Function at 0x1400090a0
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x30
mov r8, qword [rdx + 0x10]
lea r9, str.Deleting_a_service_can_prevent_the_system_from_starting_or_functioning_properly.
mov rbp, rdx
mov byte [rsp + 0x20], 1
lea rdx, [0x1401b9538]
mov rdi, rcx
mov r8, qword [r8 + 8]
call sym.ProcessHacker.exe_PhShowConfirmMessage
test al, al
jne 0x1400090df
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbp + 0x10]
mov edx, 0x10000
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhOpenService
mov rsi, rax
test rax, rax
je 0x14000912b
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rsi
test eax, eax
je 0x140009125
mov bl, 1
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop dword [rax]
jmp 0x1400093c7
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140009140
movzx ebx, ax
or ebx, 0xc0070000
mov rax, qword [rbp + 0x10]
lea rcx, str.Unable_to_delete
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhConcatStrings2
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x48]
mov r8d, ebx
mov rcx, rdi
mov rdx, qword [rax + 8]
call fcn.1400018e0
test al, al
je 0x1400092d5
xor bl, bl
cmp byte [rsp + 0x48], bl
je 0x1400093c7
mov rcx, qword [rbp + 0x10]
mov edx, 5
mov rcx, qword [rcx + 8]
call fcn.14007ace0
mov ebx, eax
test eax, eax
js 0x1400091b0
mov bl, 1
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x1400093c7
mov r8, qword [rbp + 0x10]
lea rdx, [0x1401b9538]
lea rcx, str.Unable_to__s__s.
mov r8, qword [r8 + 8]
call fcn.140001720
mov rsi, qword [rax + 8]
cmp ebx, 0xc0000022
je 0x1400091f2
cmp ebx, 0xc0000005
je 0x1400091f2
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x140009204
movzx eax, bx
jmp 0x1400091fd
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax]
test eax, eax
jne 0x140009210
lfence
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x14000921a
lfence
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x140009291
lfence
lfence
lea r8, [0x1401b8d58]
test rsi, rsi
je 0x14000925a
mov rax, qword [rax + 8]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov edx, 0x20
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.ProcessHacker.exe_PhShowMessage2
jmp 0x140009268
mov r9, qword [rbx + 8]
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400092c9
lfence
call fcn.1400fbcc0
xor bl, bl
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x1400093c7
mov edx, 0x10
test rsi, rsi
je 0x1400092b6
mov r9, rsi
lea r8, [0x1401efb68]
call sym.ProcessHacker.exe_PhShowMessage
xor bl, bl
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x1400093c7
lea r9, str.Unable_to_perform_the_operation.
lea r8, [0x1401b8d58]
call sym.ProcessHacker.exe_PhShowMessage
xor bl, bl
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
jmp 0x1400093c7
mov r8, qword [rbp + 0x10]
lea rdx, [0x1401b9538]
lea rcx, str.Unable_to__s__s.
mov r8, qword [r8 + 8]
call fcn.140001720
mov rsi, qword [rax + 8]
cmp ebx, 0xc0000022
je 0x14000931b
nop dword [rax]
cmp ebx, 0xc0000005
je 0x14000931b
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14000932a
movzx eax, bx
jmp 0x140009326
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x140009333
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x14000933a
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x140009398
mov r9, qword [rax + 8]
lea r8, [0x1401b8d58]
test rsi, rsi
je 0x140009374
mov qword [rsp + 0x28], r9
mov edx, 0x20
mov qword [rsp + 0x20], r8
mov r9, rsi
mov r8d, 0xfffe
call sym.ProcessHacker.exe_PhShowMessage2
jmp 0x14000937e
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400093c5
call fcn.1400fbcc0
jmp 0x1400093c5
mov edx, 0x10
test rsi, rsi
je 0x1400093b1
mov r9, rsi
lea r8, [0x1401efb68]
jmp 0x1400093bf
lea r9, str.Unable_to_perform_the_operation.
lea r8, [0x1401b8d58]
nop
call sym.ProcessHacker.exe_PhShowMessage
xor bl, bl
mov rsi, qword [rsp + 0x50]
movzx eax, bl
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret