Function at 0x40e630
Capabilities:
Check for time delay via gettickcount
Delete service
Modify service
Query service status

Disassembly:
push 0xffffffffffffffff
push 0x48bfe5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9b0
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
xor ebp, ebp
push edi
push ebp
mov dword [esp + 0x20], ecx
push str.Q360SDClass
call esi
test eax, eax
je 0x40e693
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, ebp
inc ebp
cmp ecx, 5
jge 0x40e693
push 0
push 0
push 0x12
push eax
call edi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.Q360SDClass
call esi
test eax, eax
jne 0x40e66d
lea ecx, [esp + 0x10]
call fcn.004222a0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebp, ebp
mov dword [esp + 0x9c8], ebp
call edi
mov esi, eax
call edi
sub eax, esi
or ebx, 0xffffffff
cmp eax, 0x2710
jae 0x40e6f1
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.360sd.exe
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x18]
call fcn.004223d0
cmp eax, ebx
je 0x40e6f1
push eax
lea ecx, [esp + 0x14]
call fcn.00422570
call edi
sub eax, esi
cmp eax, 0x2710
jb 0x40e6bd
lea ecx, [esp + 0x10]
mov dword [esp + 0x9c8], ebx
call fcn.004222d0
lea ecx, [esp + 0x10]
call fcn.004222a0
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.360Quart.exe
mov dword [esp + 0x9d4], 1
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x18]
call fcn.004223d0
cmp eax, ebx
je 0x40e73e
push eax
lea ecx, [esp + 0x14]
call fcn.00422570
lea ecx, [esp + 0x10]
mov dword [esp + 0x9c8], ebx
call fcn.004222d0
lea ecx, [esp + 0x10]
call fcn.004222a0
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.LiveUpdate360.exe
mov dword [esp + 0x9d4], 2
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x18]
call fcn.004223d0
cmp eax, ebx
je 0x40e78b
push eax
lea ecx, [esp + 0x14]
call fcn.00422570
lea ecx, [esp + 0x10]
mov dword [esp + 0x9c8], ebx
call fcn.004222d0
lea ecx, [esp + 0x10]
call fcn.004222a0
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.360sdupd.exe
mov dword [esp + 0x9d4], 3
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x18]
call fcn.004223d0
cmp eax, ebx
je 0x40e7d8
push eax
lea ecx, [esp + 0x14]
call fcn.00422570
lea ecx, [esp + 0x10]
mov dword [esp + 0x9c8], ebx
call fcn.004222d0
lea ecx, [esp + 0x10]
call fcn.004222a0
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.360prox.exe
mov dword [esp + 0x9d4], 4
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x18]
call fcn.004223d0
cmp eax, ebx
je 0x40e825
push eax
lea ecx, [esp + 0x14]
call fcn.00422570
lea ecx, [esp + 0x10]
mov dword [esp + 0x9c8], ebx
call fcn.004222d0
lea ecx, [esp + 0x10]
call fcn.004222a0
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.360nq.exe
mov dword [esp + 0x9d4], 5
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x18]
call fcn.004223d0
cmp eax, ebx
je 0x40e872
push eax
lea ecx, [esp + 0x14]
call fcn.00422570
lea ecx, [esp + 0x10]
mov dword [esp + 0x9c8], ebx
call fcn.004222d0
xor eax, eax
mov ecx, 6
lea edi, [esp + 0x24]
push 0xf003f
mov dword [esp + 0x24], ebp
push eax
rep stosd dword es:[edi], eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test eax, eax
mov dword [esp + 0x14], eax
je 0x40e8bb
push 0x10016
push str.360rp
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, eax
mov al, byte [esp + 0x9d0]
test al, al
je 0x40e90e
push 1
call fcn.0041e9f0
add esp, 4
test eax, eax
jne 0x40e90e
lea ecx, [esp + 0x10]
call fcn.0041a310
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x9cc], 6
call fcn.0041a350
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x10]
mov dword [esp + 0x9c8], ebx
call fcn.0041a340
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov esi, eax
mov dword [esp + 0x18], esi
call edi
sub eax, esi
cmp eax, 0x7530
jae 0x40ea6e
xor esi, esi
test ebp, ebp
je 0x40e9be
lea edx, [esp + 0x20]
push edx
push ebp
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40e9be
cmp dword [esp + 0x24], 1
je 0x40e9be
push 1
lea ecx, [esp + 0x40]
call fcn.00421a10
push 3
lea ecx, [esp + 0x40]
mov dword [esp + 0x9cc], 7
call fcn.00421a90
mov esi, 1
mov dword [esp + 0x3c], 0x495d90
lea ecx, [esp + 0x40]
mov dword [esp + 0x9c8], 9
call fcn.00421d60
lea ecx, [esp + 0x2a0]
call fcn.00421d60
lea ecx, [esp + 0x2a0]
mov byte [esp + 0x9c8], 8
call fcn.00421cb0
lea ecx, [esp + 0x40]
mov dword [esp + 0x9c8], ebx
call fcn.00421cb0
push 1
call fcn.0041e9f0
add esp, 4
test eax, eax
je 0x40ea59
lea ecx, [esp + 0x500]
call fcn.00421940
mov al, byte [esp + 0x9d0]
lea ecx, [esp + 0x500]
neg al
sbb eax, eax
mov dword [esp + 0x9c8], 0xa
add eax, 2
push eax
call fcn.004219a0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x500]
mov dword [esp + 0x9c8], 0xc
call fcn.00421d60
lea ecx, [esp + 0x760]
call fcn.00421d60
lea ecx, [esp + 0x760]
mov byte [esp + 0x9c8], 0xb
call fcn.00421cb0
lea ecx, [esp + 0x500]
mov dword [esp + 0x9c8], ebx
call fcn.00421cb0
jmp 0x40ea5d
test esi, esi
je 0x40ea6e
call edi
sub eax, dword [esp + 0x18]
cmp eax, 0x7530
jb 0x40e92b
mov al, byte [esp + 0x9d0]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test al, al
je 0x40eaa3
test ebp, ebp
je 0x40eaaa
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 3
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push ebp
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test ebp, ebp
je 0x40eaaa
push ebp
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40eab5
push eax
call esi
push 1
call fcn.0041e9f0
add esp, 4
test eax, eax
je 0x40eb11
lea ecx, [esp + 0x10]
call fcn.004222a0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.360rp.exe
mov dword [esp + 0x9d4], 0xd
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x18]
call fcn.004223d0
cmp eax, ebx
je 0x40eb01
push eax
lea ecx, [esp + 0x14]
call fcn.00422570
lea ecx, [esp + 0x10]
mov dword [esp + 0x9c8], ebx
call fcn.004222d0
lea ecx, [esp + 0x18]
call fcn.004222a0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.360rps.exe
mov dword [esp + 0x9d4], 0xe
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x20]
call fcn.004223d0
cmp eax, ebx
je 0x40eb4f
push eax
lea ecx, [esp + 0x1c]
call fcn.00422570
lea ecx, [esp + 0x18]
mov dword [esp + 0x9c8], ebx
call fcn.004222d0
mov ecx, dword [esp + 0x1c]
call fcn.0040e0e0
mov ecx, dword [esp + 0x9c0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x9bc
ret 4