Function at 0x402ed0
Capabilities:
Enumerate services
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x451430]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
push str.StopService__S_n
mov dword [ebp - 0x4d4], esi
mov byte [ebp - 0x4b5], 0
mov dword [ebp - 0x4d0], 0
mov byte [ebp - 0x4b6], 0
call fcn.0040c2f0
add esp, 8
push 0
call fcn.004177f0
push esi
mov dword [ebp - 0x4cc], eax
call fcn.00402d40
mov edi, eax
test edi, edi
je 0x402f96
call fcn.00401000
mov ebx, eax
test ebx, ebx
je 0x402f5b
cmp ebx, 0xffffffff
je 0x402f5b
push 0
lea eax, [ebp - 0x4c4]
push eax
push 0
push 0
push 0
push 0
push 0x9edb6510
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea ecx, [ebp - 0x4d0]
push ecx
push str.LockDownEnabled
push edi
call fcn.00424450
push 0
push str.LockDownEnabled
push edi
call fcn.00424390
add esp, 0x18
test ebx, ebx
je 0x402f8d
cmp ebx, 0xffffffff
je 0x402f8d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.00422c60
add esp, 4
push esi
call fcn.004176a0
push 0xa0000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x4c4], ebx
jne 0x402fe2
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push str.StopService:_Unable_to_open_SCM___d__n
call fcn.0040c2f0
add esp, 8
call edi
push eax
push str.StopService:_Unable_to_open_SCM___d__n
call fcn.0042e111
add esp, 8
jmp 0x403371
mov dword [ebp - 0x4c0], 0xa
xor edi, edi
mov edi, edi
push 0x28
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
mov dword [ebp - 0x4bc], eax
jne 0x40302c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x424
je 0x403025
push edi
push esi
push str.StopService:_Unable_to_open_service__S_via_SCM___d__n
call fcn.0040c2f0
add esp, 0xc
jmp 0x40302c
mov byte [ebp - 0x4b5], 1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 5
jne 0x40304e
cmp dword [ebp - 0x4bc], 0
jne 0x40305b
sub dword [ebp - 0x4c0], 1
jne 0x402ff0
cmp dword [ebp - 0x4bc], 0
je 0x40336a
push esi
xor edi, edi
call fcn.00402d40
mov esi, eax
test esi, esi
je 0x4030ff
push 0x12c
lea edx, [ebp - 0x25c]
push edx
push 0x12c
lea eax, [ebp - 0x4b4]
push eax
push edi
push esi
call fcn.004230c0
add esp, 0x18
test al, al
je 0x4030f6
lea ecx, [ebp - 0x4b4]
push str.ServicePreStopCommand.
push ecx
add edi, 1
call fcn.00421cc0
add esp, 8
test eax, eax
jne 0x4030d0
lea edx, [ebp - 0x25c]
push edx
push str.Running_pre_stop_command__S_n
call fcn.0040c2f0
add esp, 8
push 1
lea eax, [ebp - 0x25c]
push eax
call fcn.00402e10
push 0x12c
lea ecx, [ebp - 0x25c]
push ecx
push 0x12c
lea edx, [ebp - 0x4b4]
push edx
push edi
push esi
call fcn.004230c0
add esp, 0x18
test al, al
jne 0x403093
push esi
call fcn.00422c60
add esp, 4
mov ecx, dword [ebp - 0x4bc]
lea eax, [ebp - 0x4f0]
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x40326d
mov esi, dword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x41b
jne 0x403240
xor edi, edi
cmp byte [ebp - 0x4b6], 0
mov dword [ebp - 0x4c8], edi
mov dword [ebp - 0x4c0], edi
jne 0x40327c
push str.Service_can_not_be_stopped_due_to_running_dependent_services___attempting_to_shut_dependent_services_down_n
call fcn.0040c2f0
mov ebx, dword [ebp - 0x4bc]
add esp, 4
lea edx, [ebp - 0x4c0]
push edx
lea eax, [ebp - 0x4c8]
push eax
push edi
push edi
push 1
push ebx
mov byte [ebp - 0x4b6], 1
call esi
test eax, eax
jne 0x4031d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x40328e
test edi, edi
je 0x4031a0
push edi
call fcn.0042df6a
add esp, 4
mov ecx, dword [ebp - 0x4c8]
push ecx
call fcn.0042e047
mov edi, eax
add esp, 4
test edi, edi
je 0x4032a4
mov ecx, dword [ebp - 0x4c8]
lea edx, [ebp - 0x4c0]
push edx
lea eax, [ebp - 0x4c8]
push eax
push ecx
push edi
push 1
push ebx
call esi
test eax, eax
je 0x403182
xor ebx, ebx
cmp dword [ebp - 0x4c0], ebx
jbe 0x40321e
mov esi, edi
