Function at 0x479840
Capabilities:
Enumerate processes
Query service status
Stop service
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e8c3
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x63434c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x270], ebx
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x479f1d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x264], eax
mov eax, str.Kingsoft_WPS_UpdateService
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x264]
test eax, 0xffff0000
jne 0x4798c7
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x4798d3
push 0x1a
push str.Kingsoft_WPS_UpdateService
call fcn.0042a000
push 0xf003f
push 0
push 0
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, dword [ebp - 0x264]
mov edi, eax
mov dword [ebp - 0x260], edi
test edi, edi
je 0x47996f
push 0x24
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
je 0x479962
lea eax, [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov eax, dword [ebp - 0x28]
cmp eax, 4
je 0x479923
cmp eax, 7
jne 0x47995b
lea eax, [ebp - 0x2c]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x47995b
xor edi, edi
lea eax, [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x28], 1
je 0x479955
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x14
jl 0x479936
mov edi, dword [ebp - 0x260]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [ebp - 0x270]
or edi, 0xffffffff
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x479989
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push 0x5b7698
lea eax, [ebp - 0x268]
push ebx
push eax
call fcn.004297b0
add esp, 0xc
push 0
push 2
mov dword [ebp - 4], 1
mov dword [ebp - 0x258], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x479d7c
mov byte [ebp - 4], 2
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x479f27
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x258]
mov byte [ebp - 4], 3
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x479d58
push dword [ebp - 0x250]
call fcn.0047e330
add esp, 4
test eax, eax
jne 0x479d3d
lea ecx, [ebp - 0x234]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x479a22
sub ecx, edx
lea eax, [ebp - 0x234]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x25c]
call fcn.0042a000
push dword [ebp - 0x250]
lea eax, [ebp - 0x260]
push eax
call fcn.0047c330
push 0x5c
push dword [ebp - 0x260]
mov byte [ebp - 4], 4
call fcn.0055cf79
add esp, 0x10
test eax, eax
je 0x479abf
sub eax, dword [ebp - 0x260]
sar eax, 1
cmp eax, 0xffffffff
je 0x479abf
push eax
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x260]
call fcn.00448c60
push eax
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 5
call fcn.00429740
mov edx, dword [ebp - 0x274]
mov eax, edi
mov byte [ebp - 4], 4
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x479abf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov esi, esp
mov dword [ebp - 0x278], esp
mov dword [ebp - 0x27c], esi
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
push eax
call fcn.00429b20
add eax, 0x10
mov dword [esi], eax
push ecx
push esp
mov byte [ebp - 4], 6
call fcn.0047cc40
add esp, 4
mov byte [ebp - 4], 4
call fcn.004797e0
add esp, 0xc
test eax, eax
je 0x479b58
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.00438ee0
add esp, 8
test al, al
je case.0x479dc3.3
push dword [ebp - 0x250]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 4
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x479dfa
cmp esi, 0xffffffff
je case.0x479dc3.3
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
jmp 0x479dd0
push ecx
mov esi, esp
mov dword [ebp - 0x27c], esp
mov dword [ebp - 0x278], esi
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
push eax
call fcn.00429b20
add eax, 0x10
mov dword [esi], eax
mov esi, dword [ebp + 0x10]
push ecx
mov eax, esp
mov byte [ebp - 4], 7
push esi
push eax
call fcn.0047af40
add esp, 8
mov byte [ebp - 4], 4
call fcn.004797e0
add esp, 0xc
test eax, eax
je 0x479d90
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.00438ee0
add esp, 8
test al, al
je case.0x479dc3.3
call fcn.0047d690
mov eax, dword [eax + 4]
push eax
lea eax, [ebp - 0x25c]
push eax
call fcn.00448560
add esp, 8
test eax, eax
je 0x479bf3
push dword [ebp - 0x250]
call fcn.0046ae50
add esp, 4
test eax, eax
jne 0x479d1c
push dword [ebp - 0x250]
lea eax, [ebp - 0x264]
push eax
call fcn.0047c330
add esp, 8
mov eax, dword [ebp - 0x25c]
mov byte [ebp - 4], 8
cmp dword [eax - 0xc], 0
jl 0x479c7e
push 0x5bd360
push eax
call fcn.0055d020
add esp, 8
test eax, eax
je 0x479c7e
sub eax, dword [ebp - 0x25c]
sar eax, 1
cmp eax, 0xffffffff
je 0x479c7e
mov eax, dword [ebp - 0x270]
mov ecx, dword [eax]
test ecx, ecx
je 0x479cff
mov eax, dword [ebp - 0x264]
cmp dword [eax - 0xc], 0
jl 0x479d05
push ecx
push eax
call fcn.0055d020
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x479cff
mov eax, dword [ebp - 0x264]
sub ecx, eax
sar ecx, 1
cmp ecx, 0xffffffff
je 0x479d05
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
push eax
call fcn.00429b20
mov ebx, dword [ebp - 0x26c]
add eax, 0x10
mov edx, dword [ebp - 0x264]
add esp, 4
add edx, 0xfffffff0
mov dword [ebx], eax
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x479cc1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x260]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x479cde
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x25c]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x479ee4
mov ecx, dword [edx]
push edx
jmp 0x479edf
mov eax, dword [ebp - 0x264]
lea edx, [eax - 0x10]
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x479d1c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x260]
mov eax, edi
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x479d3d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x258]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x479a03
push ebx
call esi
mov edx, dword [ebp - 0x25c]
mov eax, edi
mov byte [ebp - 4], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x479d7c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.004291f0
mov ecx, eax
test ecx, ecx
je 0x479f31
jmp 0x479e74
test esi, esi
jne case.0x479dc3.3
call fcn.0047d690
mov eax, dword [eax + 4]
push eax
lea eax, [ebp - 0x25c]
push eax
call fcn.00448560
add esp, 8
test eax, eax
je case.0x479dc3.3
push dword [ebp - 0x250]
call fcn.0046a7d0
add esp, 4
cmp eax, 4
ja case.0x479dc3.3
jmp dword [eax*4 + 0x479f3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x260]
mov eax, edi
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x479d43
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x479d43
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
push eax
call fcn.00429b20
mov ebx, dword [ebp - 0x26c]
lea ecx, [ebp - 0x260]
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.00429660
lea ecx, [ebp - 0x25c]
call fcn.00429660
lea ecx, [ebp - 0x268]
call fcn.00429660
jmp 0x479eff
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
mov eax, dword [ebp - 0x25c]
add eax, 0xfffffff0
push eax
call fcn.00429b20
mov ebx, dword [ebp - 0x26c]
add esp, 4
add eax, 0x10
mov dword [ebx], eax
jmp 0x479cc1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x264], eax
mov eax, 0x5b3734
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x264]
test eax, 0xffff0000
jne 0x479ea3
movzx eax, ax
push eax
call fcn.00429d30
jmp 0x479eaf
push 0
push 0x5b3734
call fcn.0042a000
mov esi, dword [ebp - 0x264]
add esi, 0xfffffff0
mov byte [ebp - 4], 0xa
push esi
call fcn.00429b20
mov ebx, dword [ebp - 0x26c]
add eax, 0x10
add esp, 4
mov dword [ebx], eax
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x479ee4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x268]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x479eff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00557e89
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00429b00
push 0x80004005
call fcn.00429b00
push 0x80004005
call fcn.00429b00
nop
dec ecx
sahf
inc edi
add byte [ecx - 0x62], cl
inc edi
add byte [ecx - 0x62], cl
inc edi
add dl, cl
popfd
inc edi
add byte [ecx - 0x62], cl
inc edi
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp