Function at 0x4354f0
Capabilities:
Query service status
Set registry value
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
mov byte [ebp - 0x25], 0
mov byte [ebp - 0x1d], 0
call fcn.00437230
mov dword [ebp - 0x1c], 0x19
mov byte [ebp - 4], 1
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0x22e008
mov ecx, dword [ebp + 8]
push ecx
call fcn.00435270
add esp, 0x14
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x1d], al
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x43555a
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4358bd
push 0xf01ff
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x4355d1
lea ecx, [ebp - 0x48]
push ecx
push 1
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4355b4
cmp dword [ebp - 0x44], 1
jne 0x4355b4
mov dword [ebp - 0x344], 1
jmp 0x4355be
mov dword [ebp - 0x344], 0
mov dl, byte [ebp - 0x344]
mov byte [ebp - 0x25], dl
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx edx, byte [ebp - 0x25]
test edx, edx
jne 0x4358bd
lea eax, [ebp - 0x2a0]
push eax
push 0x40
lea ecx, [ebp - 0x90]
push ecx
push 0x443d78
call fcn.00436eb0
push eax
call fcn.00437a40
lea edx, [ebp - 0x324]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0x2a0]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4358bd
lea ecx, [ebp - 0x4c]
push ecx
push 0x20019
push 0
mov edx, dword [ebp + 8]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x435874
push 0
lea eax, [ebp - 0x4c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x324]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x435872
mov dword [ebp - 0x32c], 1
lea eax, [ebp - 0x320]
push eax
push 0x40
lea ecx, [ebp - 0x90]
push ecx
push 0x443d4c
call fcn.00436eb0
push eax
call fcn.00437a40
push 4
lea edx, [ebp - 0x32c]
push edx
push 4
push 0
lea eax, [ebp - 0x320]
push eax
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x43583c
mov word [ebp - 0x2a0], 0x5c
mov word [ebp - 0x29e], 0
lea edx, [ebp - 0x320]
push edx
push 0x40
lea eax, [ebp - 0x90]
push eax
push str.02____t846__0U
call fcn.00436eb0
push eax
call fcn.00437a40
lea ecx, [ebp - 0x320]
push ecx
push 0x105
lea edx, [ebp - 0x2a0]
push edx
call fcn.0041e5a9
add esp, 0xc
push 0x447ba4
push 0x105
lea eax, [ebp - 0x2a0]
push eax
call fcn.0041e5a9
add esp, 0xc
lea ecx, [ebp - 0x320]
push ecx
push 0x40
lea edx, [ebp - 0x90]
push edx
push 0x443d78
call fcn.00436eb0
push eax
call fcn.00437a40
lea eax, [ebp - 0x320]
push eax
push 0x105
lea ecx, [ebp - 0x2a0]
push ecx
call fcn.0041e5a9
add esp, 0xc
push 0x447ba4
push 0x105
lea edx, [ebp - 0x2a0]
push edx
call fcn.0041e5a9
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 0x105
lea ecx, [ebp - 0x2a0]
push ecx
call fcn.0041e5a9
add esp, 0xc
lea edx, [ebp - 0x2a0]
mov dword [ebp - 0x334], edx
lea eax, [ebp - 0x2a0]
push eax
call fcn.0041d842
add esp, 4
movzx ecx, ax
shl ecx, 1
mov word [ebp - 0x338], cx
movzx edx, word [ebp - 0x338]
add edx, 2
mov word [ebp - 0x336], dx
push 0
push 0x443d24
call fcn.00437060
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0
je 0x43583c
lea eax, [ebp - 0x338]
push eax
call dword [ebp - 0x330]
mov dword [ebp - 0x33c], eax
xor ecx, ecx
cmp dword [ebp - 0x33c], 0
setge cl
mov byte [ebp - 0x25], cl
movzx edx, byte [ebp - 0x25]
test edx, edx
je 0x435826
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x43583c
mov eax, dword [ebp - 0x33c]
push eax
call fcn.00432610
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x328], eax
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x324]
push eax
call fcn.00432570
add esp, 8
mov ecx, dword [ebp - 0x328]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x435897
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x328], eax
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x328], eax
mov ecx, dword [ebp - 0x324]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x328]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, byte [ebp - 0x25]
test eax, eax
jne 0x435903
movzx ecx, byte [ebp - 0x1d]
test ecx, ecx
je 0x435903
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x340], eax
mov byte [ebp - 4], 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
push 0x22e008
mov eax, dword [ebp + 8]
push eax
call fcn.00435270
add esp, 0x14
mov ecx, dword [ebp - 0x340]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, byte [ebp - 0x25]
mov esp, ebp
pop ebp
ret 4