Function at 0x4f4400
Capabilities:
Modify service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor esi, esi
mov edx, dword [eax + 0xc]
test edx, edx
je 0x4f444c
mov eax, dword [eax + 0x14]
test eax, eax
je 0x4f444c
lea ecx, [esp + 0x20]
push eax
call fcn.004eeb50
add esp, 4
mov esi, dword [esp + 0x20]
cmp dword [esp + 0x24], 0
je 0x4f444c
mov eax, dword [0x56bbf8]
push esi
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
push 0xf003f
push 0
push esi
call sub.advapi32.dll_OpenSCManagerW
mov dword [esp + 0xa0], eax
call sub.kernel32.dll_GetLastError
test eax, eax
mov dword [esp + 0xa4], eax
je 0x4f4516
lea eax, [esp + 0xa4]
mov dword [esp + 0x20], 0x56b20c
mov dword [esp + 0x24], 2
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x41af80
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 1
lea eax, [esp + 0x20]
push eax
call fcn.004c4f80
add esp, 4
mov ebx, dword [edi + 8]
mov eax, dword [edi]
test ebx, ebx
mov dword [esp + 0xc], eax
je 0x4f44fb
mov eax, dword [esp + 0xc]
mov esi, dword [0x56bbf8]
shl ebx, 4
lea edi, [eax + 4]
jmp 0x4f44e8
add edi, 0x10
add ebx, 0xfffffff0
je 0x4f44fb
cmp dword [edi], 0
je 0x4f44e0
push dword [edi - 4]
push 0
push dword [esi]
call sub.kernel32.dll_HeapFree
jmp 0x4f44e0
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0
je 0x4f4f35
mov eax, dword [0x56bbf8]
push dword [esp + 0xc]
jmp 0x4f4f2c
mov ecx, dword [edi + 8]
mov ebx, dword [edi]
mov eax, dword [edi + 4]
mov edx, ecx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], ebx
shl edx, 4
add edx, ebx
test ecx, ecx
mov dword [esp + 0x8c], edx
je 0x4f4f16
mov edi, 0xfffffff0
sub edi, ebx
jmp 0x4f4577
mov ebx, dword [esp + 0x54]
mov edi, dword [esp + 0x7c]
mov edx, dword [esp + 0xc]
add edi, 0xfffffff0
cmp ebx, edx
je 0x4f4f16
movzx eax, byte [ebx + 0xc]
lea ecx, [ebx + 0x10]
cmp al, 2
je 0x4f4edc
mov dword [esp + 0x54], ecx
mov ecx, dword [ebx + 8]
mov dword [esp + 0xc], edx
mov dword [esp + 0x7c], edi
mov dword [esp + 0x70], ecx
lea ecx, [esp + 0x75]
movsd xmm0, qword [ebx]
movsd qword [esp + 0x68], xmm0
mov byte [esp + 0x74], al
movzx eax, byte [ebx + 0xf]
mov byte [ecx + 2], al
movzx eax, word [ebx + 0xd]
mov word [ecx], ax
mov esi, dword [esp + 0x70]
mov edx, dword [esp + 0x68]
test esi, esi
je 0x4f4640
lea ecx, [edx + esi]
mov edi, edx
jmp 0x4f45e6
add edi, 2
cmp ebx, ecx
cmovne ebx, edi
nop word cs:[eax + eax]
nop
cmp ebx, ecx
mov edi, ebx
je 0x4f4640
movzx eax, byte [edi]
lea ebx, [edi + 1]
test al, al
jns 0x4f45e0
cmp al, 0xe0
jb 0x4f45cc
cmp al, 0xed
jne 0x4f4610
cmp ebx, ecx
je 0x4f4640
lea eax, [edi + 2]
cmp eax, ecx
je 0x4f4640
cmp byte [edi + 1], 0xa0
jae 0x4f4630
add edi, 3
mov ebx, edi
jmp 0x4f45e0
add edi, 2
cmp ebx, ecx
cmove edi, ebx
xor ebx, ebx
cmp edi, ecx
setne bl
add ebx, edi
cmp al, 0xf0
jb 0x4f45e0
xor eax, eax
cmp ebx, ecx
setne al
add ebx, eax
jmp 0x4f45e0
xor edx, edx
