Function at 0x4066d0
Capabilities:
Delete file
Delete service
Get session user name
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbe4
mov eax, dword [0x445040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1f4
lea eax, [ebp - 0x450]
mov dword [ebp - 0xb94], pe_nt_image_headers32
push 0
push eax
call fcn.00415480
add esp, 0xc
lea eax, [ebp - 0xb94]
push eax
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x550]
push eax
lea eax, [ebp - 0x450]
push str.HW_s
push eax
call fcn.004012e0
push 0x1f4
lea eax, [ebp - 0x744]
push 0
push eax
call fcn.00415480
lea eax, [ebp - 0x744]
push 0x1f4
push eax
call fcn.0041e8fc
push 0x1f4
lea eax, [ebp - 0x938]
push 0
push eax
call fcn.00415480
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x744]
push eax
lea eax, [ebp - 0x938]
push str._s_s.sys
push eax
call fcn.004012e0
add esp, 0x3c
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
mov dword [ebp - 0xbe4], esi
test esi, esi
je 0x40688b
push ebx
push 0xf01ff
lea eax, [ebp - 0x450]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
je 0x40688a
lea eax, [ebp - 0xb98]
push eax
push 0x24
lea eax, [ebp - 0xbe0]
push eax
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x406925
mov eax, dword [ebp - 0xbdc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, 1
je 0x406834
cmp eax, 3
je 0x406834
mov edx, ebx
mov ecx, esi
call fcn.004064f0
lea eax, [ebp - 0xbbc]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40689a
cmp dword [ebp - 0xbb8], 1
je 0x406834
push 0x3e8
call edi
cmp dword [ebp - 0xbb8], 1
jne 0x406824
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push 0x3e8
mov esi, eax
call edi
test esi, esi
jne 0x4068be
push 0x258
lea eax, [ebp - 0x25c]
push esi
push eax
call fcn.00415480
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4409b0
lea eax, [ebp - 0x25c]
push eax
call fcn.00401230
lea eax, [ebp - 0x25c]
push eax
push str._ls_n
call fcn.00401200
add esp, 0x14
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413732
mov esp, ebp
pop ebp
ret
push 0x258
lea eax, [ebp - 0x25c]
push 0
push eax
call fcn.00415480
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4408b0
jmp 0x406869
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
push dword [ebp - 0xbe4]
call esi
lea eax, [ebp - 0x938]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x258
lea eax, [ebp - 0xb90]
push 0
push eax
call fcn.00415480
lea eax, [ebp - 0xb90]
push 0x440a08
push eax
call fcn.00401230
lea eax, [ebp - 0xb90]
push eax
push str._ls_n
call fcn.00401200
add esp, 0x1c
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413732
mov esp, ebp
pop ebp
ret
push 0x258
lea eax, [ebp - 0x25c]
push 0
push eax
call fcn.00415480
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x25c]
push 0x440940
push eax
call fcn.00401230
lea eax, [ebp - 0x25c]
push eax
push str._ls_n
call fcn.00401200
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop ebx
pop esi
call fcn.00413732
mov esp, ebp
pop ebp
ret