Function at 0x5f38d1
Capabilities:
Delete service

Disassembly:
push 0x500
mov eax, 0x6b9a0c
call fcn.0064d086
push 7
pop edi
xor ebx, ebx
lea ecx, [ebp - 0xf4]
mov dword [ebp - 4], ebx
xor eax, eax
push str.ClickToRunSvc
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], edi
mov word [ebp - 0xf4], ax
call fcn.0040d510
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xdc]
xor eax, eax
mov dword [ebp - 0xcc], ebx
push str.OfficeSvc
mov dword [ebp - 0xc8], edi
mov word [ebp - 0xdc], ax
call fcn.0040d510
mov byte [ebp - 4], 2
lea eax, [ebp - 0xc4]
push dword [ebp - 0x4fc]
lea ecx, [ebp - 0x508]
mov dword [ebp - 0x508], ebx
push eax
lea eax, [ebp - 0xf4]
mov dword [ebp - 0x504], ebx
push eax
mov dword [ebp - 0x500], ebx
call fcn.00411fc4
push fcn.0040d3a3
push 2
push 0x18
lea eax, [ebp - 0xf4]
mov byte [ebp - 4], 4
push eax
call fcn.0064c692
mov esi, dword [ebp - 0x508]
cmp esi, dword [ebp - 0x504]
je 0x5f3db5
push esi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call fcn.0040d595
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 5
call fcn.0050cee2
push 4
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x30]
call fcn.0050d066
test al, al
jne 0x5f39e8
lea eax, [ebp - 0x48]
mov ecx, 0x7c1405
push eax
push str.O15Client::RemoveOfficeService:___s_is_not_installed._Continuing.
push 0x32
push 0xe
pop edx
call fcn.004fae82
lea ecx, [ebp - 0x30]
call fcn.0050cfd9
jmp 0x5f3da1
lea ecx, [ebp - 0x30]
call fcn.0050cfd9
lea eax, [ebp - 0x48]
mov ecx, 0x7c1406
push eax
push str.O15Client::RemoveOfficeService:_Ensure_service__s_is_shut_down_and_removed.
push 0x32
push 0xe
pop edx
call fcn.004fae82
lea ecx, [ebp - 0x48]
call fcn.005f24d4
test al, al
jne 0x5f3b4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
mov dword [ebp - 0x4ec], eax
push 7
xor eax, eax
mov dword [ebp - 0x68], ebx
lea edi, [ebp - 0xc4]
mov word [ebp - 0x78], ax
pop esi
rep stosd dword es:[edi], eax
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], esi
mov word [ebp - 0x60], ax
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], esi
mov word [ebp - 0xa8], ax
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], esi
mov word [ebp - 0x90], ax
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x4ec]
push eax
lea ecx, [ebp - 0x15c]
call fcn.005b30c3
xor ecx, ecx
mov dword [ebp - 0xc4], vtable.C2R::CommonTelemetry.0
mov word [ebp - 0xc0], cx
mov edx, 0x3ae
lea ecx, [ebp - 0x4f8]
mov dword [ebp - 0xb0], ebx
push ecx
push eax
lea eax, [ebp - 0xc4]
mov dword [ebp - 0xac], esi
push eax
push str.O15Client::RemoveOfficeService
push 0xa
mov ecx, 0x8807d5
mov dword [ebp - method.Mso::Logging::StructuredObject_wchar_t_const___1_.virtual_0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov dword [ebp - 0x4f4], str.ContextData
mov dword [ebp - 0x4f0], str.Service_failed_to_shutdown._Cant_remove_service.
