Function at 0x47b150
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x69def4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
push ebx
push esi
push edi
test eax, eax
je 0x47b28e
call fcn.0048beb0
test al, al
je 0x47b18f
pop esi
pop ecx
pop edi
push ebx
pop ecx
push edi
push eax
pop edi
push ebp
push edi
push eax
pop eax
push esp
push edx
push ebx
pop eax
pop edi
push ebp
pop ebp
push ecx
pop edx
call fcn.0048c5b0
test al, al
je 0x47b1ab
push esp
pop esp
push edi
pop ecx
pop ebp
push esp
push esp
pop eax
push esi
push esi
push ebp
pop esp
pop ebx
pop ebx
push edi
pop esp
push esp
pop edi
push edx
call fcn.0048c0e0
test al, al
je 0x47b1d2
push edx
push edi
pop eax
pop esp
push edi
pop ebx
pop esi
pop ebp
push esi
pop edi
push esp
push ecx
pop eax
push eax
push ecx
push ebp
push ecx
push ebp
pop esp
push esp
pop edx
pop esp
pop ebp
pop eax
pop esp
pop ebx
pop esi
push edi
push edi
pop ebp
mov ecx, dword [ebp - 0x24]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47b1e0
sub ecx, edx
sar ecx, 1
je 0x47b28e
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x28], eax
call fcn.0048beb0
test al, al
je 0x47b225
pop esi
pop ecx
pop edi
push ebx
pop ecx
push edi
push eax
pop edi
push ebp
push edi
push eax
pop eax
push esp
push edx
push ebx
pop eax
pop edi
push ebp
pop ebp
push ecx
pop edx
call fcn.0048c5b0
test al, al
je 0x47b241
push esp
pop esp
push edi
pop ecx
pop ebp
push esp
push esp
pop eax
push esi
push esi
push ebp
pop esp
pop ebx
pop ebx
push edi
pop esp
push esp
pop edi
push edx
call fcn.0048c0e0
test al, al
je 0x47b268
push edx
push edi
pop eax
pop esp
push edi
pop ebx
pop esi
pop ebp
push esi
pop edi
push esp
push ecx
pop eax
push eax
push ecx
push ebp
push ecx
push ebp
pop esp
push esp
pop edx
pop esp
pop ebp
pop eax
pop esp
pop ebx
pop esi
push edi
push edi
pop ebp
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x47b28e
push 0x10020
push dword [ebp - 0x24]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
jne 0x47b2a3
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005cabbc
mov esp, ebp
pop ebp
ret 4
call fcn.0048bcf0
test al, al
je 0x47b2be
pop eax
push edx
push edi
pop esi
push edx
push esi
push edi
push esi
push eax
push eax
pop esp
pop ebp
push edi
pop ecx
push esp
pop esp
pop esi
push ebx
call fcn.0048c460
test al, al
je 0x47b2da
push ebx
pop esi
pop esi
push ebp
pop edx
push ecx
pop ebx
pop eax
pop ecx
pop esp
pop esi
pop ecx
pop edx
push ebp
pop edx
push edi
mov ebx, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push dword [ebp - 0x24]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
test edi, edi
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.005cabbc
mov esp, ebp
pop ebp
ret 4