Function at 0x44f910
Capabilities:
Delete registry key
Modify service
Pause service
Query or enumerate registry value
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push 0xf003f
push ebx
push ebx
mov byte [ebp - 0x25], bl
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 1
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x40], esi
cmp esi, ebx
je 0x44fb0a
push 0xf01ff
push str.wuauserv
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x34], eax
cmp eax, ebx
je 0x44fb03
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 0x24]
push eax
push 1
push ebx
push str.SYSTEMCurrentControlSetServicesAeFilterTEMModeInfoWinUpdServ
mov edi, 4
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], edi
call esi
test eax, eax
jne 0x44f9ba
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x2c]
push edx
push ebx
push ebx
push str.StartupType
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44f9ba
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x44f9c8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x24]
push edx
push 1
push ebx
push str.SYSTEMCurrentControlSetServicesAeFilterTEMModeInfoWinUpdServ
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], edi
call esi
test eax, eax
jne 0x44fa0b
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push ebx
push ebx
push str.AutoDelayStartupType
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44fa0b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x44fa19
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x24]
push ecx
push 1
push ebx
push str.SYSTEMCurrentControlSetServicesAeFilterTEMModeInfoWinUpdServ
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], edi
call esi
test eax, eax
jne 0x44fa59
mov ecx, dword [ebp - 0x24]
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push str.CurrentServiceStatus
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, dword [ebp - 0x2c]
test eax, eax
je 0x44fa5b
mov edi, ebx
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x44fa69
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x34]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push edx
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
cmp dword [ebp - 0x38], ebx
je 0x44faaf
mov eax, dword [0x539d94]
cmp eax, 1
je 0x44faaf
cmp eax, 2
je 0x44faaf
cmp eax, 3
je 0x44faaf
lea eax, [ebp - 0x34]
push eax
push 3
push esi
mov dword [ebp - 0x34], 1
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
cmp edi, 3
je 0x44fae3
cmp edi, 1
je 0x44fae3
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x44faf8
cmp edi, 6
je 0x44fad0
cmp edi, 7
jne 0x44faf4
lea ecx, [ebp - 0x20]
push ecx
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x44faf4
jmp 0x44faf8
lea edx, [ebp - 0x20]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x44faf8
mov byte [ebp - 0x25], 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x40]
pop edi
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push str.SYSTEMCurrentControlSetServicesAeFilterTEMModeInfoWinUpdServ
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 4]
movzx eax, byte [ebp - 0x25]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d5564
mov esp, ebp
pop ebp
ret