Function at 0x410df0
Capabilities:
Check os version
Delete file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43a57d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x558
push esi
mov dword [ebp - 0x1c], 0
cmp dword [0x459a18], 0
push edi
mov dword [ebp - 0x24], ecx
jne 0x410e79
mov esi, dword fs:[0x30]
test esi, esi
je 0x410e79
mov edx, dword [esi + 0xa8]
mov ecx, dword [esi + 0xa4]
cmp edx, 0xa
jb 0x410e62
mov eax, 0xcccccccd
mul edx
shr edx, 3
cmp edx, 0xa
jae 0x410e53
lea eax, [ecx + ecx*4]
lea eax, [edx + eax*2]
mov dword [0x459a18], eax
movzx eax, word [esi + 0xac]
mov dword [0x459a14], eax
push 0x208
lea eax, [ebp - 0x568]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x568]
push 0x104
push eax
push dword [0x459944]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x410ecf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x410ecf
mov ecx, 0x104
lea eax, [ebp - 0x568]
cmp word [eax], 0
je 0x410ee7
add eax, 2
sub ecx, 1
jne 0x410ec1
mov eax, 2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, 0x104
sub eax, ecx
je 0x410ecf
lea eax, [ebp + eax*2 - 0x568]
nop word [eax + eax]
cmp word [eax - 4], 0x5c
lea eax, [eax - 2]
jne 0x410f00
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x568]
push eax
push str.Rootpath_is__ls_n
push ecx
call fcn.0040e7c0
add esp, 0xc
mov dword [ebp - 0x20], ecx
lea eax, [ebp - 0x20]
push str.WINDIR
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wdupenv_s]
add esp, 0xc
test eax, eax
jne 0x4116ca
cmp dword [ebp - 0x20], eax
je 0x4116db
lea ecx, [ebp - 0x568]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410f54
sub ecx, edx
lea eax, [ebp - 0x568]
sar ecx, 1
push ecx
push eax
mov ecx, 0x4551dc
call fcn.00414c60
push dword [ebp - 0x20]
lea ecx, [ebp - 0x94]
call fcn.0041a350
push str.System32_ntdll.dll
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0
call fcn.0040c930
lea ecx, [ebp - 0x134]
call fcn.00410a60
push 0xf
push str.x86wntdll.pdb
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0041ab20
mov edx, eax
cmp dword [edx + 0x14], 0x10
jb 0x410fc1
mov edx, dword [edx]
mov ecx, edx
mov byte [ebp - 0x1c], 0
lea esi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x410fd0
sub ecx, esi
push ecx
push edx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xec]
call fcn.00416820
add esp, 0xc
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 2
call fcn.0040ff70
lea ecx, [ebp - 0xec]
mov byte [ebp - 0x11], al
call fcn.00401e10
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 0
call fcn.00406370
cmp byte [ebp - 0x11], 0
jne 0x411035
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.____Downloading_ntdll_pdb_n
call fcn.00401b60
mov byte [ebp - 4], 3
lea eax, [ebp - 0xd4]
push 0x4551dc
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x18], eax
mov word [ebp - 0xd4], 0x101
mov byte [ebp - 0xd2], 0
mov dword [ebp - 0xd0], 0
call fcn.0040d700
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0xb4]
call fcn.0040d700
mov dword [ebp - 0x9c], 0x455120
mov dword [ebp - 0x98], 0x41f7f0
push 0xb0
mov byte [ebp - 4], 5
call fcn.00438d2f
add esp, 4
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 7
push ecx
mov ecx, eax
call fcn.00416940
mov esi, eax
mov byte [ebp - 0x54], 0
mov dword [ebp - 0x58], esi
mov byte [ebp - 0x50], 0
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 9
call fcn.00415d10
test esi, esi
je 0x4116f3
lea ecx, [esi + 4]
lock inc dword [ecx]
mov dword [ebp - 0x3c], esi
mov byte [ebp - 0x38], 1
mov dword [ebp - 0x1c], 3
or edi, 0xffffffff
mov byte [ebp - 4], 0xa
mov eax, edi
lock xadd dword [ecx], eax
jne 0x411117
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x41110f
mov eax, dword [ecx]
push esi
jmp 0x411115
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], esi
push eax
mov ecx, 0x459e84
mov dword [ebp - 0x3c], 0
mov byte [ebp - 0x28], 0
call fcn.00413b70
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x41115b
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x41115b
mov edx, dword [ecx + 0x78]
test edx, edx
je 0x411155
mov eax, dword [edx]
push ecx
mov ecx, edx
jmp 0x411159
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebp - 0x1c], 1
push dword [ebp - 0x20]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov byte [ebp - 4], 0xe
push 0xb0
mov dword [ebp - 0x44], 0x459a20
mov dword [ebp - 0x40], 0x4042c0
call fcn.00438d2f
add esp, 4
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xf
push ecx
mov ecx, eax
call fcn.00416a90
mov esi, eax
mov byte [ebp - 0x60], 0
mov dword [ebp - 0x64], esi
mov byte [ebp - 0x5c], 0
mov byte [ebp - 4], 0x10
test esi, esi
je 0x4116f3
lea ecx, [esi + 4]
lock inc dword [ecx]
mov dword [ebp - 0x4c], esi
mov byte [ebp - 0x48], 1
mov dword [ebp - 0x1c], 5
mov byte [ebp - 4], 0x11
mov eax, edi
lock xadd dword [ecx], eax
jne 0x4111ec
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x4111e4
mov eax, dword [ecx]
push esi
jmp 0x4111ea
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], esi
push eax
mov ecx, 0x459ea8
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x30], 0
call fcn.00413b70
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x41122f
lock xadd dword [ecx + 4], edi
dec edi
jne 0x41122f
mov edx, dword [ecx + 0x78]
test edx, edx
je 0x411229
mov eax, dword [edx]
push ecx
mov ecx, edx
jmp 0x41122d
mov eax, dword [ecx]
push 1
call dword [eax]
push 0
push 0
push 1
mov byte [ebp - 4], 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x459e38], eax
test eax, eax
jne 0x411254
call edi
push 0
push 0
push 1
push 0
call esi
mov dword [0x459958], eax
test eax, eax
jne 0x411269
call edi
push 0
push 0
push 1
push 0
call esi
mov dword [0x459954], eax
test eax, eax
jne 0x41127e
call edi
push 0
push 0
push 1
push 0
call esi
mov dword [0x459a1c], eax
test eax, eax
jne 0x411293
call edi
call sym.GH_Injector___x86.exe_GetSymbolState
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x4112af
push 0xa
call esi
call sym.GH_Injector___x86.exe_GetSymbolState
test eax, eax
jne 0x4112a2
call sym.GH_Injector___x86.exe_GetImportState
test eax, eax
je 0x4112c5
push 0xa
call esi
call sym.GH_Injector___x86.exe_GetImportState
test eax, eax
jne 0x4112b8
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.____ntdll_pdb_loaded_n
call fcn.00401b60
sub esp, 0x18
xorps xmm0, xmm0
mov esi, esp
push 0xf
movups xmmword [esi], xmm0
push str.sc_stop_HookDrv
push esi
mov dword [esi + 0x10], 0xf
mov dword [esi + 0x14], 0xf
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0xf], 0
call fcn.004108c0
mov esi, esp
xorps xmm0, xmm0
push 0x20
mov ecx, esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.00406230
mov dword [esi], eax
mov dword [esi + 0x10], 0x11
mov dword [esi + 0x14], 0x1f
movups xmm0, xmmword [str.sc_delete_HookDrv]
movups xmmword [eax], xmm0
mov cl, byte [0x449580]
mov byte [eax + 0x10], cl
mov byte [eax + 0x11], 0
call fcn.004108c0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x18
push 0x449584
call edi
push 0xe
push 0x449584
mov byte [ebp - 0x1c], 0
lea ecx, [ebp - 0x104]
push dword [ebp - 0x1c]
call fcn.00416820
add esp, 0xc
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 0x15
call fcn.0040ff70
lea ecx, [ebp - 0x104]
mov byte [ebp - 0x11], al
mov byte [ebp - 4], 0
call fcn.00401e10
cmp byte [ebp - 0x11], 0
jne 0x411405
push str.C:HookDrv.sys
lea ecx, [ebp - 0x11c]
call fcn.0041a350
push ecx
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0x16
call fcn.004100c0
add esp, 4
mov byte [ebp - 0x11], al
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0
call fcn.00401e10
cmp byte [ebp - 0x11], 0
jne 0x411405
lea ecx, [ebp - 0x94]
mov esi, 5
call fcn.00401e10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
sub esp, 0x18
xorps xmm0, xmm0
mov esi, esp
mov ecx, esi
push 0x40
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.00406230
mov ecx, eax
mov dword [esi + 0x10], 0x35
mov dword [esi], ecx
mov dword [esi + 0x14], 0x3f
movups xmm0, xmmword [str.sc_create_HookDrv_binpathC:HookDrv.sys_typefilesys]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x4495c4]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x4495d4]
movups xmmword [ecx + 0x20], xmm0
mov eax, dword [0x4495e4]
mov dword [ecx + 0x30], eax
mov al, byte [0x4495e8]
mov byte [ecx + 0x34], al
mov byte [ecx + 0x35], 0
call fcn.004108c0
mov esi, esp
xorps xmm0, xmm0
push 0x20
mov ecx, esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.00406230
mov dword [esi], eax
mov dword [esi + 0x10], 0x10
mov dword [esi + 0x14], 0x1f
movups xmm0, xmmword [str.sc_start_HookDrv]
movups xmmword [eax], xmm0
mov byte [eax + 0x10], 0
call fcn.004108c0
mov esi, dword [ebp - 0x24]
add esp, 0x18
mov ecx, esi
call fcn.00410810
test eax, eax
je 0x411575
sub esp, 0x18
xorps xmm0, xmm0
mov esi, esp
push 0xf
movups xmmword [esi], xmm0
push str.sc_stop_HookDrv
push esi
mov dword [esi + 0x10], 0xf
mov dword [esi + 0x14], 0xf
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0xf], 0
call fcn.004108c0
mov esi, esp
xorps xmm0, xmm0
push 0x20
mov ecx, esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.00406230
mov dword [esi], eax
mov dword [esi + 0x10], 0x11
mov dword [esi + 0x14], 0x1f
movups xmm0, xmmword [str.sc_delete_HookDrv]
movups xmmword [eax], xmm0
mov cl, byte [0x449580]
mov byte [eax + 0x10], cl
mov byte [eax + 0x11], 0
call fcn.004108c0
add esp, 0x18
push 0x449584
call edi
lea ecx, [ebp - 0x94]
mov esi, 4
call fcn.00401e10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x208
lea eax, [ebp - 0x360]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x158], esi
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x150], 4
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 0
mov byte [ebp - 0x13c], 0
call fcn.00410a60
push 0xb
push str.module.dll
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x17
call fcn.0041ab20
cmp dword [ebp - 0x68], 0x10
lea ecx, [ebp - 0x7c]
lea edx, [ebp - 0x360]
cmovae ecx, dword [ebp - 0x7c]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x411602
lea eax, [ebp - 0x360]
push eax
call sym.GH_Injector___x86.exe_InjectA
sub esp, 0x18
xorps xmm0, xmm0
mov esi, esp
push 0xf
movups xmmword [esi], xmm0
push str.sc_stop_HookDrv
push esi
mov dword [esi + 0x10], 0xf
mov dword [esi + 0x14], 0xf
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0xf], 0
call fcn.004108c0
mov esi, esp
xorps xmm0, xmm0
push 0x20
mov ecx, esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.00406230
mov dword [esi], eax
mov dword [esi + 0x10], 0x11
mov dword [esi + 0x14], 0x1f
movups xmm0, xmmword [str.sc_delete_HookDrv]
movups xmmword [eax], xmm0
mov cl, byte [0x449580]
mov byte [eax + 0x10], cl
mov byte [eax + 0x11], 0
call fcn.004108c0
add esp, 0x18
push 0x449584
call edi
lea ecx, [ebp - 0x7c]
call fcn.00406370
lea ecx, [ebp - 0x94]
call fcn.00401e10
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4116db
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, 3
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov ecx, 4
call fcn.00406660
int3