Function at 0x443190
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x5868f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x24
lea eax, [ebp - 0x2c]
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4431b0
mov ecx, 0x1c
lea eax, [ebp - 0x48]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4431c3
push esi
push 0xf003f
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x50], eax
test eax, eax
jne 0x443211
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push str.Failed_to_open_SCM
push esi
push 0x58ba20
call fcn.00437520
add esp, 0xc
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret
push edi
push 0x2c
push str.QualysAgent
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x44326c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x424
jne 0x44324f
push str.Service_does_not_exist___returning_success
push 0x58ba20
call fcn.00437360
add esp, 8
xor esi, esi
jmp 0x443437
push str.QualysAgent
push str.Failed_to_open_service___s_
push esi
push 0x58ba20
call fcn.00437520
add esp, 0x10
jmp 0x443437
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 8]
push eax
push 0x24
lea eax, [ebp - 0x2c]
push eax
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x4432c9
mov eax, dword [ebp - 0x28]
cmp eax, 1
je 0x4432eb
cmp eax, 4
je 0x4432b8
cmp eax, 7
je 0x4432b8
push str.Service_in_transition_state___pausing_1_second...
push 0x58ba20
call fcn.004372e0
add esp, 8
push 0x3e8
call ebx
mov eax, dword [ebp - 0x28]
cmp eax, 1
je 0x4432eb
cmp eax, 4
je 0x4432eb
cmp eax, 7
jne 0x443273
jmp 0x4432eb
mov dword [ebp - 0x28], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push str.Failed_to_query_service_status
push esi
push 0x58ba20
call fcn.00437520
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x48]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x443329
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x426
jne 0x443316
xor esi, esi
jmp 0x443329
push str.Failed_to_issue_STOP_control_to_SCM
push esi
push 0x58ba20
call fcn.00437520
add esp, 0xc
push str.Waiting_for_SCM_to_register_Service_as_stopped...
push 0x58ba20
call fcn.00437360
add esp, 8
nop dword [eax + eax]
lea eax, [ebp - 8]
push eax
push 0x24
lea eax, [ebp - 0x2c]
push eax
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x443396
mov eax, dword [ebp - 0x28]
cmp eax, 1
je 0x4433b8
cmp eax, 4
je 0x443385
cmp eax, 7
je 0x443385
push str.Service_in_transition_state___pausing_1_second...
push 0x58ba20
call fcn.004372e0
add esp, 8
push 0x3e8
call ebx
mov eax, dword [ebp - 0x28]
cmp eax, 1
je 0x4433b8
cmp eax, 4
je 0x4433b8
cmp eax, 7
jne 0x443340
jmp 0x4433b8
mov dword [ebp - 0x28], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push str.Failed_to_query_service_status
push esi
push 0x58ba20
call fcn.00437520
add esp, 0xc
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x4c]
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x443402
push 0x3c
push str.Waiting_up_to__d_seconds_for_service_to_terminate...
push 0x58ba20
call fcn.00437360
add esp, 0xc
push 0xea60
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
test esi, esi
je 0x443424
mov esi, 0x102
jmp 0x44342b
cmp esi, 0x41d
jne 0x443420
push str.Coercing_timeout_error__1053__as_success__as_service_is_Stopped_now.
push 0x58ba20
call fcn.00437360
add esp, 8
xor esi, esi
jmp 0x443424
test esi, esi
jne 0x443436
push 0x1388
call ebx
test edi, edi
je 0x443436
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret