Function at 0x412890
Capabilities:
Create process on windows
Delete file
Delete service
Get common file path
Manipulate safe mode programs
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc4
mov eax, dword [0x441044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x206
xor ebx, ebx
lea ecx, [ebp - 0xc16]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0xc18], ax
call fcn.004238b0
add esp, 0xc
push 0x206
lea eax, [ebp - 0x20e]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x210], dx
call fcn.004238b0
add esp, 0xc
mov esi, 0x43be7c
mov dword [ebp - 0xc80], ebx
mov dword [ebp - 0xc78], 1
call fcn.00413110
test eax, eax
jne 0x412a8a
push ebx
push str.C:Program_Filesww2010cfwmcUser.exe
call fcn.0041c33e
add esp, 8
mov esi, str.wmcUser.exe
test eax, eax
jne 0x41298c
push 0x43bee0
call fcn.00403790
add esp, 4
lea ecx, [ebp - 0xc54]
push ecx
mov dword [ebp - 0xc54], 0x3c
mov dword [ebp - 0xc50], 0x40
mov dword [ebp - 0xc4c], ebx
mov dword [ebp - 0xc48], ebx
mov dword [ebp - 0xc44], esi
mov dword [ebp - 0xc40], str.__registrystop
mov dword [ebp - 0xc3c], str.C:Program_Filesww2010cf
mov dword [ebp - 0xc38], ebx
mov dword [ebp - 0xc34], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call edi
jmp 0x412992
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push str.C:Program_Files__x86_ww2010cfwmcUser.exe
call fcn.0041c33e
add esp, 8
test eax, eax
jne 0x412a0b
push 0x43bfe8
call fcn.00403790
add esp, 4
lea edx, [ebp - 0xc54]
push edx
mov dword [ebp - 0xc54], 0x3c
mov dword [ebp - 0xc50], 0x40
mov dword [ebp - 0xc4c], ebx
mov dword [ebp - 0xc48], ebx
mov dword [ebp - 0xc44], esi
mov dword [ebp - 0xc40], str.__registrystop
mov dword [ebp - 0xc3c], str.C:Program_Files__x86_ww2010cf
mov dword [ebp - 0xc38], ebx
mov dword [ebp - 0xc34], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0x7d0
call edi
push ebx
push str.C:Program_Filesww2017cfwmcUser7.exe
call fcn.0041c33e
add esp, 8
test eax, eax
jne 0x412a90
push 0x43c0c0
call fcn.00403790
add esp, 4
lea eax, [ebp - 0xc54]
push eax
mov dword [ebp - 0xc54], 0x3c
mov dword [ebp - 0xc50], 0x40
mov dword [ebp - 0xc4c], ebx
mov dword [ebp - 0xc48], ebx
mov dword [ebp - 0xc44], 0x436a00
mov dword [ebp - 0xc40], str.__registrystop
mov dword [ebp - 0xc3c], str.C:Program_Filesww2017cf
mov dword [ebp - 0xc38], ebx
mov dword [ebp - 0xc34], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xbb8
call edi
jmp 0x412a90
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0xc7c], esi
cmp esi, ebx
je 0x412e0e
push 0xf01ff
push 0x43c124
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0xc74], eax
cmp eax, ebx
je 0x412df8
push 0x1f2
lea edx, [ebp - 0x5fe]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x600], cx
call fcn.004238b0
mov ecx, dword [ebp - 0xc74]
add esp, 0xc
lea eax, [ebp - 0xc70]
push eax
push 1
mov dword [ebp - 0xc84], ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0xbb8
call edi
mov eax, dword [ebp - 0xc74]
lea edx, [ebp - 0xc34]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x412b4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x600]
push 0x43c148
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x600]
add esp, 0xc
push edx
call fcn.00403790
add esp, 4
mov esi, dword [ebp - 0xc30]
cmp esi, 1
je 0x412d96
cmp esi, 3
je 0x412d96
push 0x1f2
lea ecx, [ebp - 0x406]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x408], ax
call fcn.004238b0
lea eax, [esi - 2]
add esp, 0xc
cmp eax, 5
ja case.default.0x412b8f
jmp dword [eax*4 + 0x4130ec]
xor eax, eax
jmp 0x412ba0
movzx ecx, word [eax + str.SERVICE_START_PENDING]
mov word [ebp + eax - 0x408], cx
add eax, 2
cmp cx, bx
jne 0x412ba0
jmp 0x412c77
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.SERVICE_STOP_PENDING]
mov word [ebp + eax - 0x408], cx
add eax, 2
cmp cx, bx
jne 0x412bc0
jmp 0x412c77
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.SERVICE_RUNNING]
mov word [ebp + eax - 0x408], cx
add eax, 2
cmp cx, bx
jne 0x412be0
jmp 0x412c77
xor eax, eax
jmp 0x412c00
movzx ecx, word [eax + str.SERVICE_CONTINUE_PENDING]
mov word [ebp + eax - 0x408], cx
add eax, 2
cmp cx, bx
jne 0x412c00
jmp 0x412c77
xor eax, eax
jmp 0x412c20
movzx ecx, word [eax + str.SERVICE_PAUSE_PENDING]
mov word [ebp + eax - 0x408], cx
add eax, 2
cmp cx, bx
jne 0x412c20
jmp 0x412c77
xor eax, eax
jmp 0x412c40
movzx ecx, word [eax + str.SERVICE_PAUSED]
mov word [ebp + eax - 0x408], cx
add eax, 2
cmp cx, bx
jne 0x412c40
jmp 0x412c77
xor eax, eax
jmp 0x412c60
movzx ecx, word [eax + str.Unknow]
mov word [ebp + eax - 0x408], cx
add eax, 2
cmp cx, bx
jne 0x412c60
lea edx, [ebp - 0x408]
push edx
lea eax, [ebp - 0x600]
push 0x43c288
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x600]
add esp, 0xc
push ecx
call fcn.00403790
mov esi, dword [ebp - 0xc84]
add esp, 4
inc esi
push esi
lea edx, [ebp - 0x600]
push 0x43c2b4
push edx
mov dword [ebp - 0xc84], esi