mov edx, dword [esi]
push edx
push str.Attempting_to_stop_dependent_service__S_n
call fcn.0040c2f0
mov eax, dword [esi]
add esp, 8
push eax
call fcn.00402ed0
test al, al
jne 0x403210
mov ecx, dword [esi]
push ecx
push str.Could_not_stop_dependent_service__S_n
call fcn.0040c2f0
add esp, 8
add ebx, 1
add esi, 0x24
cmp ebx, dword [ebp - 0x4c0]
jb 0x4031e4
test edi, edi
je 0x40322b
push edi
call fcn.0042df6a
add esp, 4
mov eax, dword [ebp - 0x4bc]
lea edx, [ebp - 0x4f0]
push edx
push 1
push eax
jmp 0x40310f
sub eax, 0xb
je 0x40324a
sub eax, 0x35
jne 0x403251
mov byte [ebp - 0x4b5], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Stop_service_failed_0x_x_n
call fcn.0040c2f0
mov ebx, dword [ebp - 0x4bc]
add esp, 8
jmp 0x4032be
mov ebx, dword [ebp - 0x4bc]
mov byte [ebp - 0x4b5], 1
jmp 0x4032cb
push str.Service_can_not_be_stopped_due_to_running_dependent_services_n
call fcn.0040c2f0
mov ebx, dword [ebp - 0x4bc]
jmp 0x4032bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Stop_service_failed_due_to_dependencies_that_could_not_be_enumerated:__x_n
call fcn.0040c2f0
add esp, 8
jmp 0x4032b1
push str.Stop_service_failed_due_to_dependencies_that_could_not_be_enumerated__malloc_error__n
call fcn.0040c2f0
add esp, 4
test edi, edi
je 0x4032be
push edi
call fcn.0042df6a
add esp, 4
cmp byte [ebp - 0x4b5], 0
je 0x403353
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x4d4]
lea ecx, [ebp - 0x50c]
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x403359
mov ecx, dword [ebp - 0x508]
mov eax, ecx
sub eax, 1
je 0x403343
sub eax, 3
je 0x40332c
sub eax, 3
je 0x403315
push ecx
push esi
push str.waiting_on__S_service_to_report_RUNNING_or_STOPPED__current_state__x__n
call fcn.0040c2f0
add esp, 0xc
push 0x64
call edi
jmp 0x4032d7
push esi
push str._S_service_reports_PAUSED_n
call fcn.0040c2f0
add esp, 8
mov byte [ebp - 0x4b5], 0
jmp 0x403359
push esi
push str._S_service_reports_RUNNING__restarted___n
call fcn.0040c2f0
add esp, 8
mov byte [ebp - 0x4b5], 0
jmp 0x403359
push esi
push str._S_service_reports_STOPPED_n
call fcn.0040c2f0
add esp, 8
jmp 0x403359
mov esi, dword [ebp - 0x4d4]
test ebx, ebx
je 0x403364
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [ebp - 0x4c4]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 0x4cc]
push edx
call fcn.004177f0
cmp dword [ebp - 0x4d0], 0
je 0x403498
push esi
call fcn.00402d40
test eax, eax
mov dword [ebp - 0x4c4], eax
je 0x403498
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ebx, ebx
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..WGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4033ea
push 0
push 0x40000000
push 3
push 0
push 0
push SysReAllocString
push str..GlobalWGUARDNT
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4033ea
xor esi, esi
jmp 0x403410
test esi, esi
je 0x403410
cmp esi, 0xffffffff
je 0x403410
push 0
lea eax, [ebp - 0x4cc]
push eax
push 0
push 0
push 0
push 0
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [ebp - 0x4c4]
push 1
push str.LockDownEnabled
push ecx
call fcn.00424390
add esp, 0xc
test al, al
jne 0x403479
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x403465
cmp ebx, 0xa
jge 0x403465
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 1
test esi, esi
je 0x4033a6
cmp esi, 0xffffffff
je 0x4033a6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4033a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_set_LockDownEnabled___u_n
call fcn.0040c2f0
add esp, 8
test esi, esi
je 0x403489
cmp esi, 0xffffffff
je 0x403489
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x4c4]
push edx
call fcn.00422c60
add esp, 4
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x4b5]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d845
mov esp, ebp
pop ebp
ret 4