Function at 0x102acc1
Capabilities:
Delete service

Disassembly:
push 0x10
mov eax, 0x10df293
call fcn.010a0b4c
mov edi, ecx
mov dword [ebp - 0x18], edi
mov eax, dword [0x10ed030]
mov esi, 0x10ed030
cmp eax, esi
je 0x102acf8
test byte [eax + 0x1c], 1
je 0x102acf8
push 0x10029d4
push 0x40
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
push 0xf003f
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 0x10], 0x400d377a
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x102adf6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102ad49
test byte [eax + 0x1c], 2
je 0x102ad49
cmp byte [eax + 0x19], 2
jb 0x102ad49
push edi
push 0x10029d4
push 0x41
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
cmp edi, 5
jne 0x102adea
mov dword [ebp - 0x10], 0xc00d37e7
push 0x10f1178
lea ecx, [ebp - 0x14]
call fcn.0104bdc3
push edi
lea eax, [ebp - 0x14]
push 0x1002a04
push eax
mov dword [ebp - 4], ebx
call fcn.0102aca6
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
add esp, 0xc
push ebx
push esi
push dword [ecx + 0x24]
push dword [ebp - 0x10]
push 1
call fcn.0102a5cf
mov ecx, dword [0x10efc9c]
push edi
push dword [ebp - 0x10]
call fcn.0102d817
lea ecx, [esi - 0x10]
call fcn.010280a5
mov esi, 0x10ed030
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102ade2
test byte [eax + 0x1c], 1
je 0x102ade2
movzx ecx, byte [eax + 0x19]
mov edx, edi
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x102ade2
push edi
push 0x10029d4
push 0x47
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
mov eax, edi
call fcn.010a0c38
ret
mov dword [ebp - 0x10], 0xc00d37e8
jmp 0x102af77
lea ebx, [edi + 0x24]
mov eax, dword [ebx]
push 0x10024
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
jne 0x102ae8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x424
jne 0x102ae4e
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102ae4a
test byte [eax + 0x1c], 2
je 0x102ae4a
cmp byte [eax + 0x19], 4
jb 0x102ae4a
push 0x10029d4
push 0x42
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
xor edi, edi
jmp 0x102ae7d
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102ae76
test byte [eax + 0x1c], 2
je 0x102ae76
cmp byte [eax + 0x19], 2
jb 0x102ae76
push edi
push 0x10029d4
push 0x43
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
mov dword [ebp - 0x10], 0xc00d37e9
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x102af75
push 0x7530
push edi
push dword [ebp - 0x14]
call fcn.01029720
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x102aecf
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102aecb
test byte [eax + 0x1c], 2
je 0x102aecb
cmp byte [eax + 0x19], 4
jb 0x102aecb
push 0x10029d4
push 0x44
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
xor edi, edi
jmp 0x102af40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x430
jne 0x102af11
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102af06
test byte [eax + 0x1c], 2
je 0x102af06
cmp byte [eax + 0x19], 4
jb 0x102af06
push 0x10029d4
push 0x45
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
xor edi, edi
mov dword [ebp - 0x10], 0x400d377b
jmp 0x102af40
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102af39
test byte [eax + 0x1c], 2
je 0x102af39
cmp byte [eax + 0x19], 2
jb 0x102af39
push edi
push 0x10029d4
push 0x46
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
mov dword [ebp - 0x10], 0xc00d37ea
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push 0xea60
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push ebx
call fcn.01028795
push dword [ebp - 0x14]
call fcn.0102a913
push dword [ebp - 0x14]
call esi
mov esi, 0x10ed030
xor ebx, ebx
cmp edi, ebx
jne 0x102ad59
mov ecx, dword [ebp - 0x18]
push ebx
push ebx
push dword [ecx + 0x24]
push dword [ebp - 0x10]
push 4
call fcn.0102a5cf
mov ecx, dword [0x10efc9c]
push ebx
push dword [ebp - 0x10]
call fcn.0102d817
jmp 0x102adac