Function at 0x102ad50
Capabilities:
Delete service

Disassembly:
push 0x10
mov eax, 0x10df4fa
call fcn.010a0c60
mov edi, ecx
mov dword [ebp - 0x18], edi
mov eax, dword [0x10ed030]
mov esi, 0x10ed030
cmp eax, esi
je 0x102ad87
test byte [eax + 0x1c], 1
je 0x102ad87
push 0x10029d4
push 0x40
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
push 0xf003f
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 0x10], 0x400d377a
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x102ae85
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102add8
test byte [eax + 0x1c], 2
je 0x102add8
cmp byte [eax + 0x19], 2
jb 0x102add8
push edi
push 0x10029d4
push 0x41
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
cmp edi, 5
jne 0x102ae79
mov dword [ebp - 0x10], 0xc00d37e7
push 0x10f1178
lea ecx, [ebp - 0x14]
call fcn.0102847f
push edi
lea eax, [ebp - 0x14]
push 0x1002a04
push eax
mov dword [ebp - 4], ebx
call fcn.0102ad35
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
add esp, 0xc
push ebx
push esi
push dword [ecx + 0x24]
push dword [ebp - 0x10]
push 1
call fcn.0102a65e
mov ecx, dword [0x10efc9c]
push edi
push dword [ebp - 0x10]
call fcn.0102d8fa
lea ecx, [esi - 0x10]
call fcn.01028079
mov esi, 0x10ed030
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102ae71
test byte [eax + 0x1c], 1
je 0x102ae71
movzx ecx, byte [eax + 0x19]
mov edx, edi
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x102ae71
push edi
push 0x10029d4
push 0x47
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
mov eax, edi
call fcn.010a0d4c
ret
mov dword [ebp - 0x10], 0xc00d37e8
jmp 0x102b006
lea ebx, [edi + 0x24]
mov eax, dword [ebx]
push 0x10024
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
jne 0x102af1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x424
jne 0x102aedd
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102aed9
test byte [eax + 0x1c], 2
je 0x102aed9
cmp byte [eax + 0x19], 4
jb 0x102aed9
push 0x10029d4
push 0x42
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
xor edi, edi
jmp 0x102af0c
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102af05
test byte [eax + 0x1c], 2
je 0x102af05
cmp byte [eax + 0x19], 2
jb 0x102af05
push edi
push 0x10029d4
push 0x43
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
mov dword [ebp - 0x10], 0xc00d37e9
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x102b004
push 0x7530
push edi
push dword [ebp - 0x14]
call fcn.010297ac
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x102af5e
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102af5a
test byte [eax + 0x1c], 2
je 0x102af5a
cmp byte [eax + 0x19], 4
jb 0x102af5a
push 0x10029d4
push 0x44
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
xor edi, edi
jmp 0x102afcf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x430
jne 0x102afa0
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102af95
test byte [eax + 0x1c], 2
je 0x102af95
cmp byte [eax + 0x19], 4
jb 0x102af95
push 0x10029d4
push 0x45
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
xor edi, edi
mov dword [ebp - 0x10], 0x400d377b
jmp 0x102afcf
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102afc8
test byte [eax + 0x1c], 2
je 0x102afc8
cmp byte [eax + 0x19], 2
jb 0x102afc8
push edi
push 0x10029d4
push 0x46
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010294b2
mov dword [ebp - 0x10], 0xc00d37ea
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push 0xea60
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push ebx
call fcn.010287b7
push dword [ebp - 0x14]
call fcn.0102a9a2
push dword [ebp - 0x14]
call esi
mov esi, 0x10ed030
xor ebx, ebx
cmp edi, ebx
jne 0x102ade8
mov ecx, dword [ebp - 0x18]
push ebx
push ebx
push dword [ecx + 0x24]
push dword [ebp - 0x10]
push 4
call fcn.0102a65e
mov ecx, dword [0x10efc9c]
push ebx
push dword [ebp - 0x10]
call fcn.0102d8fa
jmp 0x102ae3b