Function at 0x4ffad0
Capabilities:
Delete file
Delete service
Get common file path
Set file attributes

Disassembly:
jmp 0x4ffad0
push 0xffffffffffffffff
push 0x78a79d
mov eax, dword fs:[0]
push eax
sub esp, 0x2a4
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x2a0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x856918]
xor eax, esp
push eax
lea eax, [esp + 0x2b8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2cc]
mov eax, dword [esp + 0x2d0]
mov edi, dword [esp + 0x2c8]
xor ebp, ebp
mov ebx, ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], eax
cmp dword [esi + 0x14], ebp
jne 0x4ffb56
push 0x1f
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebp
push str.CWFP::UninstallWFP___Wrong_data
mov ecx, edi
mov byte [edi + 4], 0
call fcn.00405920
jmp 0x500010
push esi
call fcn.004045b6
push ebp
test al, al
jne 0x4ffb7f
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebp
push 0x7bb946
mov ecx, edi
mov byte [edi + 4], al
call fcn.00405920
jmp 0x500010
push esi
mov ecx, ebx
call fcn.00405d53
test al, al
je 0x4ffbac
push esi
lea ecx, [esp + 0x5c]
push ecx
mov ecx, ebx
call fcn.00401208
cmp dword [esp + 0x70], 0x10
jb 0x4ffbac
mov edx, dword [esp + 0x5c]
push edx
call fcn.00564155
add esp, 4
push 2
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
cmp ebx, ebp
jne 0x4ffbcd
push 0x7bbfc4
mov ecx, edi
call fcn.004062df
jmp 0x500010
cmp dword [esi + 0x18], 8
jb 0x4ffbd8
mov esi, dword [esi + 4]
jmp 0x4ffbdb
add esi, 4
push 0xf01ff
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, eax
test ebp, ebp
jne 0x4ffc4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [esp + 0x20]
push esi
push eax
call fcn.004083af
add esp, 8
mov esi, eax
push str.CWFP::UninstallWFP___Failed_to_open_service_with_error:
lea ecx, [esp + 0x5c]
mov dword [esp + 0x2c4], ebp
call fcn.004062df
push esi
push eax
push edi
mov byte [esp + 0x2cc], 1
call fcn.00402fd1
add esp, 0xc
lea ecx, [esp + 0x58]
call fcn.00402ed7
lea ecx, [esp + 0x20]
call fcn.00402ed7
jmp 0x500010
push ebp
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4ffc61
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call ebp
push ebx
call ebp
xor ebp, ebp
cmp esi, ebp
je 0x4ffcc6
lea ecx, [esp + 0x58]
push esi
push ecx
call fcn.004083af
add esp, 8
mov esi, eax
push str.CWFP::UninstallWFP___Failed_to_delete_service_with_error
lea ecx, [esp + 0x24]
mov dword [esp + 0x2c4], 2
call fcn.004062df
push esi
push eax
push edi
mov byte [esp + 0x2cc], 3
call fcn.00402fd1
add esp, 0xc
lea ecx, [esp + 0x20]
call fcn.00402ed7
lea ecx, [esp + 0x58]
call fcn.00402ed7
jmp 0x500010
xor edx, edx
mov dword [esp + 0xa8], 7
mov dword [esp + 0xa4], ebp
mov word [esp + 0x94], dx
mov dword [esp + 0x2c0], 4
call fcn.00408a76
mov ecx, eax
call fcn.0040364d
test al, al
je 0x4ffd45
cmp dword [0x8699c4], ebp
je 0x4ffd0d
cmp dword [0x8699c0], ebp
jne 0x4ffd45
push 0x7bc064
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebp
je 0x4ffd3e
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64DisableWow64FsRedirection
push esi
call ebx
push str.Wow64RevertWow64FsRedirection
push esi
mov dword [0x8699c4], eax
call ebx
mov dword [0x8699c0], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x208
lea eax, [esp + 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 0xac]
push ecx
lea ecx, [esp + 0x78]
call fcn.00403706
mov byte [esp + 0x2c0], 5
call fcn.00408a76
mov ecx, eax
call fcn.0040364d
test al, al
je 0x4ffd98
cmp dword [0x8699c0], ebp
je 0x4ffd91
cmp dword [0x8699c4], ebp
jne 0x4ffd98
push str.SysWOW64Drivers_
jmp 0x4ffd9d
push str._system32Drivers_
lea ecx, [esp + 0x78]
call fcn.004050a1
mov edx, dword [esp + 0x1c]
push 0xffffffffffffffff
push ebp
push edx
lea ecx, [esp + 0x80]
call fcn.004019a1
mov dword [esp + 0x14], ebp
call fcn.00408a76
mov ecx, eax
call fcn.0040364d
test al, al
je 0x4ffe65
cmp dword [0x8699c0], ebp
je 0x4ffe65
mov eax, dword [0x8699c4]
cmp eax, ebp
je 0x4ffe65
lea ecx, [esp + 0x14]
push ecx
call eax
test eax, eax
jne 0x4ffe65
push str.CWFP::UninstallWFP___Failed_to_call_Wow64RevertWow64FsRedirection:
lea ecx, [esp + 0x5c]
call fcn.004062df
mov bl, 6
mov byte [esp + 0x2c0], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x24]
push edx
call fcn.004083af
add esp, 8
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x2cc], 7
call fcn.00401e38
lea ecx, [esp + 0x20]
mov byte [esp + 0x2c0], bl
call fcn.00402ed7
lea eax, [esp + 0x58]
push ebp
push eax
call fcn.004024eb
mov ecx, eax
call fcn.004020ae
lea ecx, [esp + 0x58]
mov byte [esp + 0x2c0], 5
call fcn.00402ed7
lea ecx, [esp + 0x74]
push ecx
call fcn.00405b9b
add esp, 4
test al, al
je 0x4fff68
push str.CWFP::UninstallWFP___Detected_existing_WFP
lea ecx, [esp + 0x5c]
call fcn.004062df
lea edx, [esp + 0x58]
push 1
push edx
mov byte [esp + 0x2c8], 8
call fcn.004024eb
mov ecx, eax
call fcn.00403bb1
lea ecx, [esp + 0x58]
mov byte [esp + 0x2c0], 5
call fcn.00402ed7
mov eax, dword [esp + 0x78]
mov esi, 8
cmp dword [esp + 0x8c], esi
jae 0x4ffeca
lea eax, [esp + 0x78]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x4fff13
push str.CWFP::UninstallWFP___Failed_to_call_SetFileAttributesW
lea ecx, [esp + 0x5c]
call fcn.004062df
lea eax, [esp + 0x58]
push ebp
push eax
mov byte [esp + 0x2c8], 9
call fcn.004024eb
mov ecx, eax
call fcn.004020ae
lea ecx, [esp + 0x58]
mov byte [esp + 0x2c0], 5
call fcn.00402ed7
mov eax, dword [esp + 0x78]
cmp dword [esp + 0x8c], esi
jae 0x4fff24
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4fff68
push str.CWFP::UninstallWFP___Failed_to_call_DeleteFileW
lea ecx, [esp + 0x5c]
call fcn.004062df
lea ecx, [esp + 0x58]
push ebp
push ecx
mov byte [esp + 0x2c8], 0xa
call fcn.004024eb
mov ecx, eax
call fcn.004020ae
lea ecx, [esp + 0x58]
mov byte [esp + 0x2c0], 5
call fcn.00402ed7
call fcn.00408a76
mov ecx, eax
call fcn.0040364d
test al, al
je 0x4fff90
mov eax, dword [0x8699c0]
cmp eax, ebp
je 0x4fff90
cmp dword [0x8699c4], ebp
je 0x4fff90
mov edx, dword [esp + 0x14]
push edx
call eax
mov esi, dword [esp + 0x18]
push 1
lea eax, [esp + 0x24]
push eax
mov ecx, esi
call fcn.00406a2d
lea ecx, [esp + 0x20]
call fcn.00402ed7
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push str.CWFP::UninstallWFP
call fcn.004062df
lea ecx, [esp + 0x5c]
push ecx
mov byte [esp + 0x2e4], 0xb
call fcn.00408a76
mov ecx, eax
mov byte [esp + 0x2e4], 5
call fcn.00406cd5
lea ecx, [esp + 0x3c]
call fcn.00403a26
push ebp
push edi
mov ecx, esi
mov byte [esi + 4], 0
mov byte [esi + 5], 1
call fcn.00406a2d
lea ecx, [esp + 0x74]
call fcn.00403a26
lea ecx, [esp + 0x90]
call fcn.00403a26
mov eax, edi
mov ecx, dword [esp + 0x2b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2a0]
xor ecx, esp
call fcn.00564b24
add esp, 0x2b0
ret 0xc