Function at 0x405e90
Capabilities:
Create process on windows
Delete file
Delete service
Get common file path
Manipulate safe mode programs
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.______Remove_Process_Driver_.
call fcn.004033d0
add esp, 4
push 0x206
xor ebx, ebx
lea ecx, [ebp - 0x20e]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x210], ax
call fcn.00414930
add esp, 0xc
push 0x206
lea eax, [ebp - 0x416]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x418], dx
call fcn.00414930
add esp, 0xc
push ebx
push str.C:Program_Filesww2017cfwmcUser7.exe
call fcn.0040e72e
add esp, 8
test eax, eax
jne 0x405f72
lea ecx, [ebp - 0x64c]
push ecx
mov dword [ebp - 0x64c], 0x3c
mov dword [ebp - 0x648], 0x40
mov dword [ebp - 0x644], ebx
mov dword [ebp - 0x640], ebx
mov dword [ebp - 0x63c], 0x41a750
mov dword [ebp - 0x638], str.__processstop
mov dword [ebp - 0x634], str.C:Program_Filesww2017cf
mov dword [ebp - 0x630], ebx
mov dword [ebp - 0x62c], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0x41de2c
call fcn.004033d0
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x670], esi
cmp esi, ebx
je 0x4060be
push 0xf01ff
push str.cbfsprocess2017
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, ebx
je 0x4060a8
push 0x1f2
lea eax, [ebp - 0x60e]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x610], dx
call fcn.00414930
add esp, 0xc
lea ecx, [ebp - 0x668]
push ecx
push 1
push edi
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea ecx, [ecx]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x62c]
push edx
push edi
call ebx
cmp dword [ebp - 0x628], 1
je 0x40602b
inc esi
push esi
lea eax, [ebp - 0x610]
push 0x41de68
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x610]
add esp, 0xc
push ecx
call fcn.004033d0
add esp, 4
cmp esi, 0xa
je 0x406085
jle 0x405fe0
push 0x41dec0
call fcn.004033d0
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push 0x41df20
call fcn.004033d0
add esp, 4
push str.C:Program_Filesww2017cfCBFSProcess.cab
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x41dfd0
call fcn.004033d0
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x670]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4060cb
push 0x41e030
call fcn.004033d0
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x670]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4060cb
push str._t_tDelete_Proc_Driver__OpenService_Fail__Maybe_not_exist.
call fcn.004033d0
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4060cb
push 0x41e104
call fcn.004033d0
add esp, 4
push 0x41e138
call fcn.004033d0
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
add esp, 4
mov ecx, 0x82
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x210]
push eax
call ebx
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x406110
mov ecx, 0x13
mov esi, str.System32driverscbfsprocess2017.sys
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
je 0x40615b
lea edx, [ebp - 0x634]
push edx
call eax
movzx eax, word [ebp - 0x634]
test eax, eax
je 0x4061c5
cmp eax, 9
je 0x406174
cmp byte [ebp - 0x669], 1
jne 0x4061c5
push str._t_tDelete_Proc_Driver__is_64bit__DisableFsRedirection.
call fcn.004033d0
add esp, 4
push str.Kernel32.dll
mov dword [ebp - 0x670], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4061b8
push str.Wow64DisableWow64FsRedirection
push esi
call edi
lea ecx, [ebp - 0x670]
push ecx
call eax
push esi
test eax, eax
jne 0x40622e
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str._t_tDelete_Proc_Driver__is_64bit__DisableFsRedirection_FALSE.
call fcn.004033d0
add esp, 4
push str._t_t_t_Terminate_Process_Driver_
call fcn.004033d0
add esp, 4
mov esi, str.SYSTEMCurrentControlSetServicescbfsprocess2017
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SYSTEMCurrentControlSetControlSafeBootMinimalcbfsprocess2017.sys
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SYSTEMCurrentControlSetControlSafeBootMinimalcbfsprocess2017
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SYSTEMCurrentControlSetControlSafeBootNetworkcbfsprocess2017.sys
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SYSTEMCurrentControlSetControlSafeBootNetworkcbfsprocess2017
mov ecx, 0x80000002
call fcn.0040a170
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x418]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x418]
push eax
call ebx
xor eax, eax
jmp 0x406280
movzx ecx, word [ebp + eax - 0x418]
mov word [ebp + eax - 0x210], cx
add eax, 2
test cx, cx
jne 0x406280
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4062a1
mov ecx, 0x13
mov esi, str.System32driverscbfsprocess2017.sys
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4062ee
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str._t_tDelete_Proc_Driver__is_64bit__RevertFsRedirection.
jmp 0x4061bd