Function at 0x430840
Capabilities:
Enumerate services
Query service configuration
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x25468
call fcn.00450200
push edi
push 4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x43086a
xor eax, eax
jmp 0x430b09
mov dword [ebp - 8], 0x24000
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x24020]
push ecx
push 1
push 0x30
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x4308cb
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x430b09
mov dword [ebp - 4], 0
jmp 0x4308dd
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x18]
jae 0x430afd
push 0x35
mov eax, dword [ebp - 4]
imul eax, eax, 0x24
mov ecx, dword [ebp + eax - 0x24020]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x24424], eax
cmp dword [ebp - 0x24424], 0
jne 0x430914
jmp 0x4308d4
mov al, byte [0x47a6f3]
mov byte [ebp - 0x24828], al
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x24827]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x47a6f4]
mov byte [ebp - 0x25428], cl
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x25427]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0x47a6f5]
mov byte [ebp - 0x24420], dl
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x2441f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x47a6f6]
mov byte [ebp - 0x24c28], al
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x24c27]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x47a6f7]
mov byte [ebp - 0x25028], cl
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x25027]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x24828]
mov dword [ebp - 0x2545c], edx
lea eax, [ebp - 0x24420]
mov dword [ebp - 0x25450], eax
lea ecx, [ebp - 0x25428]
mov dword [ebp - 0x25458], ecx
lea edx, [ebp - 0x24c28]
mov dword [ebp - 0x2544c], edx
lea eax, [ebp - 0x25028]
mov dword [ebp - 0x25448], eax
lea ecx, [ebp - 0x10]
push ecx
push 0x1424
lea edx, [ebp - 0x25468]
push edx
mov eax, dword [ebp - 0x24424]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x430a17
mov ecx, dword [ebp - 0x24424]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4308d4
lea edx, [ebp - 0x25444]
push edx
mov eax, dword [ebp - 0x24424]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x25440], 4
je 0x430a46
mov ecx, dword [ebp - 0x24424]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4308d4
mov edx, dword [ebp + 8]
push edx
call fcn.00450240
add esp, 4
push eax
mov eax, dword [ebp - 0x2545c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00452c17
add esp, 0xc
test eax, eax
je 0x430a7c
mov edx, dword [ebp - 0x24424]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4308d4
lea eax, [ebp - 0x25444]
push eax
push 1
mov ecx, dword [ebp - 0x24424]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea edx, [ebp - 0x25444]
push edx
mov eax, dword [ebp - 0x24424]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x430ac4
cmp dword [ebp - 0x25440], 3
jne 0x430ac0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x430ac2
jmp 0x430ac4
jmp 0x430a92
cmp dword [ebp - 0x25440], 1
je 0x430adf
mov ecx, dword [ebp - 0x24424]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4308d4
mov edx, dword [ebp - 0x24424]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x430b09
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret