Function at 0x41a530
Capabilities:
Delete file
Delete service
Get common file path
Manipulate safe mode programs
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa74
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00428450
add esp, 0xc
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x41a5bb
push 0xf01ff
push str.wm7f
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x41a5b8
lea edx, [ebp - 0xa4c]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call ebx
push edi
call ebx
push 0x44818c
call fcn.00406870
add esp, 4
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x61e]
push ecx
mov word [ebp - 0x620], ax
call fcn.00428450
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x416]
push eax
mov word [ebp - 0x418], dx
call fcn.00428450
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edi, [ebp - 0x418]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x41a620
mov ecx, 9
mov esi, str.System32drivers
lea edx, [ebp - 0x620]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push str._c_takeown__f_wm7f.sys
push edx
call esi
push 0xa
push str.cmd.exe
lea edx, [ebp - 0x418]
lea ecx, [ebp - 0x620]
call fcn.00419340
lea eax, [ebp - 0x620]
push str._c_icacls.exe_wm7f.sys__grant:r_Administrators:F__t
push eax
call esi
push 0xa
push str.cmd.exe
lea edx, [ebp - 0x418]
lea ecx, [ebp - 0x620]
call fcn.00419340
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x210]
push str._swm7f.sys
push ecx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x2c
lea edx, [ebp - 0x210]
push edx
call ebx
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x210]
push str._swm7f.inf
push ecx
call esi
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
call ebx
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x210]
push str._swm7f.cat
push ecx
call esi
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
call ebx
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41a762
lea ecx, [ebp - 0xa74]
push ecx
call eax
movzx eax, word [ebp - 0xa74]
test eax, eax
je 0x41a893
cmp eax, 9
jne 0x41a893
push str.Kernel32.dll
mov dword [ebp - 0xa50], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x41a893
push str.Wow64DisableWow64FsRedirection
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [ebp - 0xa50]
push edx
call eax
push edi
test eax, eax
je 0x41a88d
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x210]
push str._swm7f.sys
push ecx
call esi
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
call ebx
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x210]
push str._swm7f.inf
push ecx
call esi
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
call ebx
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x210]
push str._swm7f.cat
push ecx
call esi
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
call ebx
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x41a893
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x4482a0
call fcn.00406870
add esp, 4
xor eax, eax
push 0x40e
push eax
lea ecx, [ebp - 0xa2e]
push ecx
mov word [ebp - 0xa30], ax
call fcn.00428450
add esp, 0xc
mov edx, str.SYSTEMCurrentControlSetControlSafeBootMinimalwm7f.sys
lea ecx, [ebp - 0xa30]
call fcn.004075e0
push 0
lea edx, [ebp - 0xa30]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00408b80
add esp, 0xc
xor eax, eax
push 0x40e
push eax
lea ecx, [ebp - 0xa2e]
push ecx
mov word [ebp - 0xa30], ax
call fcn.00428450
add esp, 0xc
mov edx, str.SYSTEMCurrentControlSetControlSafeBootNetworkwm7f.sys
lea ecx, [ebp - 0xa30]
call fcn.004075e0
push 0
lea edx, [ebp - 0xa30]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00408b80
add esp, 0xc
push 0x4483a0
call fcn.00406870
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004217a4
mov esp, ebp
pop ebp
ret