Function at 0x40e900
Capabilities:
Check for time delay via gettickcount
Delete service
Modify service
Query service status

Disassembly:
push 0xffffffffffffffff
push 0x48bdb5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9b0
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
xor ebp, ebp
push edi
push ebp
mov dword [esp + 0x20], ecx
push str.Q360SDClass
call esi
test eax, eax
je 0x40e963
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, ebp
inc ebp
cmp ecx, 5
jge 0x40e963
push 0
push 0
push 0x12
push eax
call edi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.Q360SDClass
call esi
test eax, eax
jne 0x40e93d
lea ecx, [esp + 0x10]
call fcn.00422430
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebp, ebp
mov dword [esp + 0x9c8], ebp
call edi
mov esi, eax
call edi
sub eax, esi
or ebx, 0xffffffff
cmp eax, 0x2710
jae 0x40e9c1
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.360sd.exe
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x18]
call fcn.00422560
cmp eax, ebx
je 0x40e9c1
push eax
lea ecx, [esp + 0x14]
call fcn.00422700
call edi
sub eax, esi
cmp eax, 0x2710
jb 0x40e98d
lea ecx, [esp + 0x10]
mov dword [esp + 0x9c8], ebx
call fcn.00422460
lea ecx, [esp + 0x10]
call fcn.00422430
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.360Quart.exe
mov dword [esp + 0x9d4], 1
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x18]
call fcn.00422560
cmp eax, ebx
je 0x40ea0e
push eax
lea ecx, [esp + 0x14]
call fcn.00422700
lea ecx, [esp + 0x10]
mov dword [esp + 0x9c8], ebx
call fcn.00422460
lea ecx, [esp + 0x10]
call fcn.00422430
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.LiveUpdate360.exe
mov dword [esp + 0x9d4], 2
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x18]
call fcn.00422560
cmp eax, ebx
je 0x40ea5b
push eax
lea ecx, [esp + 0x14]
call fcn.00422700
lea ecx, [esp + 0x10]
mov dword [esp + 0x9c8], ebx
call fcn.00422460
lea ecx, [esp + 0x10]
call fcn.00422430
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.360sdupd.exe
mov dword [esp + 0x9d4], 3
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x18]
call fcn.00422560
cmp eax, ebx
je 0x40eaa8
push eax
lea ecx, [esp + 0x14]
call fcn.00422700
lea ecx, [esp + 0x10]
mov dword [esp + 0x9c8], ebx
call fcn.00422460
lea ecx, [esp + 0x10]
call fcn.00422430
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.360prox.exe
mov dword [esp + 0x9d4], 4
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x18]
call fcn.00422560
cmp eax, ebx
je 0x40eaf5
push eax
lea ecx, [esp + 0x14]
call fcn.00422700
lea ecx, [esp + 0x10]
mov dword [esp + 0x9c8], ebx
call fcn.00422460
lea ecx, [esp + 0x10]
call fcn.00422430
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.360nq.exe
mov dword [esp + 0x9d4], 5
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x18]
call fcn.00422560
cmp eax, ebx
je 0x40eb42
push eax
lea ecx, [esp + 0x14]
call fcn.00422700
lea ecx, [esp + 0x10]
mov dword [esp + 0x9c8], ebx
call fcn.00422460
xor eax, eax
mov ecx, 6
lea edi, [esp + 0x24]
push 0xf003f
mov dword [esp + 0x24], ebp
push eax
rep stosd dword es:[edi], eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test eax, eax
mov dword [esp + 0x14], eax
je 0x40eb8b
push 0x10016
push str.360rp
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, eax
mov al, byte [esp + 0x9d0]
test al, al
je 0x40ebde
push 1
call fcn.0041eb80
add esp, 4
test eax, eax
jne 0x40ebde
lea ecx, [esp + 0x10]
call fcn.0041a5b0
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x9cc], 6
call fcn.0041a5f0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x10]
mov dword [esp + 0x9c8], ebx
call fcn.0041a5e0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov esi, eax
mov dword [esp + 0x18], esi
call edi
sub eax, esi
cmp eax, 0x7530
jae 0x40ed3e
xor esi, esi
test ebp, ebp
je 0x40ec8e
lea edx, [esp + 0x20]
push edx
push ebp
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40ec8e
cmp dword [esp + 0x24], 1
je 0x40ec8e
push 1
lea ecx, [esp + 0x40]
call fcn.00421b80
push 3
lea ecx, [esp + 0x40]
mov dword [esp + 0x9cc], 7
call fcn.00421c00
mov esi, 1
mov dword [esp + 0x3c], 0x495dc0
lea ecx, [esp + 0x40]
mov dword [esp + 0x9c8], 9
call fcn.00421ed0
lea ecx, [esp + 0x2a0]
call fcn.00421ed0
lea ecx, [esp + 0x2a0]
mov byte [esp + 0x9c8], 8
call fcn.00421e20
lea ecx, [esp + 0x40]
mov dword [esp + 0x9c8], ebx
call fcn.00421e20
push 1
call fcn.0041eb80
add esp, 4
test eax, eax
je 0x40ed29
lea ecx, [esp + 0x500]
call fcn.00421ab0
mov al, byte [esp + 0x9d0]
lea ecx, [esp + 0x500]
neg al
sbb eax, eax
mov dword [esp + 0x9c8], 0xa
add eax, 2
push eax
call fcn.00421b10
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x500]
mov dword [esp + 0x9c8], 0xc
call fcn.00421ed0
lea ecx, [esp + 0x760]
call fcn.00421ed0
lea ecx, [esp + 0x760]
mov byte [esp + 0x9c8], 0xb
call fcn.00421e20
lea ecx, [esp + 0x500]
mov dword [esp + 0x9c8], ebx
call fcn.00421e20
jmp 0x40ed2d
test esi, esi
je 0x40ed3e
call edi
sub eax, dword [esp + 0x18]
cmp eax, 0x7530
jb 0x40ebfb
mov al, byte [esp + 0x9d0]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test al, al
je 0x40ed73
test ebp, ebp
je 0x40ed7a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 3
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push ebp
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test ebp, ebp
je 0x40ed7a
push ebp
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40ed85
push eax
call esi
push 1
call fcn.0041eb80
add esp, 4
test eax, eax
je 0x40ede1
lea ecx, [esp + 0x10]
call fcn.00422430
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.360rp.exe
mov dword [esp + 0x9d4], 0xd
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x18]
call fcn.00422560
cmp eax, ebx
je 0x40edd1
push eax
lea ecx, [esp + 0x14]
call fcn.00422700
lea ecx, [esp + 0x10]
mov dword [esp + 0x9c8], ebx
call fcn.00422460
lea ecx, [esp + 0x18]
call fcn.00422430
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.360rps.exe
mov dword [esp + 0x9d4], 0xe
call sub.MFC42u.DLL_CString::CString_2
lea ecx, [esp + 0x20]
call fcn.00422560
cmp eax, ebx
je 0x40ee1f
push eax
lea ecx, [esp + 0x1c]
call fcn.00422700
lea ecx, [esp + 0x18]
mov dword [esp + 0x9c8], ebx
call fcn.00422460
mov ecx, dword [esp + 0x1c]
call fcn.0040e3b0
mov ecx, dword [esp + 0x9c0]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x9bc
ret 4