Function at 0x48448c
Capabilities:
Stop service
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
mov eax, 0x5bb5e8
call fcn.00568428
call fcn.004934c0
cmp al, 5
jne 0x4844bf
push 0x5b014c
lea edx, [ebp - 0x108]
push edx
call fcn.0056805c
add esp, 8
jmp 0x4844c6
mov byte [ebp - 0x108], 0
push str.UniqueServUEvent_93570126297340819583
lea ecx, [ebp - 0x108]
push ecx
call fcn.00567f80
add esp, 8
lea eax, [ebp - 0x108]
push eax
push 0
push 0x1f0003
call sub.KERNEL32.DLL_OpenEventA
mov dword [ebp - 0x5c], eax
mov edx, dword [ebp - 0x5c]
test edx, edx
jne 0x484508
mov ecx, dword [ebp - 0x58]
mov dword fs:[0], ecx
mov eax, ecx
jmp 0x4848df
mov dl, byte [ebp + 0xc]
test dl, dl
jne 0x4845b8
push dword [ebp + 8]
call fcn.004848e4
pop ecx
test al, al
je 0x4845b8
mov eax, dword [0x5cefd4]
mov edx, dword [eax]
cmp edx, 2
jne 0x4845b8
push 2
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerA
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
test ecx, ecx
jne 0x484557
mov eax, dword [ebp - 0x58]
mov dword fs:[0], eax
jmp 0x4848df
push 0x20
push 0x5b0190
push dword [ebp - 0x60]
call sub.ADVAPI32.DLL_OpenServiceA
mov dword [ebp - 0x64], eax
mov edx, dword [ebp - 0x64]
test edx, edx
je 0x484581
lea ecx, [ebp - 0x124]
push ecx
push 1
push dword [ebp - 0x64]
call sub.ADVAPI32.DLL_ControlService
mov eax, dword [ebp - 0x60]
test eax, eax
je 0x484590
push dword [ebp - 0x60]
call sub.ADVAPI32.DLL_CloseServiceHandle
mov edx, dword [ebp - 0x64]
test edx, edx
je 0x48459f
push dword [ebp - 0x64]
call sub.ADVAPI32.DLL_CloseServiceHandle
push dword [ebp - 0x5c]
call sub.KERNEL32.DLL_CloseHandle
mov ecx, dword [ebp - 0x58]
mov dword fs:[0], ecx
mov eax, ecx
jmp 0x4848df
push dword [ebp - 0x5c]
call sub.KERNEL32.DLL_SetEvent
push dword [ebp - 0x5c]
call sub.KERNEL32.DLL_CloseHandle
mov dl, byte [ebp + 0xc]
test dl, dl
je 0x4848d5
mov word [ebp - 0x48], 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x24]
add edx, 4
lea eax, [ebp - 4]
call fcn.0058fcb0
inc dword [ebp - 0x3c]
mov word [ebp - 0x48], 8
mov word [ebp - 0x48], 0x20
mov edx, 0x5aecd6
lea eax, [ebp - 8]
call fcn.0058fc78
inc dword [ebp - 0x3c]
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.00590780
mov edx, eax
inc edx
lea eax, [ebp - 4]
mov ecx, 0xfa
call fcn.00590250
mov edx, eax
lea eax, [ebp - 4]
call fcn.0058ff44
dec dword [ebp - 0x3c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0058ff14
mov word [ebp - 0x48], 0x2c
mov edx, str.ServUDaemon.ini
lea eax, [ebp - 0xc]
call fcn.0058fc78
inc dword [ebp - 0x3c]
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.0058ff58
dec dword [ebp - 0x3c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0058ff14
mov eax, dword [ebp - 4]
call fcn.0054814c
test al, al
jne 0x484776
mov word [ebp - 0x48], 0x38
mov edx, 0x5aecd6
lea eax, [ebp - 0x10]
call fcn.0058fc78
inc dword [ebp - 0x3c]
lea edx, [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00590780
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 0xfa
call fcn.00590250
mov edx, eax
lea eax, [ebp - 4]
call fcn.0058ff44
dec dword [ebp - 0x3c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0058ff14
mov word [ebp - 0x48], 0x44
mov edx, 0x5aecd6
lea eax, [ebp - 0x14]
call fcn.0058fc78
inc dword [ebp - 0x3c]
lea edx, [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.00590780
mov edx, eax
inc edx
lea eax, [ebp - 4]
mov ecx, 0xfa
call fcn.00590250
mov edx, eax
lea eax, [ebp - 4]
call fcn.0058ff44
dec dword [ebp - 0x3c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0058ff14
mov word [ebp - 0x48], 0x50
mov edx, str.Daemon_
lea eax, [ebp - 0x18]
call fcn.0058fc78
inc dword [ebp - 0x3c]
lea edx, [ebp - 0x18]
lea eax, [ebp - 4]
call fcn.0058ff58
dec dword [ebp - 0x3c]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0058ff14
mov word [ebp - 0x48], 0x5c
mov edx, str.ServUDaemon.ini
lea eax, [ebp - 0x1c]
call fcn.0058fc78
inc dword [ebp - 0x3c]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.0058ff58
dec dword [ebp - 0x3c]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0058ff14
mov eax, dword [ebp - 4]
call fcn.0054814c
test al, al
jne 0x4847a1
dec dword [ebp - 0x3c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0058ff14
mov ecx, dword [ebp - 0x58]
mov dword fs:[0], ecx
jmp 0x4848df
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x544220]
call fcn.00482324
mov dword [ebp - 0x68], eax
mov word [ebp - 0x48], 8
push 0
mov edx, str.ProcessID
lea eax, [ebp - 0x24]
call fcn.0058fc78
inc dword [ebp - 0x3c]
push dword [eax]
mov word [ebp - 0x48], 0x68
mov edx, 0x5b00ed
lea eax, [ebp - 0x20]
call fcn.0058fc78
inc dword [ebp - 0x3c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x68]
pop ecx
mov ebx, dword [eax]
call dword [ebx + 8]
mov dword [ebp - 0x6c], eax
dec dword [ebp - 0x3c]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0058ff14
dec dword [ebp - 0x3c]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.0058ff14
mov word [ebp - 0x48], 8
mov ecx, dword [ebp - 0x6c]
test ecx, ecx
je 0x48483e
push dword [ebp - 0x6c]
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x48483e
push 0xffffffffffffffff
push dword [ebp - 0x70]
call sub.KERNEL32.DLL_TerminateProcess
mov edx, str.ProcessID
lea eax, [ebp - 0x2c]
call fcn.0058fc78
inc dword [ebp - 0x3c]
push dword [eax]
mov word [ebp - 0x48], 0x74
mov edx, 0x5b00ed
lea eax, [ebp - 0x28]
call fcn.0058fc78
inc dword [ebp - 0x3c]
mov edx, dword [eax]
mov eax, dword [ebp - 0x68]
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x50]
dec dword [ebp - 0x3c]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.0058ff14
dec dword [ebp - 0x3c]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.0058ff14
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x4848bf
mov edx, dword [ebp - 0x34]
mov ecx, dword [edx]
mov dword [ebp - 0x30], ecx
mov word [ebp - 0x48], 0x8c
mov edx, 3
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x48], 0x80
dec dword [ebp - 0x3c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0058ff14
mov word [ebp - 0x48], 0
mov ecx, dword [ebp - 0x58]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret