Function at 0x10292cc
Capabilities:
Delete service

Disassembly:
push 0x10
mov eax, 0x10a458d
call fcn.0107a6db
mov edi, ecx
mov dword [ebp - 0x18], edi
mov eax, dword [0x10b30cc]
mov esi, 0x10b30cc
cmp eax, esi
je 0x1029303
test byte [eax + 0x1c], 1
je 0x1029303
push 0x10022a4
push 0x3e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
push 0xf003f
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 0x10], 0x400d377a
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov dword [ebp - 0x14], eax
jne 0x10293fd
call dword [fcn.010011dc]
mov edi, eax
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x1029354
test byte [eax + 0x1c], 2
je 0x1029354
cmp byte [eax + 0x19], 2
jb 0x1029354
push edi
push 0x10022a4
push 0x3f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028164
cmp edi, 5
jne 0x10293f1
mov dword [ebp - 0x10], 0xc00d37e7
push 0x10b7af8
lea ecx, [ebp - 0x14]
call fcn.0104078f
push edi
lea eax, [ebp - 0x14]
push 0x10022c4
push eax
mov dword [ebp - 4], ebx
call fcn.010292b1
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
add esp, 0xc
push ebx
push esi
push dword [ecx + 0x20]
push dword [ebp - 0x10]
push 1
call fcn.01028c8b
push edi
push dword [ebp - 0x10]
push 0
call fcn.0103f789
lea ecx, [esi - 0x10]
call fcn.01026e74
mov esi, 0x10b30cc
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x10293e9
test byte [eax + 0x1c], 1
je 0x10293e9
movzx ecx, byte [eax + 0x19]
mov edx, edi
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x10293e9
push edi
push 0x10022a4
push 0x45
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028164
mov eax, edi
call fcn.0107a7c7
ret
mov dword [ebp - 0x10], 0xc00d37e8
jmp 0x102957e
lea ebx, [edi + 0x20]
mov eax, dword [ebx]
push 0x10024
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
mov dword [ebp - 0x1c], edi
jne 0x1029492
call dword [fcn.010011dc]
mov edi, eax
cmp edi, 0x424
jne 0x1029455
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x1029451
test byte [eax + 0x1c], 2
je 0x1029451
cmp byte [eax + 0x19], 4
jb 0x1029451
push 0x10022a4
push 0x40
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
xor edi, edi
jmp 0x1029484
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x102947d
test byte [eax + 0x1c], 2
je 0x102947d
cmp byte [eax + 0x19], 2
jb 0x102947d
push edi
push 0x10022a4
push 0x41
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028164
mov dword [ebp - 0x10], 0xc00d37e9
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x102957c
push 0x7530
push edi
push dword [ebp - 0x14]
call fcn.010283fe
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x10294d6
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x10294d2
test byte [eax + 0x1c], 2
je 0x10294d2
cmp byte [eax + 0x19], 4
jb 0x10294d2
push 0x10022a4
push 0x42
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
xor edi, edi
jmp 0x1029547
call dword [fcn.010011dc]
mov edi, eax
cmp edi, 0x430
jne 0x1029518
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x102950d
test byte [eax + 0x1c], 2
je 0x102950d
cmp byte [eax + 0x19], 4
jb 0x102950d
push 0x10022a4
push 0x43
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01026c05
xor edi, edi
mov dword [ebp - 0x10], 0x400d377b
jmp 0x1029547
mov eax, dword [0x10b30cc]
cmp eax, esi
je 0x1029540
test byte [eax + 0x1c], 2
je 0x1029540
cmp byte [eax + 0x19], 2
jb 0x1029540
push edi
push 0x10022a4
push 0x44
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01028164
mov dword [ebp - 0x10], 0xc00d37ea
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push 0xea60
call dword [fcn.010011d8]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push ebx
call fcn.01027546
push dword [ebp - 0x14]
call fcn.01028f67
push dword [ebp - 0x14]
call esi
mov esi, 0x10b30cc
xor ebx, ebx
cmp edi, ebx
jne 0x1029364
mov ecx, dword [ebp - 0x18]
push ebx
push ebx
push dword [ecx + 0x20]
push dword [ebp - 0x10]
push 4
call fcn.01028c8b
push ebx
push dword [ebp - 0x10]
push ebx
call fcn.0103f789
jmp 0x10293b3