Function at 0x405890
Capabilities:
Create process on windows
Delete file
Delete service
Get common file path
Manipulate safe mode programs
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x89c
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.______Remove_Reg_Driver_.
call fcn.004033d0
add esp, 4
push 0x206
xor ebx, ebx
lea ecx, [ebp - 0x406]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x408], ax
call fcn.00414930
add esp, 0xc
push 0x206
lea eax, [ebp - 0x806]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x808], dx
call fcn.00414930
add esp, 0xc
push 2
push ebx
push ebx
mov dword [ebp - 0x850], ebx
mov dword [ebp - 0x858], 1
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x85c], esi
cmp esi, ebx
je 0x405df4
push 0xf01ff
push str.cbfsregistry2017
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x84c], eax
cmp eax, ebx
je 0x405c64
push 0x1f2
lea edx, [ebp - 0x5fe]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x600], cx
call fcn.00414930
mov ecx, dword [ebp - 0x84c]
add esp, 0xc
lea eax, [ebp - 0x848]
push eax
push 1
xor edi, edi
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x84c]
lea edx, [ebp - 0x824]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x4059be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x600]
push str._t_t_t_Terminate_Reg_Driver__Query_Service_Status_Error
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x600]
add esp, 0xc
push edx
call fcn.004033d0
add esp, 4
mov esi, dword [ebp - 0x820]
cmp esi, 1
je 0x405bf8
cmp esi, 3
je 0x405bf8
push 0x1f2
lea ecx, [ebp - 0x1fe]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x200], ax
call fcn.00414930
lea eax, [esi - 2]
add esp, 0xc
cmp eax, 5
ja case.default.0x405a00
jmp dword [eax*4 + 0x405e78]
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + str.SERVICE_START_PENDING]
mov word [ebp + eax - 0x200], cx
add eax, 2
cmp cx, bx
jne 0x405a10
jmp 0x405ae7
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.SERVICE_STOP_PENDING]
mov word [ebp + eax - 0x200], cx
add eax, 2
cmp cx, bx
jne 0x405a30
jmp 0x405ae7
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.SERVICE_RUNNING]
mov word [ebp + eax - 0x200], cx
add eax, 2
cmp cx, bx
jne 0x405a50
jmp 0x405ae7
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.SERVICE_CONTINUE_PENDING]
mov word [ebp + eax - 0x200], cx
add eax, 2
cmp cx, bx
jne 0x405a70
jmp 0x405ae7
xor eax, eax
jmp 0x405a90
movzx ecx, word [eax + str.SERVICE_PAUSE_PENDING]
mov word [ebp + eax - 0x200], cx
add eax, 2
cmp cx, bx
jne 0x405a90
jmp 0x405ae7
xor eax, eax
jmp 0x405ab0
movzx ecx, word [eax + str.SERVICE_PAUSED]
mov word [ebp + eax - 0x200], cx
add eax, 2
cmp cx, bx
jne 0x405ab0
jmp 0x405ae7
xor eax, eax
jmp 0x405ad0
movzx ecx, word [eax + str.Unknow]
mov word [ebp + eax - 0x200], cx
add eax, 2
cmp cx, bx
jne 0x405ad0
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x200]
push edx
lea eax, [ebp - 0x600]
push str._t_t_t_Terminate_Reg_Driver__Query_Service_Status
push eax
call esi
lea ecx, [ebp - 0x600]
add esp, 0xc
push ecx
call fcn.004033d0
add esp, 4
inc edi
push edi
lea edx, [ebp - 0x600]
push 0x41d5c8
push edx
call esi
lea eax, [ebp - 0x600]
add esp, 0xc
push eax
call fcn.004033d0
add esp, 4
cmp edi, 0x1e
jne 0x405bf2
mov eax, 1
cmp dword [ebp - 0x850], eax
jge 0x405c19
add dword [ebp - 0x850], eax
push ebx
push str.C:Program_Filesww2017cfwmcUser7.exe
xor edi, edi
call fcn.0040e72e
add esp, 8
test eax, eax
jne 0x405970
lea ecx, [ebp - 0x898]
push ecx
mov dword [ebp - 0x898], 0x3c
mov dword [ebp - 0x894], 0x40
mov dword [ebp - 0x890], ebx
mov dword [ebp - 0x88c], ebx
mov dword [ebp - 0x888], 0x41a750
mov dword [ebp - 0x884], str.__registrystop
mov dword [ebp - 0x880], str.C:Program_Filesww2017cf
mov dword [ebp - 0x87c], ebx
mov dword [ebp - 0x878], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0x41d6c0
call fcn.004033d0
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x84c]
lea edx, [ebp - 0x848]
push edx
push 1
push eax
jmp 0x40596a
jle 0x405970
push 0x41d718
call fcn.004033d0
mov ecx, dword [ebp - 0x84c]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push 0x41d768
jmp 0x405c24
mov dword [ebp - 0x858], ebx
push 0x41d7b0
call fcn.004033d0
add esp, 4
push str.C:Program_Filesww2017cfCBFSRegistry.cab
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x41d858
call fcn.004033d0
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x84c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x85c]
jmp 0x405c71
push str._t_tDelete_Reg_Driver__OpenService_Fail.
call fcn.004033d0
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x858], ebx
je 0x405e64
push 0x41d958
call fcn.004033d0
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
add esp, 4
mov ecx, 0x82
lea edi, [ebp - 0x408]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edi, [ebp - 0x408]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x405cc5
mov ecx, 0x13
mov esi, str.System32driverscbfsregistry2017.sys
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x408]
push ecx
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x405d10
lea edx, [ebp - 0x82c]
push edx
call eax
movzx eax, word [ebp - 0x82c]
cmp eax, ebx
je 0x405e13
cmp eax, 9
je 0x405d31
cmp byte [ebp - 0x851], 1
jne 0x405e13
push str._t_tDelete_Reg_Driver__is_64bit__DisableFsRedirection.
call fcn.004033d0
add esp, 4
call fcn.004038b0
cmp eax, 1
jne 0x405e06
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x808]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x82
lea edi, [ebp - 0x408]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
jmp 0x405da0
movzx ecx, word [ebp + eax - 0x808]
mov word [ebp + eax - 0x408], cx
add eax, 2
cmp cx, bx
jne 0x405da0
lea edi, [ebp - 0x408]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x405dc1
mov ecx, 0x13
mov esi, str.System32driverscbfsregistry2017.sys
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x408]
push ecx
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00403910
push str._t_tDelete_Reg_Driver__is_64bit__RevertFsRedirection.
jmp 0x405e0b
push 0x41d900
call fcn.004033d0
add esp, 4
jmp 0x405c84
push str._t_tDelete_Reg_Driver__is_64bit__DisableFsRedirection_FALSE.
call fcn.004033d0
add esp, 4
cmp byte [0x429f56], bl
je 0x405e64
push str._t_t_t_Terminate_Reg_Driver_
call fcn.004033d0
add esp, 4
mov esi, str.SYSTEMCurrentControlSetControlSafeBootMinimalcbfsregistry2017.sys
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SYSTEMCurrentControlSetControlSafeBootMinimalcbfsregistry2017
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SYSTEMCurrentControlSetControlSafeBootNetworkcbfsregistry2017.sys
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SYSTEMCurrentControlSetControlSafeBootNetworkcbfsregistry2017
mov ecx, 0x80000002
call fcn.0040a170
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret