Function at 0x418c9d
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1034
call fcn.00424390
mov eax, dword [0x46d290]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.00413ce8
test eax, eax
jne 0x418cc6
inc eax
jmp 0x418f44
push ebx
push edi
push 0xf003f
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x1030], ebx
test ebx, ebx
jne 0x418d50
mov ebx, 0x400
lea eax, [ebp - 0x804]
push ebx
push eax
push 0xd80a
call fcn.0040f38c
add esp, 0xc
test eax, eax
jne 0x418d3e
push edi
lea eax, [ebp - 0x102c]
push str.Cik7IyFvKjo5djkgJjhoET8_My4lL3UOOzkoLCI0
push eax
call fcn.0040fe8d
pop ecx
pop ecx
mov ecx, eax
call fcn.00404f20
push eax
lea eax, [ebp - 0x804]
push ebx
push eax
call fcn.00422d36
push eax
call fcn.004031e5
add esp, 0x10
lea ecx, [ebp - 0x102c]
call fcn.00404a45
push edi
lea eax, [esi + 0x2c]
push eax
lea eax, [ebp - 0x804]
push eax
push edi
jmp 0x418f3a
push 0xf01ff
lea edi, [esi + 0x2c]
push edi
push ebx
mov dword [ebp - 0x1034], edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x418ddc
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, 0x400
lea eax, [ebp - 0x804]
push ebx
push eax
push 0xd80c
call fcn.0040f38c
add esp, 0xc
test eax, eax
jne 0x418dce
push eax
lea eax, [ebp - 0x102c]
push str.Cik7IyFvKjo5djkgJjhoMT8_My4lLw
push eax
call fcn.0040fe8d
pop ecx
pop ecx
mov ecx, eax
call fcn.00404f20
push eax
lea eax, [ebp - 0x804]
push ebx
push eax
call fcn.00422d36
push eax
call fcn.004031e5
add esp, 0x10
lea ecx, [ebp - 0x102c]
call fcn.00404a45
push 0
push edi
lea eax, [ebp - 0x804]
jmp 0x418f37
lea eax, [ebp - 0x1020]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ebx, 0x400
test eax, eax
jne 0x418e7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x418e7e
cmp eax, 0x425
jne 0x418e16
cmp dword [ebp - 0x101c], 3
je 0x418e7e
push ebx
lea eax, [ebp - 0x804]
push eax
push 0xd80e
call fcn.0040f38c
add esp, 0xc
test eax, eax
jne 0x418e6c
push eax
lea eax, [ebp - 0x102c]
push str.Cik7IyFvKjo5diUkLCZoMT8_My4lLw
push eax
call fcn.0040fe8d
pop ecx
pop ecx
mov ecx, eax
call fcn.00404f20
push eax
lea eax, [ebp - 0x804]
push ebx
push eax
call fcn.00422d36
push eax
call fcn.004031e5
add esp, 0x10
lea ecx, [ebp - 0x102c]
call fcn.00404a45
push 0
push edi
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor edi, edi
jmp 0x418ea7
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, edi
inc edi
cmp eax, 0x3c
jae 0x418eb0
lea eax, [ebp - 0x1020]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x418eb0
cmp dword [ebp - 0x101c], 1
jne 0x418e82
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
call esi
push dword [ebp - 0x1030]
call esi
test edi, edi
je 0x418ed3
xor eax, eax
inc eax
jmp 0x418f42
push ebx
lea eax, [ebp - 0x1004]
push eax
push 0xd80d
call fcn.0040f38c
add esp, 0xc
test eax, eax
jne 0x418f29
push eax
lea eax, [ebp - 0x102c]
push str.Cik7IyFvKjo5djI1LzM8J3oIDUwIzYm
push eax
call fcn.0040fe8d
pop ecx
pop ecx
mov ecx, eax
call fcn.00404f20
push eax
lea eax, [ebp - 0x1004]
push ebx
push eax
call fcn.00422d36
push eax
call fcn.004031e5
add esp, 0x10
lea ecx, [ebp - 0x102c]
call fcn.00404a45
push 0
push dword [ebp - 0x1034]
lea eax, [ebp - 0x1004]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00421ac3
mov esp, ebp
pop ebp
ret