Function at 0x4a4de0
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x4a4de9
mov eax, dword [ebp - 4]
add esp, 0xfffffa18
push ebx
xor edx, edx
mov dword [ebp - 0x35ec], edx
mov dword [ebp - 0x35e8], edx
mov dword [ebp - 0x35e4], edx
mov dword [ebp - 0x35e0], edx
xor eax, eax
push ebp
push 0x4a5108
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4e8b6c], 0xffffffff
jne 0x4a4e35
mov bl, 1
jmp 0x4a50ea
lea eax, [ebp - 0x35b0]
xor ecx, ecx
mov edx, 0x35a4
call fcn.00402eb0
push 0
lea eax, [ebp - 4]
push eax
push 0x35a4
lea eax, [ebp - 0x35b0]
push eax
push 0x35a4
lea eax, [ebp - 0x35b0]
push eax
mov eax, dword [0x4eb1b4]
push eax
mov eax, dword [0x4e8b6c]
push eax
call sub.kernel32.dll_DeviceIoControl
test eax, eax
jne 0x4a4e81
mov bl, 1
jmp 0x4a50ea
cmp dword [ebp - 0x35b0], 0
je 0x4a4e91
xor ebx, ebx
jmp 0x4a50ea
call fcn.004a4d58
dec eax
jle 0x4a4ea0
xor ebx, ebx
jmp 0x4a50ea
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a50d9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a4f26
mov eax, 0x4a5120
mov dword [ebp - 0x35dc], eax
mov byte [ebp - 0x35d8], 0xb
call sub.kernel32.dll_GetLastError
lea edx, [ebp - 0x35e0]
call fcn.0040c2ec
mov eax, dword [ebp - 0x35e0]
mov dword [ebp - 0x35d4], eax
mov byte [ebp - 0x35d0], 0xb
lea eax, [ebp - 0x35dc]
push eax
push 1
mov ecx, dword [0x4e97f0]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x407c54]
call fcn.0040cb60
call fcn.00403c84
push 0xf01ff
push 0x4a5128
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4a4f99
mov eax, 0x4a5120
mov dword [ebp - 0x35dc], eax
mov byte [ebp - 0x35d8], 0xb
call sub.kernel32.dll_GetLastError
lea edx, [ebp - 0x35e4]
call fcn.0040c2ec
mov eax, dword [ebp - 0x35e4]
mov dword [ebp - 0x35d4], eax
mov byte [ebp - 0x35d0], 0xb
lea eax, [ebp - 0x35dc]
push eax
push 1
mov ecx, dword [0x4e9bc8]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x407c54]
call fcn.0040cb60
call fcn.00403c84
lea eax, [ebp - 0x35cc]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x4a5004
mov eax, 0x4a5120
mov dword [ebp - 0x35dc], eax
mov byte [ebp - 0x35d8], 0xb
call sub.kernel32.dll_GetLastError
lea edx, [ebp - 0x35e8]
call fcn.0040c2ec
mov eax, dword [ebp - 0x35e8]
mov dword [ebp - 0x35d4], eax
mov byte [ebp - 0x35d0], 0xb
lea eax, [ebp - 0x35dc]
push eax
push 1
mov ecx, dword [0x4e94f4]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x407c54]
call fcn.0040cb60
call fcn.00403c84
cmp dword [ebp - 0x35c8], 1
je 0x4a50ad
lea eax, [ebp - 0x35cc]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ControlService
mov ebx, 6
lea eax, [ebp - 0x35cc]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x4a5093
mov eax, 0x4a5120
mov dword [ebp - 0x35dc], eax
mov byte [ebp - 0x35d8], 0xb
call sub.kernel32.dll_GetLastError
lea edx, [ebp - 0x35ec]
call fcn.0040c2ec
mov eax, dword [ebp - 0x35ec]
mov dword [ebp - 0x35d4], eax
mov byte [ebp - 0x35d0], 0xb
lea eax, [ebp - 0x35dc]
push eax
push 1
mov ecx, dword [0x4e94f4]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x407c54]
call fcn.0040cb60
call fcn.00403c84
cmp dword [ebp - 0x35c8], 1
je 0x4a50ad
push 0xc8
call sub.kernel32.dll_Sleep_1
dec ebx
jne 0x4a5028
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a50e0
cmp dword [ebp - 0xc], 0
je 0x4a50c9
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 8], 0
je 0x4a50d8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a510f
lea eax, [ebp - 0x35ec]
mov edx, 4
call fcn.004042f0
ret