nop word cs:[eax + eax]
nop dword [eax]
test edx, edx
mov edi, str._unknown__WARNING__Cannot_service_compile_regex:
mov eax, 9
cmove edx, edi
cmove esi, eax
lea ecx, [esp + 0x20]
push esi
call fcn.004eeb50
add esp, 4
mov esi, dword [esp + 0x20]
push 0x2f
push esi
push dword [esp + 0xa8]
call sub.advapi32.dll_OpenServiceW
mov dword [esp + 0x58], eax
cmp dword [esp + 0x24], 0
je 0x4f468c
push esi
push 0
mov eax, dword [0x56bbf8]
push dword [eax]
call sub.kernel32.dll_HeapFree
call sub.kernel32.dll_GetLastError
test eax, eax
mov dword [esp + 0xa8], eax
je 0x4f4730
mov edi, dword [esp + 0x68]
mov esi, dword [esp + 0x70]
test esi, esi
mov eax, edi
je 0x4f4882
lea ecx, [edi + esi]
mov ebx, edi
jmp 0x4f46da
add ebx, 2
cmp edx, ecx
cmovne edx, ebx
nop word cs:[eax + eax]
nop dword [eax + eax]
cmp edx, ecx
mov ebx, edx
je 0x4f4880
movzx eax, byte [ebx]
lea edx, [ebx + 1]
test al, al
jns 0x4f46d0
cmp al, 0xe0
jb 0x4f46b9
cmp al, 0xed
jne 0x4f4710
cmp edx, ecx
je 0x4f4880
lea eax, [ebx + 2]
cmp eax, ecx
je 0x4f4880
cmp byte [ebx + 1], 0xa0
jae 0x4f4eb9
add ebx, 3
mov edx, ebx
jmp 0x4f46d0
add ebx, 2
cmp edx, ecx
cmove ebx, edx
xor edx, edx
cmp ebx, ecx
setne dl
add edx, ebx
cmp al, 0xf0
jb 0x4f46d0
xor eax, eax
cmp edx, ecx
setne al
add edx, eax
jmp 0x4f46d0
push dword [esp + 0x58]
lea eax, [esp + 0x94]
push eax
call fcn.004ee790
add esp, 8
mov ecx, dword [esp + 0x98]
mov edi, dword [esp + 0x90]
mov eax, dword [esp + 0x94]
xorps xmm0, xmm0
mov dword [esp + 0x5c], 4
movlps qword [esp + 0x60], xmm0
mov ebx, ecx
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], eax
mov dword [esp + 0x78], edi
shl ebx, 5
test ecx, ecx
lea edx, [edi + ebx]
mov dword [esp + 0x50], edx
je 0x4f491a
mov eax, dword [esp + 0x78]
xor esi, esi
mov ecx, 4
mov dword [esp + 0x9c], edx
lea edi, [eax + 0x20]
jmp 0x4f47ac
add edi, 0x20
add ebx, 0xffffffe0
je 0x4f4970
movzx eax, byte [edi - 0x14]
cmp al, 2
je 0x4f4913
mov dword [esp + 0xc], ecx
lea ecx, [edi - 0x20]
cmp esi, dword [esp + 0x60]
mov edx, dword [ecx + 8]
mov dword [esp + 0x28], edx
movsd xmm0, qword [ecx]
lea ecx, [esp + 0x2d]
movsd qword [esp + 0x20], xmm0
mov byte [esp + 0x2c], al
mov eax, dword [edi - 4]
mov dword [ecx + 0xf], eax
movsd xmm0, qword [edi - 0x13]
movsd xmm1, qword [edi - 0xb]
movsd qword [ecx + 8], xmm1
movsd qword [ecx], xmm0
movsd xmm0, qword [esp + 0x20]
movsd xmm1, qword [esp + 0x28]
movsd qword [esp + 0x18], xmm1
movsd qword [esp + 0x10], xmm0
jne 0x4f4830
lea ecx, [esp + 0x5c]
mov edx, esi
call fcn.004f0ff0
mov ecx, dword [esp + 0x5c]
mov esi, dword [esp + 0x64]
jmp 0x4f4834
mov ecx, dword [esp + 0xc]
movsd xmm0, qword [esp + 0x20]
movsd xmm1, qword [esp + 0x28]
mov eax, esi
inc esi
shl eax, 4
movsd qword [ecx + eax + 8], xmm1
movsd qword [ecx + eax], xmm0
mov dword [esp + 0x64], esi
cmp dword [esp + 0x34], 0
je 0x4f47a0
push dword [esp + 0x30]
