Function at 0x40d5a0
Capabilities:
Modify service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x413008]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x22c], 6
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x230], 0x1000
push 0x415584
call fcn.0040c800
push 0x200
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.00401700
add esp, 0xc
mov ecx, dword [ebp - 0x22c]
and ecx, 0xffff
movzx edx, cx
shl edx, 0x10
push edx
push 0
push 0x401
mov eax, dword [0x418cf8]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x402
mov ecx, dword [0x418cf8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x404
mov edx, dword [0x418cf8]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x417040], 0
jne 0x40d684
push 0x4155a8
push 0x4155c4
push 0x4155e8
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x40d8db
push 0
push 0
push 0x405
mov ecx, dword [0x418cf8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jne 0x40d6bd
jmp 0x40d8db
push 0
push 0
push 0x405
mov edx, dword [0x418cf8]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xf01ff
push str.Dhcp
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x40d6fe
jmp 0x40d8db
push 0
push 0
push 0x405
mov ecx, dword [0x418cf8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [ebp - 0x228]
push edx
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x224], 4
jne 0x40d77b
push 0x415600
push 0x415608
push 0x41562c
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
mov edx, dword [ebp - 0x22c]
push edx
push 0x402
mov eax, dword [0x418cf8]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x418cfc]
push ecx
call fcn.0040c7d0
jmp 0x40d8db
push 0
push 0
push 0x405
mov edx, dword [0x418cf8]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x230]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov edx, dword [ebp - 0x230]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jne 0x40d7cc
jmp 0x40d8db
lea eax, [ebp - 0x230]
push eax
push 0x1000
mov ecx, dword [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x40d7f5
jmp 0x40d8db
push 0
push 0
push 0x405
mov eax, dword [0x418cf8]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x238]
cmp dword [ecx + 4], 4
jne 0x40d88b
mov edx, dword [ebp - 0x238]
mov dword [edx + 4], 3
mov eax, dword [ebp - 0x238]
mov ecx, dword [eax + 0x20]
push ecx
push 0
mov edx, dword [ebp - 0x238]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp - 0x238]
mov edx, dword [ecx + 0x18]
push edx
mov eax, dword [ebp - 0x238]
add eax, 0x14
push eax
mov ecx, dword [ebp - 0x238]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x238]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 0x238]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x238]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x238]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 0
push 0
push 0x405
mov eax, dword [0x418cf8]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 0x415638
push str.ck_W_
push 0x415664
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [0x418cfc]
push eax
call fcn.0040c7d0
lea ecx, [ebp - 0x208]
push ecx
call fcn.0040c800
cmp dword [ebp - 0x238], 0
je 0x40d8fd
mov edx, dword [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x234], 0
je 0x40d913
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x20c], 0
je 0x40d929
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401006
mov esp, ebp
pop ebp
ret