Function at 0x418ab0
Capabilities:
Delete service

Disassembly:
push 0x24
mov eax, 0x4aa08c
call fcn.004a95a1
mov ebx, ecx
mov dword [ebp - 0x2c], ebx
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x418ae6
test byte [eax + 0x1c], 1
je 0x418ae6
push dword [eax + 0x14]
mov edx, 0x405830
push dword [eax + 0x10]
push 0x3f
pop ecx
call fcn.00416054
mov esi, 0x405330
lea edi, [ebp - 0x24]
push 0xf003f
push 0
push 0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x28], esi
test esi, esi
jne 0x418beb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x418b42
test byte [eax + 0x1c], 2
je 0x418b42
cmp byte [eax + 0x19], 2
jb 0x418b42
push ebx
push dword [eax + 0x14]
mov edx, 0x405830
push dword [eax + 0x10]
push 0x40
pop ecx
call fcn.0041610f
lea edi, [ebp - 0x24]
cmp ebx, 5
jne 0x418bdd
mov esi, 0x405220
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x4b8970
lea ecx, [ebp - 0x28]
call fcn.00417475
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push ebx
push 0x405818
push eax
call fcn.0041a5a1
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
mov esi, dword [ebp - 0x28]
add esp, 0xc
push 0
push esi
push dword [eax + 0x24]
push ecx
mov ecx, eax
call fcn.00417c6c
lea ecx, [esi - 0x10]
call fcn.004174b0
mov esi, dword [0x4b70c8]
cmp esi, 0x4b70c8
je 0x418bd5
test byte [esi + 0x1c], 1
je 0x418bd5
movzx ecx, byte [esi + 0x19]
mov eax, ebx
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
cmp ecx, eax
jb 0x418bd5
push ebx
push dword [esi + 0x14]
mov edx, 0x405830
push dword [esi + 0x10]
push 0x46
pop ecx
call fcn.0041610f
mov eax, ebx
call fcn.004a9550
ret
mov esi, 0x405210
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x418d8b
push 0x10024
push dword [ebx + 0x24]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
mov dword [ebp - 0x30], ebx
test ebx, ebx
jne 0x418c89
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x424
jne 0x418c49
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x418c42
test byte [eax + 0x1c], 2
je 0x418c42
cmp byte [eax + 0x19], 4
jb 0x418c42
push dword [eax + 0x14]
mov edx, 0x405830
push dword [eax + 0x10]
push 0x41
pop ecx
call fcn.00416054
xor ebx, ebx
jmp 0x418d84
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x418c75
test byte [eax + 0x1c], 2
je 0x418c75
cmp byte [eax + 0x19], 2
jb 0x418c75
push ebx
push dword [eax + 0x14]
mov edx, 0x405830
push dword [eax + 0x10]
push 0x42
pop ecx
call fcn.0041610f
mov esi, 0x405200
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x28]
jmp 0x418d84
push ecx
mov edx, ebx
mov ecx, esi
call fcn.004188d3
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x418ccd
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x418cc9
test byte [eax + 0x1c], 2
je 0x418cc9
cmp byte [eax + 0x19], 4
jb 0x418cc9
push dword [eax + 0x14]
mov edx, 0x405830
push dword [eax + 0x10]
push 0x43
pop ecx
call fcn.00416054
xor ebx, ebx
jmp 0x418d49
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x430
jne 0x418d11
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x418d08
test byte [eax + 0x1c], 2
je 0x418d08
cmp byte [eax + 0x19], 4
jb 0x418d08
push dword [eax + 0x14]
mov edx, 0x405830
push dword [eax + 0x10]
push 0x44
pop ecx
call fcn.00416054
xor ebx, ebx
mov esi, 0x405320
jmp 0x418d42
mov eax, dword [0x4b70c8]
cmp eax, 0x4b70c8
je 0x418d3d
test byte [eax + 0x1c], 2
je 0x418d3d
cmp byte [eax + 0x19], 2
jb 0x418d3d
push ebx
push dword [eax + 0x14]
mov edx, 0x405830
push dword [eax + 0x10]
push 0x45
pop ecx
call fcn.0041610f
mov esi, 0x4051f0
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0xea60
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ecx
mov ecx, dword [ebp - 0x2c]
mov esi, esp
mov edi, eax
mov dword [ebp - 0x30], esi
mov ecx, dword [ecx + 0x24]
sub ecx, 0x10
call fcn.004170e6
add eax, 0x10
mov edx, edi
mov dword [esi], eax
mov esi, dword [ebp - 0x28]
mov ecx, esi
call fcn.004184b6
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
jne 0x418b57
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
push ebx
push ebx
push dword [eax + 0x24]
push ecx
mov ecx, eax
call fcn.00417c6c
jmp 0x418b99