Function at 0x624c60
Capabilities:
Check for time delay via gettickcount
Enumerate services
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407c84
xor eax, eax
push ebp
push 0x625098
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x28], eax
push 0xf003f
push 0
push 0x6250a8
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x625079
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x24], 0
je 0x62504d
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00407d28
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x62504d
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x624d09
call sub.kernel32.dll_GetLastError_1
mov esi, eax
call fcn.00406420
jmp 0x625082
cmp dword [ebp - 0x44], 1
jne 0x624d9c
xor esi, esi
call fcn.00406420
jmp 0x625082
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.advapi32.dll_QueryServiceStatus
push 0x64
call sub.kernel32.dll_Sleep_2
cmp dword [ebp - 0x44], 1
je 0x624d4c
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, dword [ebp - 0x30]
jbe 0x624d26
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x624d6e
call sub.kernel32.dll_GetLastError_1
mov esi, eax
call fcn.00406420
jmp 0x625082
cmp dword [ebp - 0x44], 1
jne 0x624d80
xor esi, esi
call fcn.00406420
jmp 0x625082
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
jbe 0x624d9c
mov esi, 0x5b4
call fcn.00406420
jmp 0x625082
cmp dword [ebp - 0x44], 3
je 0x624d1f
test edi, edi
je 0x624fb8
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 1
mov eax, dword [ebp - 0x28]
push eax
call sub.advapi32.dll_EnumDependentServicesW
test eax, eax
jne 0x624fb8
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xea
je 0x624df6
call sub.kernel32.dll_GetLastError_1
mov esi, eax
call fcn.00406420
jmp 0x625082
mov eax, dword [ebp - 0x14]
call fcn.00404368
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x624f9f
xor eax, eax
push ebp
push 0x624f98
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 1
mov eax, dword [ebp - 0x28]
push eax
call sub.advapi32.dll_EnumDependentServicesW
test eax, eax
jne 0x624e3d
call sub.kernel32.dll_GetLastError_1
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x624f8a
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 0x1c]
mov ecx, 0x24
call fcn.0040452c
push 0x24
mov eax, dword [ebp - 0x88]
push eax
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jbe 0x624f7e
xor eax, eax
push ebp
push 0x624f77
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x64]
push eax
push 1
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_ControlService
test eax, eax
je 0x624f5a
jmp 0x624f50
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_QueryServiceStatus
push 0x64
call sub.kernel32.dll_Sleep_2
cmp dword [ebp - 0x60], 1
je 0x624ee6
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, dword [ebp - 0x4c]
jbe 0x624ec0
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x624f1b
call sub.kernel32.dll_GetLastError_1
mov esi, eax
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_CloseServiceHandle
call fcn.00406420
call fcn.00406420
call fcn.00406420
jmp 0x625082
cmp dword [ebp - 0x44], 1
je 0x624f5a
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
jbe 0x624f50
mov esi, 0x5b4
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_CloseServiceHandle
call fcn.00406420
call fcn.00406420
call fcn.00406420
jmp 0x625082
cmp dword [ebp - 0x60], 1
jne 0x624eb9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x624f7e
cmp dword [ebp - 0x20], 0
je 0x624f76
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
inc dword [ebp - 0xc]
dec dword [ebp - 0x2c]
jne 0x624e54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x624fb0
ret
call sub.kernel32.dll_GetLastError_1
mov esi, eax
call fcn.00406420
jmp 0x625082
lea eax, [ebp - 0x64]
push eax
push 1
mov eax, dword [ebp - 0x28]
push eax
call sub.advapi32.dll_ControlService
test eax, eax
jne 0x625047
call sub.kernel32.dll_GetLastError_1
mov esi, eax
call fcn.00406420
jmp 0x625082
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.advapi32.dll_QueryServiceStatus
push 0x64
call sub.kernel32.dll_Sleep_2
cmp dword [ebp - 0x60], 1
je 0x625009
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, dword [ebp - 0x4c]
jbe 0x624fe3
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x28]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x625028
call sub.kernel32.dll_GetLastError_1
mov esi, eax
call fcn.00406420
jmp 0x625082
cmp dword [ebp - 0x44], 1
je 0x62504d
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
jbe 0x625047
mov esi, 0x5b4
call fcn.00406420
jmp 0x625082
cmp dword [ebp - 0x60], 1
jne 0x624fdc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x625080
cmp dword [ebp - 0x28], 0
je 0x625069
mov eax, dword [ebp - 0x28]
push eax
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x24], 0
je 0x625078
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62509f
lea eax, [ebp - 4]
call fcn.00407c8c
ret