Function at 0x4056b0
Capabilities:
Check for time delay via gettickcount
Enumerate services
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40b5a8
push 0x40ac80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x70
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x3c], 0xbb8
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov esi, eax
mov dword [ebp - 0x40], esi
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [edi + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x405715
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x34]
cmp eax, 1
je 0x405a03
cmp eax, 3
jne 0x405765
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [edi + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x405996
cmp dword [ebp - 0x34], 1
je 0x405a03
call ebx
sub eax, esi
cmp eax, 0xbb8
ja 0x405933
cmp dword [ebp - 0x34], 3
je 0x405726
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 1
mov ecx, dword [edi + 8]
push ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_EnumDependentServicesA]
call ebx
test eax, eax
jne 0x40597e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
call esi
cmp eax, 0xea
je 0x4057ab
call esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x4c]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x44], esi
test esi, esi
jne 0x4057de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x4c]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
push esi
push 1
mov eax, dword [edi + 8]
push eax
call ebx
test eax, eax
jne 0x405827
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
push ecx
call sub.MSVCRT.dll__local_unwind2
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov dword [ebp - 0x74], ebx
cmp ebx, dword [ebp - 0x48]
jae 0x405972
lea edx, [ebx + ebx*8]
lea esi, [esi + edx*4]
mov ecx, 9
lea edi, [ebp - 0x70]
rep movsd dword es:[edi], dword [esi]
push 0x24
mov eax, dword [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x80]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
mov dword [ebp - 0x78], esi
test esi, esi
jne 0x40588a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call sub.MSVCRT.dll__local_unwind2
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 1
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x38]
push ecx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4058cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0xffffffffffffffff
lea edx, [ebp - 0x10]
push edx
call sub.MSVCRT.dll__local_unwind2
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x34], edi
je 0x405949
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x38]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x405912
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0xffffffffffffffff
lea edx, [ebp - 0x10]
push edx
call sub.MSVCRT.dll__local_unwind2
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x34], edi
je 0x405949
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x3c]
jbe 0x4058cb
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call sub.MSVCRT.dll__local_unwind2
add esp, 8
mov eax, 0x5b4
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
call fcn.0040596a
inc ebx
mov dword [ebp - 0x74], ebx
mov edi, dword [ebp - 0x80]
mov esi, dword [ebp - 0x44]
jmp 0x40582c
mov dword [ebp - 4], 0xffffffff
call fcn.004059b3
lea ecx, [ebp - 0x38]
push ecx
mov ebx, 1
push ebx
mov edx, dword [edi + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4059c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x34], ebx
je 0x405a03
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x38]
push ecx
mov edx, dword [edi + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x405996
cmp dword [ebp - 0x34], ebx
je 0x405a03
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, dword [ebp - 0x3c]
ja 0x405933
cmp dword [ebp - 0x34], ebx
jne 0x4059cc
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret