Function at 0x426f20
Capabilities:
Enumerate services
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
xor eax, eax
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
cmp esi, eax
jne 0x426f52
push str.VNLStopService:_invalid_parameter
push 1
call fcn.004343f0
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push ebx
push edi
push eax
push esi
push str.VNLStopService:_Attempting_to_stop_service:__S__stop_dependents___d_
push 0x20
call fcn.004343f0
add esp, 0x10
push 0xf003f
push str.ServicesActive
push 0
call dword [0x465034]
mov ebx, dword [0x4651b0]
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
jne 0x427095
call ebx
cmp eax, 5
je 0x426fd8
cmp eax, 0x57
je 0x426fc5
cmp eax, 0x429
je 0x426fb2
push eax
push str.VNLStopService:_Service_Manager_open_failed:_0x_08X
push 1
call fcn.004343f0
add esp, 0xc
jmp 0x426ff3
push str.VNLStopService:_Service_Manager_open_failed:_ERROR_DATABASE_DOES_NOT_EXIST
push 1
call fcn.004343f0
push str.VNLStopService:_Service_Manager_open_failed:_system_config_appears_to_be_corrupt
jmp 0x426fe9
push str.VNLStopService:_Service_Manager_open_failed:_ERROR_INVALID_PARAMETER
push 1
call fcn.004343f0
push str.VNLStopService:_Service_Manager_open_failed:_system_config_appears_to_be_corrupt
jmp 0x426fe9
push str.VNLStopService:_Service_Manager_open_failed:_ERROR_ACCESS_DENIED
push 1
call fcn.004343f0
push str.VNLStopService:_Service_Manager_open_failed:_you_must_be_an_administrator
push 1
call fcn.004343f0
add esp, 0x10
push 0x80000000
push str.ServicesActive
push 0
call dword [0x465034]
mov edi, eax
mov dword [ebp - 4], eax
test edi, edi
jne 0x42708c
call ebx
cmp eax, 5
je 0x427059
cmp eax, 0x57
je 0x427046
cmp eax, 0x429
je 0x427033
push eax
push str.VNLStopService:_Service_Manager_open_failed:_0x_08X
push 1
call fcn.004343f0
add esp, 0xc
jmp 0x427074
push str.VNLStopService:_Service_Manager_open_failed:_ERROR_DATABASE_DOES_NOT_EXIST
push 1
call fcn.004343f0
push str.VNLStopService:_Service_Manager_open_failed:_system_config_appears_to_be_corrupt
jmp 0x42706a
push str.VNLStopService:_Service_Manager_open_failed:_ERROR_INVALID_PARAMETER
push 1
call fcn.004343f0
push str.VNLStopService:_Service_Manager_open_failed:_system_config_appears_to_be_corrupt
jmp 0x42706a
push str.VNLStopService:_Service_Manager_open_failed:_ERROR_ACCESS_DENIED
push 1
call fcn.004343f0
push str.VNLStopService:_Service_Manager_open_failed:_you_must_be_an_administrator
push 1
call fcn.004343f0
add esp, 0x10
push str.VNLStopService:_service_stop_failed
push 1
call fcn.004343f0
add esp, 8
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push str.VNLStopService:_Service_Manager_successfully_opened_with_reduced_permissions
push 2
jmp 0x42709c
push str.VNLStopService:_Service_Manager_successfully_opened
push 0x10
call fcn.004343f0
add esp, 8
push 0xf01ff
push esi
push edi
call dword [0x465038]
mov ebx, eax
mov dword [ebp - 0x18], ebx
test ebx, ebx
jne 0x42721f
call dword [0x4651b0]
mov dword [ebp - 0xc], ebx
cmp eax, 0x7b
ja 0x427107
je 0x4270f8
mov ecx, eax
sub ecx, 5
je 0x4270e9
sub ecx, 1
jne 0x42710e
push esi
push str.VNLStopService:_Service__S_could_not_be_opened:_ERROR_INVALID_HANDLE
push 1
call fcn.004343f0
jmp 0x427135
push esi
push str.VNLStopService:_Service__S_could_not_be_opened:_ERROR_ACCESS_DENIED
push 1
call fcn.004343f0
jmp 0x427135
push esi
push str.VNLStopService:_Service__S_could_not_be_opened:_ERROR_INVALID_NAME
push 1
call fcn.004343f0
jmp 0x427135
