30
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xd4]
add esp, 4
push 0
push ecx
push edx
push eax
push str.mfenlfk.sys
call fcn.0040a840
mov bl, al
test bl, bl
je 0x40b1ba
mov edi, dword [ebp - 0xd8]
mov byte [ebp - 0xce], 0
jmp 0x40b034
test edi, edi
pop esi
je 0x40b1c6
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xd8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bl, bl
je 0x40b1e0
cmp byte [ebp - 0xcd], 0
jne 0x40b201
push str.mfenlfk.sys_is_not_installed_properly_n
call fcn.0040ef30
add esp, 4
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c015
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
pop edi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0043c015
mov esp, ebp
pop ebp
ret 0xc