Function at 0x559ee9
Capabilities:
Modify service

Disassembly:
push 0x19c
mov eax, 0x5d6547
call fcn.00573e45
mov esi, edx
mov ebx, ecx
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x18c], eax
call fcn.00559292
test al, al
jne 0x559f2e
push str.O15Client::RestoreOfficeService:_failed_to_remove_new_service.
push 0x32
push 0xe
pop edx
mov ecx, 0x7c1409
call fcn.0048399f
pop ecx
pop ecx
xor al, al
jmp 0x55a2be
xor edx, edx
mov dword [ebp - 0x8c], 7
xor eax, eax
mov dword [ebp - 0x90], edx
mov word [ebp - 0xa0], ax
mov dword [ebp - 4], edx
cmp dword [esi + 0x14], 8
jb 0x559f56
mov ecx, dword [esi]
jmp 0x559f58
mov ecx, esi
push edx
mov edx, dword [str.ClickToRunSvc]
push 0xffffffffffffffff
call fcn.00408439
test eax, eax
jne 0x559f93
push ebx
mov edx, str.__s___service
lea ecx, [ebp - 0x40]
call fcn.004f3600
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040959d
xor ebx, ebx
lea ecx, [ebp - 0x40]
push ebx
push 1
call fcn.0040968b
jmp 0x559fc9
cmp dword [esi + 0x14], 8
jb 0x559f9d
mov ecx, dword [esi]
jmp 0x559f9f
mov ecx, esi
push 0
push 0xffffffffffffffff
mov edx, str.OfficeSvc
call fcn.00408439
test eax, eax
jne 0x559fc7
lea eax, [ebp - 0xa0]
cmp eax, ebx
je 0x559fc7
push 0xffffffffffffffff
push 0
push ebx
mov ecx, eax
call fcn.00409884
xor ebx, ebx
lea ecx, [ebp - 0x1a8]
call fcn.0054d8fa
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
push ecx
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
push ecx
push ecx
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x1a8]
push esi
call fcn.0054dea6
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0040968b
push 0x40012
push esi
lea ecx, [ebp - 0x1a8]
call fcn.0054da18
test al, al
jne 0x55a133
push 0x6c1b20
mov edx, str.Service_cannot_open_ServiceName:_s
lea ecx, [ebp - 0xb8]
call fcn.0053ced4
mov edi, eax
cmp dword [edi + 0x14], 8
jb 0x55a04f
mov edi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 7
mov dword [ebp - 0x18c], eax
xor eax, eax
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ebx
mov word [ebp - 0x88], ax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], ebx
mov word [ebp - 0x70], ax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x58], ax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], cl
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x18c]
push eax
lea ecx, [ebp - 0x188]
call fcn.0051542d
mov esi, eax
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 8
call fcn.0050f875
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
push ecx
push esi
push eax
push str.O15Client::RestoreOfficeService
push 0xa
mov edx, 0x3ae
mov dword [ebp - 0x18], str.ContextData
mov ecx, 0x7c140a
mov dword [ebp - 0x14], edi
call fcn.0040c19d
lea ecx, [ebp - 0x120]
call fcn.0040c0f8
lea ecx, [ebp - 0x188]
call fcn.0040c9ed
xor esi, esi
lea ecx, [ebp - 0x58]
push ebx
inc esi
push esi
call fcn.0040968b
push ebx
push esi
lea ecx, [ebp - 0x70]
call fcn.0040968b
push ebx
push esi
lea ecx, [ebp - 0x88]
call fcn.0040968b
lea ecx, [ebp - 0x40]
jmp 0x55a28a
sub esp, 0xc
call fcn.0055b7d7
cmp dword [edi + 0x14], 8
jb 0x55a143
mov edi, dword [edi]
lea eax, [ebp - 0x18c]
mov dword [ebp - 0x18c], edi
push eax
push 1
push dword [ebp - 0x1a4]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
sub esp, 0x10
lea ecx, [ebp - 0x1a8]
call fcn.0054df74
push ecx
lea ecx, [ebp - 0x1a8]
call fcn.0054dfda
lea ecx, [ebp - 0x1a8]
call fcn.0054dae2
test al, al
jne 0x55a2a0
push 0x6c1b20
mov edx, str.Service_cannot_start_ServiceName:_s
lea ecx, [ebp - 0xb8]
call fcn.0053ced4
mov edi, eax
cmp dword [edi + 0x14], 8
jb 0x55a1aa
mov edi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 7
mov dword [ebp - 0x18c], eax
xor eax, eax
pop ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x58], ax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], ebx
mov word [ebp - 0x70], ax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ebx
mov word [ebp - 0x88], ax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x18c]
push eax
lea ecx, [ebp - 0x120]
call fcn.0051542d
mov esi, eax
lea ecx, [ebp - 0x188]
mov byte [ebp - 4], 0xe
call fcn.0050f875
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
push ecx
push esi
push eax
push str.O15Client::RestoreOfficeService
push 0xa
mov edx, 0x3ae
mov dword [ebp - 0x18], str.ContextData
mov ecx, 0x7c140c
mov dword [ebp - 0x14], edi
call fcn.0040c19d
lea ecx, [ebp - 0x188]
call fcn.0040c0f8
lea ecx, [ebp - 0x120]
call fcn.0040c9ed
xor esi, esi
lea ecx, [ebp - 0x40]
push ebx
inc esi
push esi
call fcn.0040968b
push ebx
push esi
lea ecx, [ebp - 0x88]
call fcn.0040968b
push ebx
push esi
lea ecx, [ebp - 0x70]
call fcn.0040968b
lea ecx, [ebp - 0x58]
push ebx
push esi
call fcn.0040968b
push ebx
push esi
lea ecx, [ebp - 0xb8]
call fcn.0040968b
jmp 0x55a2a2
mov bl, 1
lea ecx, [ebp - 0x1a8]
call fcn.0054d9f0
push 0
push 1
lea ecx, [ebp - 0xa0]
call fcn.0040968b
mov al, bl
call fcn.00573def
ret 8