cmp eax, 0x424
je 0x427121
push eax
push esi
push str.VNLStopService:_Service__S_could_not_be_opened:_0x_08x
push 1
call fcn.004343f0
add esp, 0x10
jmp 0x427138
push esi
push str.VNLStopService:_Service__S_could_not_be_opened:_ERROR_SERVICE_DOES_NOT_EXIST
push 4
call fcn.004343f0
mov dword [ebp - 0xc], 1
add esp, 0xc
push 0x24
push esi
push edi
call dword [0x465038]
mov ebx, eax
mov dword [ebp - 0x18], eax
test ebx, ebx
jne 0x427215
call dword [0x4651b0]
cmp eax, 0x7b
ja 0x4271c8
je 0x4271a8
mov ecx, eax
sub ecx, 5
je 0x427188
sub ecx, 1
jne 0x4271cf
push esi
push str.VNLStopService:_Service__S_could_not_be_opened:_ERROR_INVALID_HANDLE
push 1
call fcn.004343f0
add esp, 0xc
push edi
call dword [0x46503c]
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push esi
push str.VNLStopService:_Service__S_could_not_be_opened:_ERROR_ACCESS_DENIED
push 1
call fcn.004343f0
add esp, 0xc
push edi
call dword [0x46503c]
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push esi
push str.VNLStopService:_Service__S_could_not_be_opened:_ERROR_INVALID_NAME
push 1
call fcn.004343f0
add esp, 0xc
push edi
call dword [0x46503c]
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0x424
je 0x4271f0
push eax
push esi
push str.VNLStopService:_Service__S_could_not_be_opened:_0x_08x
push 1
call fcn.004343f0
add esp, 0x10
push edi
call dword [0x46503c]
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push esi
push str.VNLStopService:_Service__S_could_not_be_opened:_ERROR_SERVICE_DOES_NOT_EXIST
push 4
call fcn.004343f0
add esp, 0xc
push edi
mov ebx, 1
call dword [0x46503c]
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push esi
push str.VNLStopService:_Service__S_successfully_opened_with_reduced_permissions
push 2
jmp 0x427227
push esi
push str.VNLStopService:_Service__S_successfully_opened
push 0x10
call fcn.004343f0
add esp, 0xc
lea ecx, [ebp - 0x38]
push ecx
push ebx
call dword [0x465044]
test eax, eax
jne 0x42726b
call dword [0x4651b0]
push eax
push esi
push str.VNLStopService:_Could_not_query_service__S_status:_0x_08x
push 1
call fcn.004343f0
mov esi, dword [0x46503c]
add esp, 0x10
push ebx
call esi
push edi
call esi
mov eax, dword [ebp - 0xc]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x34]
lea edx, [eax - 1]
cmp edx, 6
ja 0x42727f
mov eax, dword [eax*4 + 0x4a54cc]
jmp 0x427284
mov eax, dword [str.INVALID]
mov ecx, dword [ebp - 0x24]
push ecx
push eax
push esi
push str.VNLStopService:_service__S_status:__s_cp0x_08x
push 0x20
call fcn.004343f0
mov eax, dword [ebp - 0x34]
mov edi, dword [ebp - 0x20]
add esp, 0x14
cmp eax, 3
jne 0x42736f
jmp 0x4272b0
push 0x1f4
call dword [0x4651d8]
lea edx, [ebp - 0x38]
mov eax, 0x1f4
add dword [ebp - 0x10], eax
add dword [ebp - 0x14], eax
push edx
push ebx
call dword [0x465044]
test eax, eax
je 0x42739f
mov eax, dword [ebp - 0x34]
lea ecx, [eax - 1]
cmp ecx, 6
ja 0x4272ed
mov eax, dword [eax*4 + 0x4a54cc]
jmp 0x4272f2
mov eax, dword [str.INVALID]
mov edx, dword [ebp - 0x24]
push edx
push eax
push esi
push str.VNLStopService:_service__S_status:__s_cp0x_08x
push 2
call fcn.004343f0
mov eax, dword [ebp - 0x24]
add esp, 0x14
cmp eax, dword [ebp - 8]
jbe 0x427331
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
push eax
push str.VNLStopService:_Updating_sleep_hint:__d
push 0x20
call fcn.004343f0
mov edi, dword [ebp - 0x20]
add esp, 0xc
mov dword [ebp - 0x10], 0
jmp 0x427363
cmp dword [ebp - 0x10], edi
jbe 0x427363
push str.VNLStopService:_Slept_hint_duration_without_any_progress
