Function at 0x433e4f
Capabilities:
Delete service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
xor ecx, ecx
mov dword [ebp - 0x22c], eax
mov esi, ecx
mov ebx, ecx
push edi
mov edi, edx
mov dword [ebp - 0x230], edi
cmp eax, 0xffffffff
je 0x43415b
test edi, edi
je 0x43415b
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], ecx
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push edi
call dword [sym.imp.SETUPAPI.dll_SetupGetLineTextW]
test eax, eax
je 0x43415b
mov eax, dword [ebp - 0x21c]
xor ecx, ecx
inc eax
push 2
pop edx
mov dword [ebp - 0x21c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044183a
mov dword [ebp - 0x228], eax
pop ecx
test eax, eax
je 0x43415b
xor ecx, ecx
push ecx
push dword [ebp - 0x21c]
push eax
push ecx
push ecx
push ecx
push edi
call dword [sym.imp.SETUPAPI.dll_SetupGetLineTextW]
test eax, eax
jne 0x433f36
push dword [ebp - 0x228]
call fcn.00441807
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x433f14
push 0x57
pop esi
test esi, esi
jle 0x433f1f
movzx esi, si
or esi, 0x80070000
push esi
push 0x408d30
push 4
call fcn.0041ea5f
add esp, 0xc
mov eax, esi
jmp 0x43415f
push 0x4059e8
push dword [ebp - 0x228]
jmp 0x434135
push edi
push 0x408df8
push 4
call fcn.0041ea5f
add esp, 0xc
push dword [ebp - 0x230]
push 0
push edi
push dword [ebp - 0x22c]
call dword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x43412e
push edi
push dword [ebp - 0x22c]
mov dword [ebp - 0x224], 1
call dword [sym.imp.SETUPAPI.dll_SetupGetLineCountW]
mov edi, eax
mov ecx, edi
mov dword [ebp - 0x238], edi
call fcn.0041de27
cmp edi, 1
jb 0x43412e
mov edi, dword [ebp - 0x230]
mov ecx, dword [ebp - 0x224]
call fcn.0041dfa0
inc dword [ebp - 0x224]
lea eax, [ebp - 0x218]
push 0
push 0x105
push eax
push 1
push edi
call dword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x434110
xor eax, eax
lea edx, [ebp - 0x218]
inc eax
xor ecx, ecx
mov dword [ebp - 0x220], eax
call fcn.004331df
test eax, eax
je 0x4340c5
mov esi, 0xf003f
push esi
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x234], eax
test eax, eax
je 0x4340a1
push esi
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x43407d
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x43405e
mov dword [ebp - 0x220], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x434047
push 0x57
pop eax
push eax
lea eax, [ebp - 0x218]
push eax
push 0x408ca8
push 2
call fcn.0041ea5f
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
push 0x408ce4
push 4
call fcn.0041ea5f
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x434093
lea eax, [ebp - 0x218]
push eax
push 0x408d0c
push 4
call fcn.0041ea5f
add esp, 0xc
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4340f1
xor eax, eax
mov dword [ebp - 0x220], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4340b6
push 0x57
pop eax
push eax
lea eax, [ebp - 0x218]
push eax
push 0x408b00
jmp 0x4340e7
xor eax, eax
mov dword [ebp - 0x220], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4340da
push 0x57
pop eax
push eax
lea eax, [ebp - 0x218]
push eax
push 0x408ca8
push 2
call fcn.0041ea5f
add esp, 0x10
mov eax, dword [ebp - 0x220]
mov ecx, 0x80004005
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x7fffbffb
add esi, ecx
test eax, eax
jne 0x434110
mov ebx, ecx
push edi
push edi
call dword [sym.imp.SETUPAPI.dll_SetupFindNextLine]
test eax, eax
je 0x43412e
mov ecx, dword [ebp - 0x224]
cmp ecx, dword [ebp - 0x238]
jbe 0x433fae
push 0x4059e8
push 0
call dword [sym.imp.msvcrt.dll_wcstok]
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x433f46
push dword [ebp - 0x228]
call fcn.00441807
pop ecx
test esi, esi
js 0x43415b
test ebx, ebx
jne 0x43415d
mov ebx, esi
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret