Function at 0x401f80
Capabilities:
Delete service
Query or enumerate registry value
Query service status
Set registry value
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x43fad8
push 0x41a270
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x1048
call fcn.0042cb70
mov eax, dword [0x441080]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x1054], 0
xor edi, edi
mov dword [ebp - 0x1050], edi
xor ebx, ebx
mov dword [ebp - 0x104c], ebx
mov dword [ebp - 0x1044], ebx
mov dword [ebp - 4], ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x1054], eax
test eax, eax
jne 0x40200a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x1048], esi
jmp 0x4021c8
push 0xf01ff
push str.Sectdr
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
mov dword [ebp - 0x1050], edi
test edi, edi
je 0x401ff7
lea eax, [ebp - 0x1040]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x402080
push 0x1f4
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
xor esi, esi
mov dword [ebp - 0x1058], esi
cmp esi, 5
jge 0x40207a
lea eax, [ebp - 0x1040]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40207a
cmp dword [ebp - 0x103c], 3
jne 0x40207a
push 0x1f4
call ebx
inc esi
jmp 0x40204a
mov ebx, dword [ebp - 0x104c]
lea eax, [ebp - 0x1020]
push eax
push 0x800
lea eax, [ebp - 0x81c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x401ff7
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x105c], eax
lea eax, [ebp - 0x1044]
push eax
push str.SYSTEMCurrentControlSetControlGroupOrderList
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
mov dword [ebp - 0x1048], esi
test esi, esi
jne 0x4021c8
mov dword [ebp - 0x1020], 0x800
lea eax, [ebp - 0x1020]
push eax
lea eax, [ebp - 0x101c]
push eax
lea eax, [ebp - 0x1024]
push eax
push esi
push str.PNP_TDI
push dword [ebp - 0x1044]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov dword [ebp - 0x1048], esi
test esi, esi
jne 0x4021c8
mov esi, dword [ebp - 0x1020]
shr esi, 2
mov dword [ebp - 0x1020], esi
mov ecx, 1
mov dword [ebp - 0x1060], ecx
mov eax, dword [ebp - 0x105c]
cmp ecx, esi
jae 0x402171
lea edx, [ebp - 0x101c]
lea edx, [edx + ecx*4]
cmp dword [edx], eax
jne 0x4021f9
mov eax, esi
sub eax, ecx
lea eax, [eax*4 - 4]
push eax
lea eax, [ebp - 0x1018]
lea eax, [eax + ecx*4]
push eax
push edx
call fcn.00419b50
add esp, 0xc
dec esi
mov dword [ebp - 0x1020], esi
lea eax, [esi - 1]
mov dword [ebp - 0x101c], eax
lea eax, [esi*4]
push eax
lea eax, [ebp - 0x101c]
push eax
push dword [ebp - 0x1024]
push 0
push str.PNP_TDI
push dword [ebp - 0x1044]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov dword [ebp - 0x1048], esi
test esi, esi
jne 0x4021c8
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x401ff7
mov ebx, 1
mov dword [ebp - 0x104c], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.00402217
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0041908f
mov esp, ebp
pop ebp
ret
inc ecx
mov dword [ebp - 0x1060], ecx
jmp 0x402136