push 0x20
call fcn.004343f0
add esp, 8
cmp dword [ebp - 0x14], 0x7530
jae 0x4273bf
mov ecx, dword [ebp - 0x14]
push ecx
push 0x1e
push str.VNLStopService:_Not_giving_up_yet_since_havent_slept_for__i_seconds:__d
push 0x20
call fcn.004343f0
add esp, 0x10
mov eax, dword [ebp - 0x34]
cmp eax, 3
je 0x4272b0
cmp eax, 1
jne 0x4273d9
push esi
push str.VNLStopService:_Service__S_already_stopped
push 0x10
call fcn.004343f0
mov esi, dword [0x46503c]
add esp, 0xc
push ebx
call esi
mov edx, dword [ebp - 4]
push edx
call esi
pop edi
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
call dword [0x4651b0]
push eax
push esi
push str.VNLStopService:_Could_not_query_service__S_status__presume_stopped:_0x_08x
push 1
call fcn.004343f0
add esp, 0x10
mov dword [ebp - 0x34], 1
jmp 0x427374
push 0x1e
push str.VNLStopService:_Slept_for__i_seconds__giving_up
push 1
call fcn.004343f0
add esp, 0xc
mov dword [ebp - 0x34], 1
jmp 0x427374
cmp dword [ebp + 0xc], 0
je 0x427515
xor edi, edi
push str.VNLStopService:_Stopping_dependents__if_any
push 0x20
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], edi
call fcn.004343f0
add esp, 8
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 8]
push ecx
push edi
push edi
push 1
push ebx
call dword [0x46502c]
test eax, eax
je 0x42741d
push str.VNLStopService:_No_dependents_exist
push 0x10
jmp 0x42751c
call dword [0x4651b0]
cmp eax, 0xea
je 0x427440
push eax
push esi
push str.VNLStopService:_Enumeration_of__S_failed_for_unexpected_reason:_0x_08x
push 1
call fcn.004343f0
add esp, 0x10
jmp 0x427524
push str.VNLStopService:_Dependents_exist
push 0x20
call fcn.004343f0
mov edx, dword [ebp - 8]
push edx
call fcn.00405d04
mov edi, eax
add esp, 0xc
mov dword [ebp - 0x1c], edi
test edi, edi
jne 0x42746d
push str.VNLStopService:_couldnt_allocate_memory_to_enumerate_dependencies
push 1
jmp 0x42751c
mov eax, dword [ebp - 8]
push eax
push 0
push edi
call fcn.00405300
mov eax, dword [ebp - 8]
add esp, 0xc
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 8]
push edx
push eax
push edi
push 1
push ebx
call dword [0x46502c]
test eax, eax
jne 0x4274b3
push 0xea
push esi
push str.VNLStopService:_Enumeration_of__S_failed_for_unexpected_reason:_0x_08x
push 1
call fcn.004343f0
push edi
call fcn.00403d53
add esp, 0x14
jmp 0x427524
xor ebx, ebx
cmp dword [ebp - 0x14], ebx
jbe 0x427501
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp - 0x10]
mov ecx, 9
lea edi, [ebp - 0x5c]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x5c]
push esi
push ebx
push str.VNLStopService:_Attempting_to_stop___d__S
push 0x20
call fcn.004343f0
push 0
push esi
call fcn.00426f20
push esi
push ebx
push str.VNLStopService:_Done_stopping___d__S
push 0x20
call fcn.004343f0
add dword [ebp - 0x10], 0x24
inc ebx
add esp, 0x28
cmp ebx, dword [ebp - 0x14]
jb 0x4274c0
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00403d53
mov esi, dword [ebp + 8]
mov ebx, dword [ebp - 0x18]
add esp, 4
jmp 0x427524
push str.VNLStopService:_Not_told_to_stop_dependents
push 0x20
call fcn.004343f0
add esp, 8
lea eax, [ebp - 0x38]
push eax
push 1
push ebx
call dword [0x465030]
test eax, eax
jne 0x4275e3
call dword [0x4651b0]
cmp eax, 0x426
je 0x4275b8
cmp eax, 0x6d
je 0x42758d
cmp eax, 0x41b
jne 0x427564
push esi
push str.VNLStopService:_Service__S_could_not_be_stopped:_need_to_stop_dependents
push 1
call fcn.004343f0
add esp, 0xc
jmp 0x427575
push eax
push esi
push str.VNLStopService:_Service__S_could_not_be_stopped:_0x_08x
push 1
call fcn.004343f0
add esp, 0x10
mov esi, dword [0x46503c]
push ebx
call esi
mov ecx, dword [ebp - 4]
push ecx
call esi
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push esi
push str.VNLStopService:_Broken_pipe_for__S__service_may_already_have_stopped
push 1
call fcn.004343f0
mov esi, dword [0x46503c]
add esp, 0xc
push ebx
call esi
mov edx, dword [ebp - 4]
push edx
call esi
pop edi
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push esi
push str.VNLStopService:_Service__S_is_already_stopped
push 1
call fcn.004343f0
mov esi, dword [0x46503c]
add esp, 0xc
push ebx
call esi
mov eax, dword [ebp - 4]
push eax
call esi
pop edi
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push str.VNLStopService:_Successfully_sent_stop_command
push 0x10
call fcn.004343f0
add esp, 8
lea ecx, [ebp - 0x38]
push ecx
push ebx
call dword [0x465044]
test eax, eax
jne 0x427631
call dword [0x4651b0]
push eax
push esi
push str.VNLStopService:_Could_not_query_service__S_status:_0x_08x
push 1
call fcn.004343f0
mov esi, dword [0x46503c]
add esp, 0x10
push ebx
call esi
mov edx, dword [ebp - 4]
push edx
call esi
mov eax, dword [ebp - 0xc]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.004269c0
add esp, 4
push eax
push str.VNLStopService:_service_status:__s_cp0x_08x
push 0x20
call fcn.004343f0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
add esp, 0x10
xor edi, edi
xor ebx, ebx
cmp dword [ebp - 0x34], 3
mov dword [ebp - 8], edx
mov dword [ebp + 8], eax
jne 0x427753
jmp 0x427670
push 0x1f4
call dword [0x4651d8]
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x38]
push ecx
push edx
add edi, 0x1f4
add ebx, 0x1f4
call dword [0x465044]
test eax, eax
je 0x427732
mov eax, dword [ebp - 0x34]
lea ecx, [eax - 1]
cmp ecx, 6
ja 0x4276b1
mov eax, dword [eax*4 + 0x4a54cc]
jmp 0x4276b6
mov eax, dword [str.INVALID]
mov edx, dword [ebp - 0x24]
push edx
push eax
push str.VNLStopService:_service_status:__s_cp0x_08x
push 0x20
call fcn.004343f0
mov eax, dword [ebp - 0x24]
add esp, 0x10
cmp eax, dword [ebp - 8]
jbe 0x4276f2
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
push eax
push str.VNLStopService:_Updating_sleep_hint:__d
push 0x20
call fcn.004343f0
mov ecx, dword [ebp - 0x20]
add esp, 0xc
mov dword [ebp + 8], ecx
xor edi, edi
jmp 0x427726
cmp dword [ebp - 0x34], 1
je 0x427726
cmp edi, dword [ebp + 8]
jbe 0x427726
push str.VNLStopService:_Slept_hint_duration_without_any_progress
push 0x20
call fcn.004343f0
add esp, 8
cmp ebx, 0x7530
jae 0x427741
push ebx
push 0x1e
push str.VNLStopService:_Not_giving_up_yet_since_havent_slept_for__i_seconds:__d
push 0x20
call fcn.004343f0
add esp, 0x10
cmp dword [ebp - 0x34], 3
je 0x427670
jmp 0x427753
call dword [0x4651b0]
push eax
push esi
push str.VNLStopService:_Could_not_query_service__S_status:_0x_08x
jmp 0x427749
push esi
push 0x1e
push str.VNLStopService:_Slept_for__i_seconds___S___giving_up
push 1
call fcn.004343f0
add esp, 0x10
mov eax, dword [ebp - 0x34]
cmp eax, 1
jne 0x427771
push str.VNLStopService:_Service_is_stopped
push 0x10
call fcn.004343f0
add esp, 8
mov edi, 1
jmp 0x42778b
push eax
call fcn.004269c0
push eax
push esi
push str.VNLStopService:_Service__S_is_not_stopped:__s
push 1
call fcn.004343f0
mov edi, dword [ebp - 0xc]
add esp, 0x14
mov edx, dword [ebp - 0x18]
mov esi, dword [0x46503c]
push edx
call esi
mov eax, dword [ebp - 4]
push eax
call esi
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret