Function at 0x4b6066
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a1668
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x694240]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push esi
push edi
mov eax, dword [0x694240]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov dword [esp + 0x10], ecx
lea eax, [esp + 0x48]
xor ebx, ebx
push eax
mov edi, ebx
call fcn.004b650f
mov esi, eax
mov dword [esp + 0xa0], ebx
lea ecx, [esp + 0x30]
push 0x60a15c
call fcn.00479014
mov byte [esp + 0xa0], 1
mov edx, 0x60bf30
push eax
lea ecx, [esp + 0x1c]
call fcn.0048177b
mov byte [esp + 0xa4], 2
mov edx, eax
lea ecx, [esp + 0x64]
mov dword [esp], str.DPLAS8XFQ16FKTNG5RTICQC5HSENNX
call fcn.004817bf
mov byte [esp + 0xa4], 3
mov edx, eax
push ecx
push esi
call fcn.004ae7d0
add esp, 0xc
mov byte [esp + 0xa0], 2
push ebx
push 1
lea ecx, [esp + 0x68]
call fcn.0047997f
mov byte [esp + 0xa0], 1
lea ecx, [esp + 0x18]
push ebx
push 1
call fcn.0047997f
mov byte [esp + 0xa0], bl
lea ecx, [esp + 0x30]
push ebx
push 1
call fcn.0047997f
or dword [esp + 0xa0], 0xffffffff
lea ecx, [esp + 0x48]
push ebx
push 1
call fcn.0047997f
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x4b6185
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4b64eb
lea eax, [esp + 0x60]
push eax
call fcn.004b65bb
mov esi, eax
mov dword [esp + 0xa0], 4
lea ecx, [esp + 0x18]
push 0x60a3c4
call fcn.00479014
mov byte [esp + 0xa0], 5
mov edx, 0x60bfe8
push eax
lea ecx, [esp + 0x34]
call fcn.0048177b
mov byte [esp + 0xa4], 6
mov edx, eax
lea ecx, [esp + 0x4c]
mov dword [esp], str.WPID1D6RM605GGX45EIJAJMNL6WSPK
call fcn.004817bf
mov byte [esp + 0xa4], 7
mov edx, eax
push ecx
push esi
call fcn.004ae7d0
add esp, 0xc
mov byte [esp + 0xa0], 6
xor esi, esi
lea ecx, [esp + 0x48]
push esi
push 1
call fcn.0047997f
mov byte [esp + 0xa0], 5
lea ecx, [esp + 0x30]
push esi
push 1
call fcn.0047997f
mov byte [esp + 0xa0], 4
lea ecx, [esp + 0x18]
push esi
push 1
call fcn.0047997f
or dword [esp + 0xa0], 0xffffffff
lea ecx, [esp + 0x60]
push esi
push 1
call fcn.0047997f
push 0xf01ff
push dword [esp + 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x4b6264
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x4b63fb
lea eax, [esp + 0x60]
push eax
call fcn.004b6694
mov esi, eax
mov dword [esp + 0xa0], 8
lea ecx, [esp + 0x18]
push 0x60a2d4
call fcn.00479014
mov byte [esp + 0xa0], 9
mov edx, 0x60c160
push eax
lea ecx, [esp + 0x34]
call fcn.0048177b
mov byte [esp + 0xa4], 0xa
mov edx, eax
lea ecx, [esp + 0x4c]
mov dword [esp], 0x60a3a4
call fcn.004817bf
mov byte [esp + 0xa4], 0xb
mov edx, eax
push ecx
push esi
call fcn.004ae7d0
add esp, 0xc
mov byte [esp + 0xa0], 0xa
xor esi, esi
lea ecx, [esp + 0x48]
push esi
push 1
call fcn.0047997f
mov byte [esp + 0xa0], 9
lea ecx, [esp + 0x30]
push esi
push 1
call fcn.0047997f
mov byte [esp + 0xa0], 8
lea ecx, [esp + 0x18]
push esi
push 1
call fcn.0047997f
or dword [esp + 0xa0], 0xffffffff
lea ecx, [esp + 0x60]
push esi
push 1
call fcn.0047997f
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4b6338
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x4b63f4
lea eax, [esp + 0x60]
push eax
call fcn.004b6766
mov esi, eax
mov dword [esp + 0xa0], 0xc
lea ecx, [esp + 0x18]
push 0x60a42c
call fcn.00479014
mov byte [esp + 0xa0], 0xd
mov edx, 0x60c0a0
push eax
lea ecx, [esp + 0x34]
call fcn.0048177b
mov byte [esp + 0xa4], 0xe
mov edx, eax
lea ecx, [esp + 0x4c]
mov dword [esp], str.1H1IDJ5MWWJO00EEBCSNWKOGF6RKB1
call fcn.004817bf
mov byte [esp + 0xa4], 0xf
mov edx, eax
push ecx
push esi
call fcn.004ae7d0
add esp, 0xc
mov byte [esp + 0xa0], 0xe
xor esi, esi
lea ecx, [esp + 0x48]
push esi
push 1
call fcn.0047997f
mov byte [esp + 0xa0], 0xd
lea ecx, [esp + 0x30]
push esi
push 1
call fcn.0047997f
mov byte [esp + 0xa0], 0xc
lea ecx, [esp + 0x18]
push esi
push 1
call fcn.0047997f
or dword [esp + 0xa0], 0xffffffff
lea ecx, [esp + 0x60]
push esi
push 1
call fcn.0047997f
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [esp + 0x78]
push eax
call fcn.004b6836
mov dword [esp + 0xa0], 0x10
mov edx, edi
push eax
lea ecx, [esp + 0x64]
call fcn.004b354a
mov esi, eax
mov byte [esp + 0xa4], 0x11
lea ecx, [esp + 0x1c]
mov dword [esp], 0x60a63c
call fcn.00479014
mov byte [esp + 0xa0], 0x12
mov edx, str.YE0EFFI963YBISPS82KJ7EBWQZRRUBRZPSWMMN4WVQI4POVGX7EWXQDDPSHVAZMBBQWOE6H6227OOSAPVMYESYJLN2OODWASKVJ90D8J8KLFP2LE1REDELM1S3RRME8O88PC2OJ84N35IW4XBR9S1IIX
push eax
lea ecx, [esp + 0x34]
call fcn.0048177b
mov byte [esp + 0xa4], 0x13
mov edx, eax
lea ecx, [esp + 0x4c]
mov dword [esp], str.VLE4CTMDEOTYVJ1ADS547U1X6SOCI4
call fcn.004817bf
mov byte [esp + 0xa4], 0x14
mov edx, eax
push ecx
push esi
call fcn.004ae7d0
add esp, 0xc
mov byte [esp + 0xa0], 0x13
xor ebx, ebx
lea ecx, [esp + 0x48]
xor esi, esi
push ebx
inc esi
push esi
call fcn.0047997f
mov byte [esp + 0xa0], 0x12
lea ecx, [esp + 0x30]
push ebx
push esi
call fcn.0047997f
mov byte [esp + 0xa0], 0x11
lea ecx, [esp + 0x18]
push ebx
push esi
call fcn.0047997f
mov byte [esp + 0xa0], 0x10
lea ecx, [esp + 0x60]
push ebx
push esi
call fcn.0047997f
or dword [esp + 0xa0], 0xffffffff
lea ecx, [esp + 0x78]
push ebx
push esi
call fcn.0047997f
mov eax, edi
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.005712ac
mov esp, ebp
pop ebp
ret