push 0
mov eax, dword [0x56bbf8]
push dword [eax]
mov dword [esp + 0x18], ecx
call sub.kernel32.dll_HeapFree
mov ecx, dword [esp + 0xc]
jmp 0x4f47a0
mov eax, edi
test eax, eax
mov ecx, str._unknown__WARNING__Cannot_service_compile_regex:
mov dword [esp + 0x20], 0x56b27c
mov dword [esp + 0x24], 3
mov dword [esp + 0x28], 0
cmove eax, ecx
mov dword [esp + 0x44], eax
mov eax, 9
cmove esi, eax
lea eax, [esp + 0x44]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xa8]
mov dword [esp + 0x14], 0x4ef2a0
mov dword [esp + 0x48], esi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], 0x41af80
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 2
lea eax, [esp + 0x20]
push eax
call fcn.004c4f80
add esp, 4
cmp dword [esp + 0x6c], 0
je 0x4f4560
push edi
push 0
mov eax, dword [0x56bbf8]
push dword [eax]
call sub.kernel32.dll_HeapFree
jmp 0x4f4560
mov edx, dword [esp + 0x9c]
sub edx, edi
mov dword [esp + 0x4c], edi
je 0x4f4970
shr edx, 5
add edi, 0x14
shl edx, 5
mov esi, edx
jmp 0x4f4938
add edi, 0x20
add esi, 0xffffffe0
je 0x4f4970
cmp dword [edi - 0x10], 0
je 0x4f494f
push dword [edi - 0x14]
push 0
mov eax, dword [0x56bbf8]
push dword [eax]
call sub.kernel32.dll_HeapFree
cmp dword [edi], 0
je 0x4f4930
push dword [edi - 4]
push 0
mov eax, dword [0x56bbf8]
push dword [eax]
call sub.kernel32.dll_HeapFree
jmp 0x4f4930
cmp dword [esp + 0x48], 0
je 0x4f4989
push dword [esp + 0x78]
push 0
mov eax, dword [0x56bbf8]
push dword [eax]
call sub.kernel32.dll_HeapFree
mov eax, dword [esp + 0x64]
movsd xmm0, qword [esp + 0x5c]
mov dword [esp + 0x28], eax
movsd qword [esp + 0x20], xmm0
lea eax, [esp + 0x20]
push eax
push dword [ebp + 8]
call fcn.004f4400
add esp, 8
xorps xmm0, xmm0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], 0
movaps xmmword [esp + 0x20], xmm0
lea eax, [esp + 0x20]
push eax
push 1
push dword [esp + 0x60]
call sub.advapi32.dll_ControlService
test eax, eax
je 0x4f4a82
call fcn.004c9fb0
mov esi, eax
mov ebx, edx
mov edi, ecx
xorps xmm0, xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x10], 0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
lea eax, [esp + 0x10]
push eax
push 0x24
lea eax, [esp + 0x28]
push eax
push 0
push dword [esp + 0x68]
call sub.advapi32.dll_QueryServiceStatusEx
test eax, eax
je 0x4f4a89
cmp dword [esp + 0x24], 1
je 0x4f4b82
call fcn.004c9fb0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
push edi
push ebx
push esi
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.004ca040
add esp, 0x14
mov eax, dword [esp + 0x20]
or eax, dword [esp + 0x24]
je 0x4f49f0
mov eax, 0x28
cmp eax, dword [esp + 0x28]
mov eax, 0
sbb eax, dword [esp + 0x2c]
jae 0x4f49f0
mov eax, 0x102
jmp 0x4f4a8b
call sub.kernel32.dll_GetLastError
jmp 0x4f4a8b
xor eax, eax
mov edi, dword [esp + 0x70]
mov esi, dword [esp + 0x68]
mov dword [esp + 0x90], eax
test edi, edi
mov eax, esi
je 0x4f4b09
