Function at 0x100461b
Capabilities:
Delete service
Enumerate services
Query service status
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x106c
call fcn.01005b50
mov eax, dword [0x1011660]
push esi
push edi
push 4
xor esi, esi
push esi
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x100c], edi
jne 0x100465c
push 0x1002060
call fcn.010036a7
pop ecx
jmp 0x1004923
push ebx
push esi
push esi
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x1008]
push eax
push 0x2c
lea eax, [ebp - 0x106c]
push eax
push 3
push 0x30
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
push edi
call esi
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x10046b0
call ebx
cmp eax, 0xea
je 0x10046b0
push 0x1002028
call fcn.010036a7
pop ecx
call ebx
push eax
call fcn.0100378f
push edi
jmp 0x100491c
mov eax, dword [ebp - 0x1008]
push 0x2c
pop ecx
xor edx, edx
div ecx
mov edi, eax
imul edi, edi, 0x58
push edi
call fcn.0100598c
pop ecx
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0x101c], eax
jne 0x10046f9
mov eax, dword [ebp - 0x1008]
imul eax, eax, 0x58
push eax
push 0x1001fb0
mov dword [0x1012208], 1
call fcn.010036a7
pop ecx
jmp 0x1004915
push ecx
push ecx
lea edx, [ebp - 0x1010]
push edx
lea edx, [ebp - 0x1008]
push edx
push edi
push eax
push 3
push 0x30
push ecx
push dword [ebp - 0x100c]
call esi
test eax, eax
jne 0x100473d
push dword [ebp - 0x1008]
push edi
push 0x1001f40
call fcn.010036a7
add esp, 0xc
call ebx
push eax
call fcn.0100378f
jmp 0x1004916
push dword [ebp - 0x1010]
push 0x1001f0c
call fcn.010036a7
and dword [ebp - 0x1014], 0
cmp dword [ebp - 0x1010], 0
pop ecx
pop ecx
jbe 0x100490a
mov edi, dword [ebp - 0x101c]
push 0x100a5
push dword [edi]
push dword [ebp - 0x100c]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
mov dword [ebp - 0x1018], esi
je 0x10048ef
lea eax, [ebp - 0x1008]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x10047bb
push 4
push dword [ebp - 0x1008]
push dword [edi]
push 0x1001e98
jmp 0x10047e7
lea eax, [ebp - 0x1008]
push eax
push 0x24
lea eax, [ebp - 0x1040]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x10047fd
push 0x24
push dword [ebp - 0x1008]
push dword [edi]
push 0x1001e20
call fcn.010036a7
add esp, 0x10
call ebx
push eax
call fcn.0100378f
push esi
jmp 0x10048e9
mov esi, dword [ebp - 0xff8]
call fcn.010045ae
push dword [ebp - 0xff8]
call fcn.01004109
cmp eax, 0xfffffc17
jne 0x10048e3
push dword [ebp - 0x1018]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
push dword [ebp - 0xff8]
jne 0x100484a
push 0x1001de0
call fcn.010036a7
pop ecx
pop ecx
call ebx
push eax
call fcn.0100378f
jmp 0x1004859
push dword [edi]
push 0x1001dac
call fcn.010036a7
add esp, 0xc
push dword [ebp - 0x1024]
push 0
push 0x100411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10048e3
cmp dword [ebp - 0x103c], 4
jne 0x10048e3
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
push dword [ebp - 0xff8]
jne 0x10048a4
push 0x1001d60
call fcn.010036a7
pop ecx
pop ecx
call ebx
push eax
call fcn.0100378f
jmp 0x10048e3
push 0x1001d00
call fcn.010036a7
pop ecx
pop ecx
push 0x7530
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10048cd
push dword [ebp - 0xff8]
push 0x1001ca0
jmp 0x1004893
mov eax, dword [0x10121f8]
push 3
cdq
pop ecx
idiv ecx
mov dword [edx*4 + 0x10121ec], 1
push dword [ebp - 0x1018]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
inc dword [ebp - 0x1014]
mov eax, dword [ebp - 0x1014]
add edi, 0x2c
cmp eax, dword [ebp - 0x1010]
jb 0x1004769
push dword [ebp - 0x101c]
call fcn.0100582a
pop ecx
push dword [ebp - 0x100c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0100524b
leave
ret