call fcn.00411ea6
lea ecx, [ebp - 0xc0]
call fcn.0040d475
lea ecx, [ebp - 0x15c]
call fcn.00413b8b
lea ecx, [ebp - 0x90]
call fcn.0040d475
lea ecx, [ebp - 0xa8]
call fcn.0040d475
lea ecx, [ebp - 0x60]
call fcn.0040d475
lea ecx, [ebp - 0x78]
call fcn.0040d475
lea ecx, [ebp - 0x48]
call fcn.0040d475
lea ecx, [ebp - 0x508]
call fcn.004158e4
xor al, al
call fcn.0064cfd3
ret
lea ecx, [ebp - 0x30]
call fcn.0050cee2
push 0x10000
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x30]
call fcn.0050d066
test al, al
je 0x5f3b7a
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x5f3b8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
jne 0x5f3e82
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 5
call fcn.0050cfd9
lea ecx, [ebp - 0x48]
call fcn.005f4a29
mov cl, al
xor eax, eax
inc eax
mov dword [ebp - 0x4ec], eax
cmp eax, 3
jge 0x5f3bd5
test cl, cl
jne 0x5f3d18
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x48]
call fcn.005f4a29
mov cl, al
mov eax, dword [ebp - 0x4ec]
inc eax
jmp 0x5f3ba4
test cl, cl
jne 0x5f3d18
lea eax, [ebp - 0x48]
mov edx, str.Service_removal_failed._ServiceName:_s
push eax
lea ecx, [ebp - 0xc0]
call reloc.KERNEL32.dll_WerRegisterMemoryBlock
mov dword [ebp - 0x4ec], eax
cmp dword [eax + 0x14], 8
jb 0x5f3c05
mov eax, dword [eax]
mov dword [ebp - 0x4ec], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
mov dword [ebp - 0x4fc], eax
push 7
xor eax, eax
mov dword [ebp - 0x80], ebx
lea edi, [ebp - 0x30]
mov word [ebp - 0x90], ax
pop esi
rep stosd dword es:[edi], eax
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], esi
mov word [ebp - 0xa8], ax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], esi
mov word [ebp - 0x60], ax
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], esi
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x4fc]
push eax
lea ecx, [ebp - 0x15c]
call fcn.005b30c3
mov ecx, eax
mov dword [ebp - 0x30], vtable.C2R::CommonTelemetry.0
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
mov edx, 0x3ae
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x4f0], eax
lea eax, [ebp - 0x4f8]
push eax
push ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], esi
push eax
push str.O15Client::RemoveOfficeService
push 0xa
mov ecx, 0x8807d6
mov dword [ebp - method.Mso::Logging::StructuredObject_wchar_t_const___1_.virtual_0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov dword [ebp - 0x4f4], str.ContextData
call fcn.00411ea6
lea ecx, [ebp - 0x2c]
call fcn.0040d475
lea ecx, [ebp - 0x15c]
call fcn.00413b8b
lea ecx, [ebp - 0x78]
call fcn.0040d475
lea ecx, [ebp - 0x60]
call fcn.0040d475
lea ecx, [ebp - 0xa8]
call fcn.0040d475
lea ecx, [ebp - 0x90]
call fcn.0040d475
lea ecx, [ebp - 0xc0]
jmp 0x5f3b2c
lea eax, [ebp - 0x48]
mov edx, str.Service_removal_completed_successfully._ServiceName:_s
push eax
lea ecx, [ebp - 0xc0]
call reloc.KERNEL32.dll_WerRegisterMemoryBlock
mov edx, eax
cmp dword [edx + 0x14], 8
jb 0x5f3d36
mov edx, dword [edx]
xor eax, eax
mov dword [ebp - 0x4f0], edx
mov ecx, edi
mov dword [ebp - method.Mso::Logging::StructuredObject_wchar_t_const___1_.virtual_0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
push 7
lea edi, [ebp - 0x30]
mov dword [ebp - 0x4f4], str.ContextData
rep stosd dword es:[edi], eax
pop edi
mov word [ebp - 0x2c], ax
mov edx, 0x3b0
lea eax, [ebp - 0x4f8]
mov dword [ebp - 0x30], vtable.C2R::CommonTelemetry.0
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x1c], ebx
push eax
push str.O15Client::RemoveOfficeService
push 0x32
mov ecx, 0x8807d7
mov dword [ebp - 0x18], edi
call fcn.00411dd9
lea ecx, [ebp - 0x2c]
call fcn.0040d475
lea ecx, [ebp - 0xc0]
call fcn.0040d475
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 4
call fcn.0040d475
add esi, 0x18
jmp 0x5f398a
lea ecx, [ebp - 0x508]
call fcn.004158e4
mov al, 1
jmp 0x5f3b46
lea eax, [ebp - 0x48]
push eax
push str.failed_to_delete_service__s
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
lea ecx, [ebp - 0x4e8]
call fcn.0050a643
push 0x811494
lea eax, [ebp - 0x4e8]
push eax
call fcn.0064f293
int3