Function at 0x406290
Capabilities:
Delete service
Write file on windows

Disassembly:
push ecx
push ebx
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
mov dword [esp + 8], ebx
jne 0x4062fe
mov eax, dword [0x41e04c]
test eax, eax
je 0x4062f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeleteUSBServices____Open_OpenSCManager_failed___d__r_n
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov eax, dword [0x41e04c]
push ebx
not ecx
dec ecx
push 0x41e048
push ecx
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
mov eax, 0x80004005
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x10]
push ebp
cmp eax, 1
push esi
jne 0x40649a
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebp, 0x418fec
mov eax, dword [ebp]
test eax, eax
je 0x406627
push eax
call fcn.00407d62
add esp, 4
test eax, eax
je 0x40648e
mov eax, dword [0x41e04c]
test eax, eax
je 0x406378
mov ecx, dword [ebp]
push ecx
push str.DeleteNokiaUSBServices___ls
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [0x41e04c]
push 0
not ecx
dec ecx
push 0x41e048
push ecx
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push edx
call esi
mov eax, dword [ebp]
push 0x10000
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x4063e4
mov eax, dword [0x41e04c]
test eax, eax
je 0x40648e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.___open_failed___d__r_n
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
push ebx
dec ecx
push 0x41e048
push ecx
mov ecx, dword [0x41e04c]
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push ecx
call esi
mov ebx, dword [esp + 0x10]
add ebp, 4
jmp 0x406318
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
mov eax, dword [0x41e04c]
jne 0x40644d
test eax, eax
je 0x406487
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.___delete_failed___d__r_n
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [0x41e04c]
push 0
not ecx
dec ecx
push 0x41e048
push ecx
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push edx
call esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [esp + 0x10]
add ebp, 4
jmp 0x406318
test eax, eax
je 0x406487
push str.___OK_r_n
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov eax, dword [0x41e04c]
push 0
not ecx
dec ecx
push 0x41e048
push ecx
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push eax
call esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [esp + 0x10]
add ebp, 4
jmp 0x406318
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebp, 0x418fd8
mov eax, dword [ebp]
test eax, eax
je 0x406627
push eax
call fcn.00407d62
add esp, 4
test eax, eax
je 0x40661b
mov eax, dword [0x41e04c]
test eax, eax
je 0x406505
mov ecx, dword [ebp]
push ecx
push str.DeleteNokiaUSBServices___ls
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [0x41e04c]
push 0
not ecx
dec ecx
push 0x41e048
push ecx
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push edx
call esi
mov eax, dword [ebp]
push 0x10000
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x406571
mov eax, dword [0x41e04c]
test eax, eax
je 0x40661b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.___open_failed___d__r_n
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
push ebx
dec ecx
push 0x41e048
push ecx
mov ecx, dword [0x41e04c]
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push ecx
call esi
mov ebx, dword [esp + 0x10]
add ebp, 4
jmp 0x4064a5
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
mov eax, dword [0x41e04c]
jne 0x4065da
test eax, eax
je 0x406614
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.___delete_failed___d__r_n
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [0x41e04c]
push 0
not ecx
dec ecx
push 0x41e048
push ecx
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push edx
call esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [esp + 0x10]
add ebp, 4
jmp 0x4064a5
test eax, eax
je 0x406614
push str.___OK_r_n
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
call fcn.0040762a
mov edi, str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov eax, dword [0x41e04c]
push 0
not ecx
dec ecx
push 0x41e048
push ecx
push str.Key__43EA7BB31D4DD114FAF09271F90BD965_open_failed_r_n
push eax
call esi
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [esp + 0x10]
add ebp, 4
jmp 0x4064a5
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
pop ecx
ret