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x600]
add esp, 0xc
push eax
call fcn.00403790
add esp, 4
cmp esi, 0x1e
jne 0x412d90
mov eax, 1
cmp dword [ebp - 0xc80], eax
jge 0x412dbc
add dword [ebp - 0xc80], eax
push ebx
push str.C:Program_Filesww2017cfwmcUser7.exe
mov dword [ebp - 0xc84], ebx
call fcn.0041c2bf
add esp, 8
test eax, eax
jne 0x412b03
lea ecx, [ebp - 0xcc0]
push ecx
mov dword [ebp - 0xcc0], 0x3c
mov dword [ebp - 0xcbc], 0x40
mov dword [ebp - 0xcb8], ebx
mov dword [ebp - 0xcb4], ebx
mov dword [ebp - 0xcb0], 0x436a00
mov dword [ebp - 0xcac], str.__registrystop
mov dword [ebp - 0xca8], str.C:Program_Filesww2017cf
mov dword [ebp - 0xca4], ebx
mov dword [ebp - 0xca0], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0x43c2e4
call fcn.00403790
add esp, 4
push 0xbb8
call edi
mov eax, dword [ebp - 0xc74]
lea edx, [ebp - 0xc70]
push edx
push 1
push eax
jmp 0x412afd
jle 0x412b03
push 0x43c318
call fcn.00403790
mov ecx, dword [ebp - 0xc74]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push 0x43c360
call fcn.00403790
jmp 0x412dd9
mov edx, dword [ebp - 0xc74]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push 0x43c3a0
call fcn.00403790
mov dword [ebp - 0xc78], ebx
mov eax, dword [ebp - 0xc74]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0xc7c]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x412e21
push 0x43c3e8
call fcn.00403790
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x412e21
push 0x43c440
mov dword [ebp - 0xc78], ebx
call fcn.00403790
add esp, 4
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0xc18]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0xc18]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edi, [ebp - 0xc18]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x412e55
mov ecx, 0x13
mov esi, str.System32driverscbfsregistry2017.sys
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0xc18]
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
call edi
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x412ea2
lea edx, [ebp - 0xc3c]
push edx
call eax
movzx eax, word [ebp - 0xc3c]
cmp eax, ebx
je 0x412ef5
cmp eax, 9
jne 0x412ef5
push str.Kernel32.dll
mov dword [ebp - 0xc7c], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x412eed
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0xc7c]
push ecx
call eax
push esi
test eax, eax
jne 0x4130ab
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x208
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.004238b0
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x210]
push str.C:Program_Filesww2010cfCBFSRegistry.cab
push ecx
call esi
add esp, 8
lea edx, [ebp - 0x210]
push edx
call edi
push 0x208
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.004238b0
add esp, 0xc
lea ecx, [ebp - 0x210]
push str.C:Program_Files__x86_ww2010cfCBFSRegistry.cab
push ecx
call esi
add esp, 8
lea edx, [ebp - 0x210]
push edx
call edi
push 0x208
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.004238b0
add esp, 0xc
lea ecx, [ebp - 0x210]
push str.C:Program_Filesww2017cfCBFSRegistry.cab
push ecx
call esi
add esp, 8
lea edx, [ebp - 0x210]
push edx
call edi
push 0x40e
lea ecx, [ebp - 0xa0e]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0xa10], ax
call fcn.004238b0
add esp, 0xc
mov edx, str.SYSTEMCurrentControlSetControlSafeBootMinimalcbfsregistry2017.sys
lea ecx, [ebp - 0xa10]
call fcn.004042a0
push ebx
lea edx, [ebp - 0xa10]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00404de0
add esp, 0xc
push 0x40e
lea ecx, [ebp - 0xa0e]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0xa10], ax
call fcn.004238b0
add esp, 0xc
mov edx, str.SYSTEMCurrentControlSetControlSafeBootMinimalcbfsregistry2017
lea ecx, [ebp - 0xa10]
call fcn.004042a0
push ebx
lea edx, [ebp - 0xa10]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00404de0
add esp, 0xc
xor eax, eax
push 0x40e
mov word [ebp - 0xa10], ax
push ebx
lea ecx, [ebp - 0xa0e]
push ecx
call fcn.004238b0
add esp, 0xc
mov edx, str.SYSTEMCurrentControlSetControlSafeBootNetworkcbfsregistry2017.sys
lea ecx, [ebp - 0xa10]
call fcn.004042a0
push ebx
lea edx, [ebp - 0xa10]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00404de0
add esp, 0xc
push 0x40e
lea ecx, [ebp - 0xa0e]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0xa10], ax
call fcn.004238b0
add esp, 0xc
mov edx, str.SYSTEMCurrentControlSetControlSafeBootNetworkcbfsregistry2017
lea ecx, [ebp - 0xa10]
call fcn.004042a0
push ebx
lea edx, [ebp - 0xa10]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00404de0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc78]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bcde
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp - 0xc18]
push edx
call edi
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x412ef5
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x412ef5