Function at 0x423d50
Capabilities:
Delete service
Query or enumerate registry value
Stop service

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b115c
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x6c0
mov eax, dword [0x503074]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4c965c
push str.ChpqWmiExModule::Uninstall
push 0
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x10
xor esi, esi
call fcn.00422b80
mov al, byte [eax + 0x38]
test al, al
je 0x423dd9
push 0x28
call fcn.00475970
add esp, 4
mov esi, eax
push str.ChpqWmiExModule::Uninstall
call fcn.00422b80
push eax
mov ecx, esi
call fcn.00477bf0
mov esi, eax
call fcn.004247c0
test eax, eax
jne 0x423df1
mov dword [ebp - 0x6ac], 1
jmp 0x4241aa
lea eax, [ebp - 0x6b4]
mov dword [ebp - 0x6b4], 0
mov dword [ebp - 0x654], eax
lea ecx, [ebp - 0x6a8]
lea eax, [ebp - 0x658]
mov dword [ebp - method.std::_Func_impl_class__lambda_75d2611776a669743d7845938f76a7e6___class_std::allocator_int___void___.virtual_0], vtable.std::_Func_impl_class__lambda_75d2611776a669743d7845938f76a7e6___class_std::allocator_int___void___.0
push eax
mov dword [ebp - 0x634], eax
call fcn.00402280
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x634]
test ecx, ecx
je 0x423e4e
mov edx, dword [ecx]
lea eax, [ebp - 0x658]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
push 0xf003f
push 0
push 0
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x6b4], eax
test eax, eax
jne 0x423e79
mov dword [ebp - 0x6ac], eax
jmp 0x42419f
lea eax, [ebp - 0x6b0]
mov dword [ebp - 0x6b0], 0
mov dword [ebp - 0x654], eax
lea ecx, [ebp - 0x680]
lea eax, [ebp - 0x658]
mov dword [ebp - method.std::_Func_impl_class__lambda_dbff3b63b4880e50ae219ae771a198d3___class_std::allocator_int___void___.virtual_0], vtable.std::_Func_impl_class__lambda_dbff3b63b4880e50ae219ae771a198d3___class_std::allocator_int___void___.0
push eax
mov dword [ebp - 0x634], eax
call fcn.00402280
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x634]
test ecx, ecx
je 0x423ed6
mov edx, dword [ecx]
lea eax, [ebp - 0x658]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
push 0x10020
push 0x50c040
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x6b4]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x6b0], eax
test eax, eax
jne 0x423f13
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x50c040
push str.Failed_to_open_service__s:__d
jmp 0x424177
lea ecx, [ebp - 0x64c]
mov dword [ebp - 0x634], 0
push ecx
xorps xmm0, xmm0
push 1
push eax
movups xmmword [ebp - 0x64c], xmm0
movq qword [ebp - 0x63c], xmm0
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6ac], eax
test edi, edi
jne 0x423ff2
mov edi, eax
push edi
push str.First_ControlService_SERVICE_CONTROL_STOP__failed._GetLastError:__d
push str.ChpqWmiExModule::Uninstall
push 2
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x14
cmp edi, 0x426
jne 0x423f81
push str.Stop_failed_with_ERROR_SERVICE_NOT_ACTIVE___continuing
jmp 0x423ff7
cmp edi, 0x435
jne 0x423f90
push str.Stop_failed_with_ERROR_SERVICE_NEVER_STARTED___continuing
jmp 0x423ff7
cmp edi, 0x425
jne 0x423fa8
cmp dword [ebp - 0x648], 3
jne 0x423fa8
push str.Stop_failed_with_SERVICE_STOP_PENDING___continuing
jmp 0x423ff7
push str.FAILED_to_stop_service__will_attempt_to_terminate_hpqwmiex_process
push str.ChpqWmiExModule::Uninstall
push 2
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00423960
xor ecx, ecx
test eax, eax
setns cl
push ecx
push str.1st_terminate_service_result:__d
push str.ChpqWmiExModule::Uninstall
push 2
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x14
jmp 0x42400c
push str.Succeeded_in_stopping_service_1st_try
push str.ChpqWmiExModule::Uninstall
push 2
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x10
push dword [ebp - 0x6b0]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 0x6ac], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c4], eax
cmp eax, 0x430
jne 0x424055
push str.Service_already_marked_for_deletion
push str.ChpqWmiExModule::Uninstall
push 2
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x10
mov dword [ebp - 0x6ac], 1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x64c]
push eax
push 1
push dword [ebp - 0x6b0]