lea eax, [esi + edi]
mov edx, esi
jmp 0x4f4ab6
add edx, 2
cmp ecx, eax
cmovne ecx, edx
nop
cmp ecx, eax
mov edx, ecx
je 0x4f4b07
movzx ebx, byte [edx]
lea ecx, [edx + 1]
test bl, bl
jns 0x4f4ab0
cmp bl, 0xe0
jb 0x4f4aa7
cmp bl, 0xed
jne 0x4f4ae6
cmp ecx, eax
je 0x4f4b07
lea ecx, [edx + 2]
cmp ecx, eax
je 0x4f4b07
cmp byte [edx + 1], 0xa0
jae 0x4f4ec0
add edx, 3
mov ecx, edx
jmp 0x4f4ab0
add edx, 2
cmp ecx, eax
cmove edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, edx
cmp bl, 0xf0
jb 0x4f4ab0
xor edx, edx
cmp ecx, eax
setne dl
add ecx, edx
jmp 0x4f4ab0
mov eax, esi
test eax, eax
mov ecx, str._unknown__WARNING__Cannot_service_compile_regex:
mov dword [esp + 0x20], 0x56b2ac
mov dword [esp + 0x24], 3
mov dword [esp + 0x28], 0
cmove eax, ecx
mov ecx, 9
mov dword [esp + 0x44], eax
mov eax, edi
cmove eax, ecx
mov dword [esp + 0x48], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x90]
mov dword [esp + 0x14], 0x4ef2a0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], 0x41af80
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 2
lea eax, [esp + 0x20]
push eax
call fcn.004c4f80
add esp, 4
jmp 0x4f4c6a
mov esi, dword [esp + 0x68]
mov edi, dword [esp + 0x70]
mov dword [esp + 0x90], 0
test edi, edi
mov eax, esi
je 0x4f4c09
lea eax, [esi + edi]
mov edx, esi
jmp 0x4f4bb6
add edx, 2
cmp ecx, eax
cmovne ecx, edx
nop word [eax + eax]
cmp ecx, eax
mov edx, ecx
je 0x4f4c07
movzx ebx, byte [edx]
lea ecx, [edx + 1]
test bl, bl
jns 0x4f4bb0
cmp bl, 0xe0
jb 0x4f4ba2
cmp bl, 0xed
jne 0x4f4be6
cmp ecx, eax
je 0x4f4c07
lea ecx, [edx + 2]
cmp ecx, eax
je 0x4f4c07
cmp byte [edx + 1], 0xa0
jae 0x4f4ed5
add edx, 3
mov ecx, edx
jmp 0x4f4bb0
add edx, 2
cmp ecx, eax
cmove edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, edx
cmp bl, 0xf0
jb 0x4f4bb0
xor edx, edx
cmp ecx, eax
setne dl
add ecx, edx
jmp 0x4f4bb0
mov eax, esi
test eax, eax
mov ecx, str._unknown__WARNING__Cannot_service_compile_regex:
mov dword [esp + 0x20], 0x56b2d8
mov dword [esp + 0x24], 2
mov dword [esp + 0x28], 0
cmove eax, ecx
mov ecx, 9
mov dword [esp + 0x10], eax
mov eax, edi
cmove eax, ecx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x48], 0x4ef2a0
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 1
lea eax, [esp + 0x20]
push eax
call fcn.004c4f80
add esp, 4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push dword [esp + 0x80]
call sub.advapi32.dll_ChangeServiceConfigW
test eax, eax
je 0x4f4d23
test edi, edi
mov eax, esi
mov dword [esp + 0x5c], 0
je 0x4f4db5
lea eax, [esi + edi]
mov edx, esi
jmp 0x4f4cca
add edx, 2
cmp ecx, eax
cmovne ecx, edx
nop word cs:[eax + eax]
nop dword [eax]
cmp ecx, eax
mov edx, ecx
je 0x4f4db3
movzx ebx, byte [edx]
lea ecx, [edx + 1]
test bl, bl
jns 0x4f4cc0
cmp bl, 0xe0
jb 0x4f4cab
cmp bl, 0xed
jne 0x4f4d02
cmp ecx, eax
je 0x4f4db3
lea ecx, [edx + 2]
cmp ecx, eax
je 0x4f4db3
cmp byte [edx + 1], 0xa0
