Function at 0x405400
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [ebx + 8]
push 1
push str.Deleting_a_service_can_prevent_the_system_from_starting_or_functioning_properly.
push dword [eax + 4]
push 0x54b33c
push edi
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
jne 0x405437
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx + 8]
push 1
push 0
push 0
mov esi, dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [esp + 0x14], eax
test eax, eax
je 0x405497
push 0x10000
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x405497
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
test eax, eax
je 0x405491
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4054ad
movzx esi, si
or esi, 0xc0070000
mov eax, dword [ebx + 8]
push dword [eax + 4]
push str.Unable_to_delete
call sym.ProcessHacker.exe_PhConcatStrings2
push eax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea ecx, [esp + 0x13]
push ecx
push esi
mov edx, dword [eax + 4]
mov ecx, edi
call fcn.00401680
test al, al
je 0x40553a
xor bl, bl
cmp byte [esp + 0x13], bl
je 0x40560c
mov esi, dword [ebp + 0xc]
mov edx, 5
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 4]
call fcn.004568a0
lea ecx, [ecx]
test eax, eax
js 0x405516
mov bl, 1
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push ecx
push eax
push esi
mov edx, 0x54b33c
mov ecx, edi
lfence
call fcn.004047a0
xor bl, bl
call sym.ProcessHacker.exe__PhUiDisconnectFromPhSvc_0
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx + 8]
push dword [eax + 4]
push 0x54b33c
push str.Unable_to__s__s.
call fcn.00401520
add esp, 0xc
mov ebx, dword [eax + 4]
cmp esi, 0xc0000022
je 0x40557b
lea ecx, [ecx]
cmp esi, 0xc0000005
je 0x40557b
mov eax, esi
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x40558a
movzx eax, si
jmp 0x405586
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x405592
push esi
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x405598
push eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov esi, eax
test esi, esi
je 0x4055e9
mov eax, dword [esi + 4]
push eax
push 0x54ace8
test ebx, ebx
je 0x4055be
push ebx
push 0xfffe
push 0x20
push edi
call sym.ProcessHacker.exe_PhShowMessage2
add esp, 0x18
jmp 0x4055c9
push 0x10
push edi
call sym.ProcessHacker.exe_PhShowMessage
add esp, 0x10
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x40560a
call fcn.004b3960
xor bl, bl
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test ebx, ebx
je 0x4055f5
push ebx
push 0x57e1d4
jmp 0x4055ff
push str.Unable_to_perform_the_operation.
push 0x54ace8
push 0x10
push edi
call sym.ProcessHacker.exe_PhShowMessage
add esp, 0x10
xor bl, bl
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8