Function at 0x4048b0
Capabilities:
Connect network resource
Delete file
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x42cf34]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x44c], 1
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x434], 0
mov eax, dword [ebp + 8]
push eax
push str._s
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call fcn.00402750
add esp, 0x10
cmp eax, 0xffffffff
jne 0x404949
mov edx, 1
imul eax, edx, 0x103
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0x104
jae 0x404936
jmp 0x40493b
call fcn.0040722d
mov ecx, dword [ebp - 0x420]
mov byte [ebp + ecx - 0x108], 0
push 1
push 0x105
call fcn.0040a6d4
add esp, 8
mov dword [ebp - 0x41c], eax
push 1
push 0x105
call fcn.0040a6d4
add esp, 8
mov dword [ebp - 0x418], eax
push 0x404820
push 2
call fcn.00413ac4
add esp, 8
push 0x404820
push 0xf
call fcn.00413ac4
add esp, 8
push 0x404820
push 0x16
call fcn.00413ac4
add esp, 8
push 0x104
lea edx, [ebp - 0x310]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push eax
push str._sIPC_
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004058a0
add esp, 0xc
lea edx, [ebp - 0x20c]
mov dword [ebp - 0x43c], edx
cmp dword [ebp + 0xc], 0
je 0x404a67
cmp dword [ebp + 0x10], 0
je 0x404a67
lea eax, [ebp - 0x20c]
push eax
push str.___Attempting_to_establish_new_connection_to__s_n
call fcn.00402030
add esp, 8
push 1
push 0
mov ecx, dword [ebp - 0x43c]
push ecx
call sub.MPR.dll_WNetCancelConnection2A
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x450]
push ecx
call sub.MPR.dll_WNetAddConnection2A
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
je 0x404a51
mov edx, dword [ebp - 0x424]
push edx
lea eax, [ebp - 0x20c]
push eax
push str.____Logon_to__s_failed:_error__d_n
call fcn.00402030
add esp, 0xc
jmp 0x404a65
lea ecx, [ebp - 0x20c]
push ecx
push str.___Logon_to__s_succeeded_n
call fcn.00402030
add esp, 8
jmp 0x404a74
push str.____No_username_and_password_supplied_n
call fcn.00402030
add esp, 4
lea edx, [ebp - 0x41c]
push edx
push 0x104
lea eax, [ebp - 0x418]
push eax
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call fcn.00404010
add esp, 0x14
test eax, eax
jne 0x404ab8
lea edx, [ebp - 0x108]
push edx
push str.____Unable_to_find_writable_share_on__s_n
call fcn.00402030
add esp, 8
jmp 0x404e63
mov eax, dword [ebp - 0x41c]
push eax
call fcn.0040a520
add esp, 4
test eax, eax
jbe 0x404ade
mov ecx, dword [ebp - 0x418]
push ecx
call fcn.0040a520
add esp, 4
test eax, eax
ja 0x404af7
lea edx, [ebp - 0x108]
push edx
push str.____Unable_to_find_a_writable_share_on__s_n
call fcn.00402030
add esp, 8
jmp 0x404e63
push 0x42c830
mov eax, dword [ebp - 0x418]
push eax
push 0x42c848
push 0x104
lea ecx, [ebp - 0x414]
push ecx
call fcn.00402750
add esp, 0x14
cmp eax, 0xffffffff
jne 0x404b53
mov edx, 1
imul eax, edx, 0x103
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0x104
jae 0x404b40
jmp 0x404b45
call fcn.0040722d
mov ecx, dword [ebp - 0x428]
mov byte [ebp + ecx - 0x414], 0
push 2
push 0
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ecx, dword [0x42fbbc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
mov dword [ecx + 0xc], eax
mov edx, dword [0x42fbbc]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + edx*4]
cmp dword [ecx + 0xc], 0
jne 0x404ba4
push str.____Failed_to_open_service_control_manager_n
call fcn.00402030
add esp, 4
jmp 0x404ca4
push 0xf01ff
push str.incognita_service
mov edx, dword [0x42fbbc]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + edx*4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ecx, dword [0x42fbbc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
mov dword [ecx + 8], eax
mov edx, dword [0x42fbbc]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + edx*4]
cmp dword [ecx + 8], 0
jne 0x404c0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Failed_to_open_service:__d_n
call fcn.00402030
add esp, 8
jmp 0x404c88
push str.___Stopping_and_deleting_incognita_service_on_remote_host_n
call fcn.00402030
add esp, 4
mov edx, dword [0x42fbbc]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + edx*4]
add ecx, 0x28
push ecx
push 1
mov edx, dword [0x42fbbc]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + edx*4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov eax, dword [0x42fbbc]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ecx, dword [0x42fbbc]
mov edx, dword fs:[0x2c]
mov eax, dword [edx + ecx*4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [0x42fbbc]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + edx*4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x5c
lea eax, [ebp - 0x310]
push eax
call fcn.00408520
add esp, 8
add eax, 1
lea ecx, [ebp - 0x310]
sub eax, ecx
mov edx, 0x103
sub edx, eax
push edx
push 0x42c8ec
push 0x5c
lea eax, [ebp - 0x310]
push eax
call fcn.00408520
add esp, 8
add eax, 1
push eax
call fcn.0040a5b0
add esp, 0xc
mov ecx, 1
imul edx, ecx, 0x103
mov dword [ebp - 0x42c], edx
cmp dword [ebp - 0x42c], 0x104
jae 0x404d09
jmp 0x404d0e
call fcn.0040722d
mov eax, dword [ebp - 0x42c]
mov byte [ebp + eax - 0x310], 0
push 0x103
mov ecx, dword [ebp - 0x41c]
push ecx
mov edx, dword [0x42fbbc]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + edx*4]
add ecx, 0xc0
push ecx
call fcn.0040a5b0
add esp, 0xc
mov edx, 1
imul eax, edx, 0x103
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0x104
jae 0x404d65
jmp 0x404d6a
call fcn.0040722d
mov ecx, dword [0x42fbbc]
mov edx, dword fs:[0x2c]
mov eax, dword [edx + ecx*4]
mov ecx, dword [ebp - 0x430]
mov byte [eax + ecx + 0xc0], 0
mov edx, dword [0x42fbbc]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + edx*4]
add ecx, 0xc0
push ecx
call fcn.0040a520
add esp, 4
mov edx, 0x104
sub edx, eax
push edx
push str.incognita_service.exe
mov eax, dword [0x42fbbc]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
add edx, 0xc0
push edx
call fcn.00413090
add esp, 0xc
mov eax, dword [0x42fbbc]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
add edx, 0xc0
push edx
push str.___Deleting_service_EXE__s_n
call fcn.00402030
add esp, 8
mov eax, dword [0x42fbbc]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
add edx, 0xc0
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x404e39
mov eax, dword [0x42fbbc]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
add edx, 0xc0
push edx
push str.___Successfully_deleted__s_n
call fcn.00402030
add esp, 8
jmp 0x404e63
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x42fbbc]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
add edx, 0xc0
push edx
push str.____Couldnt_delete__s:__d_n
call fcn.00402030
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004070d2
mov esp, ebp
pop ebp
ret