jae 0x4f4ec7
add edx, 3
mov ecx, edx
jmp 0x4f4cc0
add edx, 2
cmp ecx, eax
cmove edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, edx
cmp bl, 0xf0
jb 0x4f4cc0
xor edx, edx
cmp ecx, eax
setne dl
add ecx, edx
jmp 0x4f4cc0
call sub.kernel32.dll_GetLastError
mov dword [esp + 0x5c], eax
test edi, edi
mov eax, esi
je 0x4f4e18
lea eax, [esi + edi]
mov edx, esi
jmp 0x4f4d5a
add edx, 2
cmp ecx, eax
cmovne ecx, edx
nop word cs:[eax + eax]
nop
cmp ecx, eax
mov edx, ecx
je 0x4f4e16
movzx ebx, byte [edx]
lea ecx, [edx + 1]
test bl, bl
jns 0x4f4d50
cmp bl, 0xe0
jb 0x4f4d3d
cmp bl, 0xed
jne 0x4f4d92
cmp ecx, eax
je 0x4f4e16
lea ecx, [edx + 2]
cmp ecx, eax
je 0x4f4e16
cmp byte [edx + 1], 0xa0
jae 0x4f4ece
add edx, 3
mov ecx, edx
jmp 0x4f4d50
add edx, 2
cmp ecx, eax
cmove edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, edx
cmp bl, 0xf0
jb 0x4f4d50
xor edx, edx
cmp ecx, eax
setne dl
add ecx, edx
jmp 0x4f4d50
mov eax, esi
test eax, eax
mov ecx, str._unknown__WARNING__Cannot_service_compile_regex:
mov dword [esp + 0x20], 0x56b328
mov dword [esp + 0x24], 2
mov dword [esp + 0x28], 0
cmove eax, ecx
mov dword [esp + 0x10], eax
mov eax, 9
cmove edi, eax
lea eax, [esp + 0x10]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x14], edi
mov dword [esp + 0x48], 0x4ef2a0
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 1
lea eax, [esp + 0x20]
push eax
call fcn.004c4f80
add esp, 4
jmp 0x4f4e87
mov eax, esi
test eax, eax
mov ecx, str._unknown__WARNING__Cannot_service_compile_regex:
mov dword [esp + 0x20], 0x56b304
mov dword [esp + 0x24], 3
mov dword [esp + 0x28], 0
cmove eax, ecx
mov dword [esp + 0x44], eax
mov eax, 9
cmove edi, eax
lea eax, [esp + 0x44]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x14], 0x4ef2a0
mov dword [esp + 0x48], edi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], 0x41af80
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 2
lea eax, [esp + 0x20]
push eax
call fcn.004c4f80
add esp, 4
cmp dword [esp + 0x6c], 0
mov ebx, dword [esp + 0x54]
mov edi, dword [esp + 0x7c]
je 0x4f4ea5
push esi
push 0
mov eax, dword [0x56bbf8]
push dword [eax]
call sub.kernel32.dll_HeapFree
mov edx, dword [esp + 0x8c]
add edi, 0xfffffff0
cmp ebx, edx
jne 0x4f4577
jmp 0x4f4f16
xor eax, eax
jmp 0x4f4882
xor eax, eax
jmp 0x4f4b09
xor eax, eax
jmp 0x4f4db5
xor eax, eax
jmp 0x4f4e18
xor eax, eax
jmp 0x4f4c09
cmp edx, ecx
mov dword [esp + 0x88], ecx
je 0x4f4f16
add edx, edi
xor esi, esi
and edx, 0xfffffff0
jmp 0x4f4ef7
add esi, 0x10
cmp edx, esi
je 0x4f4f16
cmp dword [ebx + esi + 0x14], 0
je 0x4f4ef0
push dword [ebx + esi + 0x10]
push 0
mov eax, dword [0x56bbf8]
push dword [eax]
mov edi, edx
call sub.kernel32.dll_HeapFree
mov edx, edi
jmp 0x4f4ef0
cmp dword [esp + 0x84], 0
je 0x4f4f35
mov eax, dword [0x56bbf8]
push dword [esp + 0x80]
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret