Function at 0x407cb0
Capabilities:
Delete file
Delete service
Get common file path
Manipulate safe mode programs
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00414930
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x416]
push eax
mov word [ebp - 0x418], dx
call fcn.00414930
add esp, 0xc
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x407d59
push 0xf01ff
push str.wm7f
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x407d56
lea ecx, [ebp - 0x434]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call ebx
push edi
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x210]
push eax
call ebx
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x407d90
mov ecx, 0xd
mov esi, str.System32driverswm7f.sys
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x210]
push ecx
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x210]
push eax
call ebx
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
jmp 0x407df0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x407df0
mov ecx, 0xd
mov esi, str.System32driverswm7f.inf
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x210]
push ecx
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x210]
push eax
call ebx
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
jmp 0x407e50
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x407e50
mov ecx, 0xd
mov esi, str.System32driverswm7f.cat
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x210]
push ecx
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
je 0x407e9d
lea edx, [ebp - 0x460]
push edx
call eax
movzx eax, word [ebp - 0x460]
test eax, eax
je 0x407f07
cmp eax, 9
je 0x407eb6
cmp byte [ebp - 0x435], 1
jne 0x407f07
push str._t_tDelete_wm7f_Driver__is_64bit__DisableFsRedirection.
call fcn.004033d0
add esp, 4
push str.Kernel32.dll
mov dword [ebp - 0x43c], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x407efa
push str.Wow64DisableWow64FsRedirection
push esi
call edi
lea ecx, [ebp - 0x43c]
push ecx
call eax
push esi
test eax, eax
jne 0x407f63
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str._t_tDelete_wm7f_Driver__is_64bit__DisableFsRedirection_FALSE.
call fcn.004033d0
add esp, 4
mov esi, str.SYSTEMCurrentControlSetServiceswm7f
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SYSTEMCurrentControlSetControlSafeBootMinimalwm7f.sys
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SYSTEMCurrentControlSetControlSafeBootMinimalwm7f
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SYSTEMCurrentControlSetControlSafeBootNetworkwm7f.sys
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SYSTEMCurrentControlSetControlSafeBootNetworkwm7f
mov ecx, 0x80000002
call fcn.0040a170
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x418]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x418]
push eax
call ebx
xor eax, eax
jmp 0x407fb0
movzx ecx, word [ebp + eax - 0x418]
mov word [ebp + eax - 0x210], cx
add eax, 2
test cx, cx
jne 0x407fb0
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x407fd1
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0xd
mov esi, str.System32driverswm7f.sys
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x210]
push ecx
movsw word es:[edi], word [esi]
call ebx
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
xor eax, eax
jmp 0x408020
movzx ecx, word [ebp + eax - 0x418]
mov word [ebp + eax - 0x210], cx
add eax, 2
test cx, cx
jne 0x408020
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x408041
mov ecx, 0xd
mov esi, str.System32driverswm7f.inf
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x210]
push eax
movsw word es:[edi], word [esi]
call ebx
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x210]
rep stosd dword es:[edi], eax
xor eax, eax
nop
movzx ecx, word [ebp + eax - 0x418]
mov word [ebp + eax - 0x210], cx
add eax, 2
test cx, cx
jne 0x408080
lea edi, [ebp - 0x210]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4080a1
mov ecx, 0xd
mov esi, str.System32driverswm7f.cat
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x210]
push eax
movsw word es:[edi], word [esi]
call ebx
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4080ec
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str._t_tDelete_wm7f_Driver__is_64bit__RevertFsRedirection.
jmp 0x407eff