Function at 0x402700
Capabilities:
Delete service
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4104b7
mov eax, dword fs:[0]
push eax
sub esp, 0x6f4
mov eax, dword [0x415050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4174a8]
mov dword [ebp - 0x6e4], 0
test eax, eax
jne 0x402761
push str.Wow64DisableWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4174a8], eax
test eax, eax
je 0x40276a
lea ecx, [ebp - 0x6e4]
push ecx
call eax
call fcn.004020b0
mov ebx, 1
mov dword [ebp - 0x700], ebx
cmp dword [ebp + 8], ebx
jle 0x402efc
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.ntdll.dll
call edi
mov esi, eax
test esi, esi
je 0x4027ce
push str.RtlGetNtVersionNumbers
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4027c7
lea edx, [ebp - 0x6e8]
push edx
lea ecx, [ebp - 0x6e0]
push ecx
lea edx, [ebp - 0x6dc]
push edx
call eax
and dword [ebp - 0x6e8], 0xffff
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + ebx*4]
mov edx, 2
mov ecx, 0x4134e4
mov eax, esi
mov bx, word [eax]
cmp bx, word [ecx]
jne 0x4027f3
add eax, 2
add ecx, 2
dec edx
jne 0x4027e0
jmp 0x4027ff
sbb eax, eax
and eax, 0xfffffffe
inc eax
jne 0x4028de
push 0x4134ec
call fcn.00402280
add esp, 4
call fcn.004021f0
test eax, eax
je 0x402861
mov eax, dword [ebp - 0x6dc]
mov esi, 0x70
mov edi, str.PassGuard_x64.sys
cmp eax, 6
ja 0x402840
cmp eax, 5
jbe 0x4028d4
cmp dword [ebp - 0x6e0], 3
jbe 0x4028d4
call fcn.004025c0
test al, al
je 0x4028d4
mov esi, 0x72
mov edi, str.PassGuard_x64.sys
movzx ecx, si
mov edx, edi
jmp 0x402ec9
xor eax, eax
mov byte [ebp - 0x6d4], 0
mov word [ebp - 0x6d3], ax
mov byte [ebp - 0x6d1], al
str word [ebp - 0x6d4]
xor esi, esi
movzx eax, byte [ebp + esi - 0x6d4]
push eax
push str._02x
call fcn.0040498d
inc esi
add esp, 8
cmp esi, 4
jl 0x402880
cmp dword [ebp - 0x6dc], 5
mov esi, 0x6f
mov edi, str.PassGuard.sys
jne 0x4028d4
cmp dword [ebp - 0x6e0], 1
jne 0x4028d4
cmp byte [ebp - 0x6d4], 0
jne 0x4028cf
cmp byte [ebp - 0x6d3], 0x40
jne 0x4028cf
mov esi, 0x71
mov edi, str.PassGuard.sys
movzx ecx, si
mov edx, edi
jmp 0x402ec9
mov edx, 2
mov ecx, 0x413500
mov eax, esi
lea ebx, [ebx]
mov bx, word [eax]
cmp bx, word [ecx]
jne 0x402903
add eax, 2
add ecx, 2
dec edx
jne 0x4028f0
jmp 0x40290b
sbb eax, eax
and eax, 0xfffffffe
inc eax
jne 0x40294a
mov ecx, 0x416220
call fcn.00401a30
mov eax, dword [0x41663c]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov eax, dword [0x41663c]
test eax, eax
je 0x402931
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [0x416638]
test eax, eax
je 0x402ee6
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x402ee6
mov edx, 2
mov ecx, 0x413508
mov eax, esi
mov si, word [eax]
cmp si, word [ecx]
jne 0x402969
add eax, 2
add ecx, 2
dec edx
jne 0x402956
jmp 0x402975
sbb eax, eax
and eax, 0xfffffffe
inc eax
jne 0x402ee6
push str.ntdll.dll
call edi
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x4029bc
push str.RtlGetNtVersionNumbers
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4029b5
lea ecx, [ebp - 0x6fc]
push ecx
lea edx, [ebp - 0x6f4]
push edx
lea ecx, [ebp - 0x6f8]
push ecx
call eax
and dword [ebp - 0x6fc], 0xffff
