Function at 0x43cd00
Capabilities:
Enumerate services
Query service configuration
Query service status
Stop service

Disassembly:
mov eax, 0x25458
call fcn.00457d20
push ebx
push ebp
push esi
push edi
xor edi, edi
push 4
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
cmp esi, edi
mov dword [esp + 0x10], esi
je 0x43cf26
lea eax, [esp + 0x24]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
lea eax, [esp + 0x1474]
push 0x24000
push eax
push 1
push 0x30
push esi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x44], edi
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x43cd73
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x25458
ret
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp eax, edi
mov dword [esp + 0x20], edi
jbe 0x43cf23
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea ecx, [esp + 0x1468]
mov dword [esp + 0x18], ecx
jmp 0x43cd9e
xor edi, edi
mov edx, dword [esp + 0x18]
push 0x35
mov eax, dword [edx]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
cmp esi, edi
je 0x43ceff
mov dl, byte [0x493b50]
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x1069]
mov byte [esp + 0x1068], dl
mov byte [esp + 0x68], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x69]
mov byte [esp + 0x868], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x869]
mov byte [esp + 0x468], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x469]
mov byte [esp + 0xc68], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xc69]
lea edx, [esp + 0x868]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [esp + 0x1068]
lea eax, [esp + 0x68]
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], eax
lea ecx, [esp + 0x468]
lea eax, [esp + 0x1c]
mov dword [esp + 0x60], ecx
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x60], edx
push 0x1424
lea edx, [esp + 0xc70]
push ecx
push esi
mov dword [esp + 0x74], edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x43cefc
lea edx, [esp + 0x28]
push edx
push esi
call ebx
cmp dword [esp + 0x2c], 4
jne 0x43cefc
mov edx, dword [esp + 0x2546c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x50]
not ecx
dec ecx
push ecx
push eax
push edx
call fcn.00459d50
add esp, 0xc
test eax, eax
jne 0x43cefc
lea ecx, [esp + 0x28]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea edx, [esp + 0x28]
push edx
push esi
call ebx
test eax, eax
je 0x43cef5
cmp dword [esp + 0x2c], 3
jne 0x43cef5
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x28]
push eax
push esi
call ebx
test eax, eax
jne 0x43ced7
cmp dword [esp + 0x2c], 1
je 0x43cf33
push esi
call ebp
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
inc eax
add edx, 0x24
cmp eax, ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edx
jb 0x43cd9c
push esi
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x25458
ret
push esi
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x25458
ret