Function at 0x41c575
Capabilities:
Delete file
Delete service
Query service status
Stop service

Disassembly:
push 0x5c
mov eax, 0x67b9db
call fcn.00620b88
mov edi, ecx
mov ebx, 0xf003f
xor esi, esi
push ebx
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x40], eax
test eax, eax
je 0x41c745
push ebx
push dword [edi + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x41c5d0
call edi
cmp eax, 0x424
je 0x41c5d0
push str.Could_not_open_driver
call fcn.0041d0cb
push eax
call edi
jmp 0x41c756
call edi
cmp eax, 0x424
je 0x41c73f
push 0x6a00a0
lea ecx, [ebp - 0x34]
call fcn.00411430
lea eax, [ebp - 0x30]
mov dword [ebp - 4], esi
push eax
push esi
push esi
push ebx
mov dword [ebp - 0x30], esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x41c64d
push dword [ebp - 0x30]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x38], eax
push ecx
push dword [ebp - 0x30]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x41c644
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x41c63a
push eax
call fcn.00630f92
mov esi, eax
mov eax, dword [ebp - 0x3c]
pop ecx
push esi
push eax
lea ecx, [ebp - 0x34]
call fcn.0041669f
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x2c]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x41c67f
call edi
cmp eax, 0x426
je 0x41c67f
call edi
cmp eax, 5
je 0x41c67f
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push str.Could_not_open_stop_driver
jmp 0x41c5c3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [ebp - 0x28], 3
mov eax, 0x2710
add esi, eax
mov edi, eax
lea eax, [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x41c6d9
mov eax, dword [ebp - 0x14]
xor edx, edx
push 0xa
pop ecx
div ecx
mov ecx, 0x3e8
cmp eax, ecx
jae 0x41c6bd
mov eax, ecx
jmp 0x41c6c2
cmp eax, edi
cmova eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, esi
jae 0x41c6d9
cmp dword [ebp - 0x28], 3
je 0x41c697
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41c70a
push str.Could_not_open_delete_driver
call fcn.0041d0cb
push eax
call edi
push eax
lea ecx, [ebp - 0x68]
call fcn.0041b447
push 0x70a820
lea eax, [ebp - 0x68]
jmp 0x41c767
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
push dword [ebp - 0x40]
call esi
push 0x6a00a0
push dword [ebp - 0x34]
call fcn.00642be9
pop ecx
pop ecx
test eax, eax
je 0x41c734
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x34]
lea ecx, [ecx - 0x10]
call fcn.00416499
call fcn.00620b37
ret
push str.Could_not_open_Service_Manager
call fcn.0041d0cb
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x54]
call fcn.0041b447
push 0x70a820
lea eax, [ebp - 0x54]
push eax
call fcn.00625363
int3