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.004021f0
test eax, eax
je 0x402a1d
mov eax, dword [ebp - 0x6f8]
mov esi, str.PassGuard_x64.sys
mov dword [ebp - 0x6f0], 0x70
mov dword [ebp - 0x6ec], esi
cmp eax, 6
ja 0x4029fb
cmp eax, 5
jbe 0x402ebc
cmp dword [ebp - 0x6f4], 3
jbe 0x402ebc
call fcn.004025c0
test al, al
je 0x402ebc
mov dword [ebp - 0x6f0], 0x72
mov dword [ebp - 0x6ec], esi
jmp 0x402ebc
cmp dword [ebp - 0x6f8], 5
jne 0x402aa6
cmp dword [ebp - 0x6f4], 1
jne 0x402aa6
xor eax, eax
mov byte [ebp - 0x6d8], bl
mov word [ebp - 0x6d7], ax
mov byte [ebp - 0x6d5], al
str word [ebp - 0x6d8]
push str._STR_base:_0x
call fcn.0040498d
add esp, 4
xor esi, esi
mov edi, edi
movzx edx, byte [ebp + esi - 0x6d8]
push edx
push str._02x
call fcn.0040498d
inc esi
add esp, 8
cmp esi, 4
jl 0x402a60
cmp byte [ebp - 0x6d8], bl
jne 0x402a99
cmp byte [ebp - 0x6d7], 0x40
jne 0x402a99
mov dword [ebp - 0x6f0], 0x71
jmp 0x402ab0
push 0x413520
call fcn.00402280
add esp, 4
mov dword [ebp - 0x6f0], 0x6f
mov eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x6ec], str.PassGuard.sys
cmp eax, 6
ja 0x402adb
cmp eax, 5
jbe 0x402ebc
cmp dword [ebp - 0x6f4], 3
jbe 0x402ebc
call fcn.004025c0
test al, al
je 0x402ebc
push 0x104
lea eax, [ebp - 0x628]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, 0xf
mov dword [ebp - 0x630], edi
mov dword [ebp - 0x634], ebx
mov byte [ebp - 0x644], bl
lea ecx, [ebp - 0x628]
push ecx
lea eax, [ebp - 0x6d0]
mov dword [ebp - 4], ebx
call fcn.00402300
add esp, 4
mov esi, eax
lea edx, [ebp - 0x644]
mov byte [ebp - 4], 1
lea ebx, [edi + 1]
cmp edx, esi
je 0x402bb4
cmp dword [ebp - 0x630], ebx
jb 0x402b54
mov eax, dword [ebp - 0x644]
push eax
call fcn.00403bf5
add esp, 4
mov dword [ebp - 0x630], edi
mov dword [ebp - 0x634], 0
mov byte [ebp - 0x644], 0
cmp dword [esi + 0x14], ebx
jae 0x402b87
mov eax, dword [esi + 0x10]
inc eax
push eax
lea ecx, [ebp - 0x644]
push esi
push ecx
call fcn.004040f0
add esp, 0xc
jmp 0x402b95
mov edx, dword [esi]
mov dword [ebp - 0x644], edx
mov dword [esi], 0
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x634], eax
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x630], ecx
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], 0
mov byte [esi], 0
mov byte [ebp - 4], 0
cmp dword [ebp - 0x6bc], ebx
jb 0x402bcf
mov edx, dword [ebp - 0x6d0]
push edx
call fcn.00403bf5
add esp, 4
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0x6bc], edi
mov dword [ebp - 0x6c0], 0
mov byte [ebp - 0x6d0], 0
cmp dword [ebp - 0x630], ebx
jae 0x402bfa
lea eax, [ebp - 0x644]
lea ecx, [ebp - 0x6b4]
call fcn.00402380
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x634]
sub eax, dword [ebp - 0x6a4]
lea ecx, [ebp - 0x644]
push eax
push ecx
lea esi, [ebp - 0x67c]
call fcn.00402f80
mov ebx, 9
mov eax, esi
mov byte [ebp - 4], 3
call fcn.00402fd0
push 0x206
xor ebx, ebx
lea eax, [ebp - 0x41e]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x420], dx
call fcn.00404ed0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x402c79
lea eax, [ebp - 0x420]
call fcn.00401ec0
mov eax, str.PassGuard.sys
mov esi, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x402c80
lea edi, [ebp - 0x420]
sub eax, esi
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x402c96
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x420]
and ecx, 3
push edx
lea eax, [ebp - 0x660]
rep movsb byte es:[edi], byte [esi]
call fcn.00402300
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push ebx
mov byte [ebp - 4], 4
push ecx
mov word [ebp - 0x218], ax
call fcn.00404ed0
add esp, 0x10
push 0x104
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x402d05
lea eax, [ebp - 0x218]
call fcn.00401ec0
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x402d10
mov ecx, 9
mov esi, str.PassGuardX.exe.old
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x698]
movsw word es:[edi], word [esi]
call fcn.00402300
mov eax, dword [ebp - 0x660]
mov edi, 0x10
add esp, 4
cmp dword [ebp - 0x64c], edi
jae 0x402d58
lea eax, [ebp - 0x660]
push ebx
push eax
call fcn.00404608
add esp, 8
test eax, eax
jne 0x402dd8
mov eax, dword [ebp - 0x67c]
cmp dword [ebp - 0x668], edi
jae 0x402d7e
lea eax, [ebp - 0x67c]
push 0x413568
push eax
call fcn.00404b06
push eax
call fcn.00404bff
mov ecx, dword [ebp - 0x698]
add esp, 0xc
cmp dword [ebp - 0x684], edi
jae 0x402da6
lea ecx, [ebp - 0x698]
mov eax, dword [ebp - 0x660]
cmp dword [ebp - 0x64c], edi
jae 0x402dba
lea eax, [ebp - 0x660]
push ecx
push eax
call fcn.00403e67
add esp, 8
test eax, eax
jne 0x402dd8
push 4
push ebx
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [ebp - 0x684], edi
jb 0x402def
mov edx, dword [ebp - 0x698]
push edx
call fcn.00403bf5
add esp, 4
mov esi, 0xf
mov byte [ebp - 4], 3
mov dword [ebp - 0x684], esi
mov dword [ebp - 0x688], ebx
mov byte [ebp - 0x698], bl
cmp dword [ebp - 0x64c], edi
jb 0x402e21
mov eax, dword [ebp - 0x660]
push eax
call fcn.00403bf5
add esp, 4
mov byte [ebp - 4], 2
mov dword [ebp - 0x64c], esi
mov dword [ebp - 0x650], ebx
mov byte [ebp - 0x660], bl
cmp dword [ebp - 0x668], edi
jb 0x402e4e
mov ecx, dword [ebp - 0x67c]
push ecx
call fcn.00403bf5
add esp, 4
mov byte [ebp - 4], bl
mov dword [ebp - 0x668], esi
mov dword [ebp - 0x66c], ebx
mov byte [ebp - 0x67c], bl
cmp dword [ebp - 0x6a0], edi
jb 0x402e7a
mov edx, dword [ebp - 0x6b4]
push edx
call fcn.00403bf5
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x6a0], esi
mov dword [ebp - 0x6a4], ebx
mov byte [ebp - 0x6b4], bl
cmp dword [ebp - 0x630], edi
jb 0x402eaa
mov eax, dword [ebp - 0x644]
push eax
call fcn.00403bf5
add esp, 4
mov dword [ebp - 0x630], esi
mov dword [ebp - 0x634], ebx
mov byte [ebp - 0x644], bl
movzx ecx, word [ebp - 0x6f0]
mov edx, dword [ebp - 0x6ec]
call fcn.00401f50
test al, al
je 0x402ee6
mov ecx, 0x416220
call fcn.004016e0
mov ecx, 0x416220
call fcn.00401900
mov ebx, dword [ebp - 0x700]
inc ebx
mov dword [ebp - 0x700], ebx
cmp ebx, dword [ebp + 8]
jl 0x402783
mov eax, dword [0x4174ac]
mov esi, dword [ebp - 0x6e4]
test eax, eax
jne 0x402f2b
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4174ac], eax
test eax, eax
je 0x402f2e
push esi
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403c00
mov esp, ebp
pop ebp
ret