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c0], eax
test edi, edi
jne 0x424128
mov edi, eax
push edi
push str.Second_ControlService_SERVICE_CONTROL_STOP__failed._GetLastError:__d
push str.ChpqWmiExModule::Uninstall
push 2
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x14
cmp edi, 0x426
jne 0x4240b7
push str.Stop_failed_with_ERROR_SERVICE_NOT_ACTIVE___continuing
jmp 0x42412d
cmp edi, 0x435
jne 0x4240c6
push str.Stop_failed_with_ERROR_SERVICE_NEVER_STARTED___continuing
jmp 0x42412d
cmp edi, 0x425
jne 0x4240de
cmp dword [ebp - 0x648], 3
jne 0x4240de
push str.Stop_failed_with_SERVICE_STOP_PENDING___continuing
jmp 0x42412d
push str.FAILED_to_stop_service_2nd_try__will_attempt_to_terminate_hpqwmiex_process
push str.ChpqWmiExModule::Uninstall
push 2
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00423960
xor ecx, ecx
test eax, eax
setns cl
push ecx
push str.2nd_terminate_service_result:__d
push str.ChpqWmiExModule::Uninstall
push 2
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x14
jmp 0x424142
push str.Succeeded_in_stopping_service_2nd_try
push str.ChpqWmiExModule::Uninstall
push 2
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x10
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x6ac], 0
je 0x424167
mov dword [ebp - 0x6ac], 1
call fcn.004237e0
jmp 0x424194
push dword [ebp - 0x6c4]
push 0x50c040
push str.DeleteService__s_failed_:__d
push str.ChpqWmiExModule::Uninstall
push 2
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x18
xor eax, eax
mov dword [ebp - 0x6ac], eax
lea ecx, [ebp - 0x680]
call fcn.00402190
lea ecx, [ebp - 0x6a8]
call fcn.00402190
xor eax, eax
mov dword [ebp - 0x6b8], 0
mov dword [ebp - 0x6bc], 0
mov dword [ebp - 0x6b4], eax
nop word [eax + eax]
push 0x618
lea eax, [ebp - 0x630]
push 0
push eax
call fcn.0048b3f0
add esp, 0xc
lea eax, [ebp - 0x630]
push str.SYSTEMCurrentControlSet_services_
push 0x30c
push eax
call fcn.00492537
add esp, 0xc
lea eax, [ebp - 0x630]
push 0x50c040
push 0x30c
push eax
call fcn.00492537
add esp, 0xc
lea eax, [ebp - 0x6b0]
xor edi, edi
mov dword [ebp - 0x6b0], edi
push eax
push 0x20019
push edi
lea eax, [ebp - 0x630]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42424b
mov edi, dword [ebp - 0x6b0]
jmp 0x42425c
cmp eax, 2
je 0x424370
test eax, eax
jne 0x424355
lea eax, [ebp - 0x6c4]
mov dword [ebp - 0x6c4], 4
push eax
lea eax, [ebp - 0x6b8]
push eax
lea eax, [ebp - 0x6c0]
push eax
push 0
push str.Start
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42432a
cmp dword [ebp - 0x6c0], 4
jne 0x42432a
cmp dword [ebp - 0x6b8], 4
jne 0x42432a
lea eax, [ebp - 0x6c8]
mov dword [ebp - 0x6c8], 4
push eax
lea eax, [ebp - 0x6bc]
push eax
lea eax, [ebp - 0x6cc]
push eax
push 0
push str.DeleteFlag
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4242fe
cmp dword [ebp - 0x6cc], 4
jne 0x4242fe
push 0xffffffffffffffff
push dword [ebp - 0x6b8]
mov dword [ebp - 0x6bc], 0xffffffff
push str.Uninstall_is_competing_with_an_open_service_handle_somewhere._Success_can_only_fail_to_occur__dwStartValue:__d__dwDeleteFlag:__d
jmp 0x424315
push 0
push dword [ebp - 0x6b8]
mov dword [ebp - 0x6bc], 0
push str.Uninstall_delete_flag_is_really__really_weird__dwStartValue:__d__dwDeleteFlag:__d
push str.ChpqWmiExModule::Uninstall
push 2
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x18
inc dword [ebp - 0x6b4]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
test edi, edi
je 0x424346
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x6b4], 0xf
jl 0x4241d0
jmp 0x424370
push eax
push str.Service_keys_still_active__Error:__d
push str.ChpqWmiExModule::Uninstall
push 2
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x14
cmp dword [ebp - 0x6b8], 4
mov edi, dword [ebp - 0x6ac]
jne 0x42438a
xor eax, eax
cmp dword [ebp - 0x6bc], eax
cmovne edi, eax
mov ecx, 0x4c99f0
test edi, edi
mov eax, 0x4c99e4
cmove eax, ecx
push eax
push str.Result:__s
push str.ChpqWmiExModule::Uninstall
push 1
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x14
test esi, esi
je 0x4243ca
mov ecx, esi
call fcn.00478c00
push 0x28
push esi
call fcn.00475d73
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004756da
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret