Function at 0x1008b97
Capabilities:
Delete registry value
Get common file path
Modify service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x117c
call fcn.0100b5a0
mov eax, dword [0x100e0a8]
push ebx
push esi
mov ebx, ecx
xor esi, esi
push esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x117c], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, esi
jl 0x1008fe7
push edi
mov ecx, ebx
call fcn.010080cf
test eax, eax
je 0x1008c25
call fcn.01007dd8
test eax, eax
je 0x1008be5
xor eax, eax
jmp 0x1008fe6
lea edi, [ebx + 0x68]
push edi
call fcn.01007e5a
test eax, eax
je 0x1008bde
push edi
call fcn.01007e5a
test eax, eax
jne 0x1008c25
push 0x100
mov edi, 0x100f288
push edi
push 0x72
push dword [0x100f4a0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x1008c25
push 0x1001668
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
push 1
push 0x64
push ebx
call fcn.01004289
mov edi, 0xf003f
push edi
push 0x10022f8
push 0x80000000
lea ecx, [ebp - 0x1170]
mov dword [ebp - 0x1170], esi
call fcn.010032fe
cmp eax, esi
je 0x1008c5c
mov esi, eax
jmp 0x1008fd9
push edi
push 0x10022a8
push dword [ebp - 0x1170]
lea ecx, [ebp - 0x1168]
mov dword [ebp - 0x1168], esi
call fcn.010032fe
cmp eax, esi
je 0x1008c84
mov esi, eax
jmp 0x1008fce
mov edi, 0x100228c
push edi
push dword [ebp - 0x1168]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp + 0xc], esi
je 0x1008cc8
push edi
push 0x100227c
lea ecx, [ebp - 0x1168]
call fcn.01003387
push 0x1002258
push 0x1002230
lea ecx, [ebp - 0x1168]
call fcn.01003387
mov ecx, ebx
call fcn.01008114
lea ecx, [ebp - 0x1170]
call fcn.0100328b
lea ecx, [ebp - 0x1168]
call fcn.0100328b
push esi
push dword [ebp + 8]
push ebx
call fcn.01003a16
mov dword [ebp - 0x1174], eax
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [ebp + 0xc], esi
je 0x1008fba
push 0x10021c0
lea eax, [ebp - 0x418]
push eax
mov dword [ebp - 0x1160], esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x820]
push eax
push dword [0x100eff4]
call edi
push ebx
lea eax, [ebp - 0xc30]
push eax
push dword [0x100f4a0]
call edi
push 0x46
mov dword [ebp - 0x1164], eax
xor eax, eax
pop ecx
lea edi, [ebp - 0x1158]
rep stosd dword es:[edi], eax
mov word [ebp - 0x210], si
mov ecx, 0x82
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x115c]
push eax
mov dword [ebp - 0x115c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1008d97
lea ecx, [ebp - 0x1160]
call fcn.0100328b
mov esi, 0x80004005
jmp 0x1008fce
cmp dword [ebp - 0x114c], 2
jne 0x1008e09
cmp byte [ebp - 0x1042], 1
jne 0x1008e09
cmp word [ebp - 0x1048], si
jbe 0x1008e09
push 0x105
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1008dde
push ebx
lea eax, [ebp - 0x210]
push 0x1002190
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp - 0x1164]
mov ecx, 0x207
sub ecx, eax
push 0x100216c
push ecx
lea eax, [ebp + eax*2 - 0xc30]
push eax
call dword [sym.imp.msvcrt.dll__snwprintf]
add esp, 0x10
push esi
lea eax, [ebp - 0x618]
push eax
push esi
lea eax, [ebp - 0x820]
push esi
push eax
call dword [sym.imp.msvcrt.dll__wsplitpath]
add esp, 0x14
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
push esi
mov edi, 0xf003f
push edi
push esi
push esi
lea eax, [ebp - 0x418]
push eax
mov ebx, 0x80000002
push ebx
lea ecx, [ebp - 0x1160]
call fcn.010032a9
cmp eax, esi
mov dword [ebp - 0x1164], eax
lea ecx, [ebp - 0x1160]
je 0x1008e79
call fcn.0100328b
mov esi, dword [ebp - 0x1164]
jmp 0x1008fce
push 0x1002148
lea eax, [ebp - 0xc30]
push eax
call fcn.01003387
cmp eax, esi
mov dword [ebp - 0x1164], eax
lea ecx, [ebp - 0x1160]
jne 0x1008e69
push 0x1002128
push 0x1f
call fcn.01003364
cmp eax, esi
mov dword [ebp - 0x1164], eax
lea ecx, [ebp - 0x1160]
jne 0x1008e69
call fcn.0100328b
push esi
lea eax, [ebp - 0x1178]
push eax
lea eax, [ebp - 0x116c]
push eax
push esi
push edi
push esi
push esi
push esi
push 0x1001ac0
push ebx
mov dword [ebp - 0x1178], esi
mov dword [ebp - 0x116c], esi
call fcn.0100bf4b
cmp eax, esi
jne 0x1008d82
push 0x208
lea eax, [ebp - 0x1040]
push eax
push 0x74
push dword [0x100eff8]
mov dword [ebp - 0x1164], esi
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1009002
push 1
lea eax, [ebp - 0x1040]
push eax
lea eax, [ebp - 0x1164]
push eax
push 0x1002110
push esi
push dword [ebp - 0x116c]
call fcn.0100b825
test al, al
push dword [ebp - 0x116c]
je 0x1009008
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x2000007
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
cmp ebx, esi
je 0x1008ff5
mov eax, dword [ebp - 0x117c]
push 2
add eax, 0x68
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, esi
jne 0x1008f87
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1008d82
push 0x1001fac
push esi
push esi
push 0x1001fbc
push esi
push esi
push esi
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push ebx
call esi
lea ecx, [ebp - 0x1160]
call fcn.0100328b
call fcn.01007526
test al, al
mov esi, 0x80004005
je 0x1008fce
mov esi, dword [ebp - 0x1174]
lea ecx, [ebp - 0x1168]
call fcn.0100328b
lea ecx, [ebp - 0x1170]
call fcn.0100328b
mov eax, esi
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0100b28a
leave
ret 8
lea ecx, [ebp - 0x1160]
call fcn.0100328b
jmp 0x1008fce
push dword [ebp - 0x116c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1008d82