Function at 0x402442
Capabilities:
Enumerate services
Get file size
Manipulate console buffer
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x106c
call fcn.00416ff0
mov eax, dword [0x42635c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, dword [0x4e41278]
xorps xmm0, xmm0
xor edx, edx
mov dword [ebp - 0x103c], edi
movlpd qword [0x4e36340], xmm0
mov eax, dword [edi]
mov ebx, dword [edi + 4]
mov dword [ebp - 0x1038], eax
mov eax, dword [esi]
mov dword [ebp - 0x1054], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x1050], eax
cmp ecx, 0xdce
jne 0x4024cb
lea eax, [ebp - 0x1044]
push eax
lea eax, [ebp - 0x1030]
push eax
lea eax, [ebp - 0x1034]
push eax
push edx
lea eax, [ebp - 0x102c]
push eax
push edx
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
mov ecx, dword [0x4e41278]
xor edx, edx
mov eax, dword [esi + 8]
mov dword [ebp - 0x1034], eax
cmp ecx, 0xe8d
jne 0x4024ef
push edx
call dword [sym.imp.KERNEL32.DLL_DeleteTimerQueue]
mov ecx, dword [0x4e41278]
mov eax, dword [ebp - 0x1034]
mov edx, dword [esi + 0xc]
mov edi, 0xc6ef3720
mov dword [ebp - 0x1044], edx
mov edx, dword [ebp - 0x1038]
mov dword [ebp - 0x1048], 0x20
and dword [ebp - 0x1030], 0
mov esi, edx
shl esi, 4
add esi, eax
mov eax, dword [0x4e38944]
cmp ecx, 0x3df
cmove eax, dword [ebp - 0x1030]
mov dword [0x4e38944], eax
lea eax, [edi + edx]
mov dword [ebp - 0x1030], eax
cmp ecx, 0x645
jne 0x40256f
lea eax, [ebp - 0x105c]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
lea eax, [ebp - 0x1060]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
mov ecx, dword [0x4e41278]
mov edx, dword [ebp - 0x1038]
mov eax, edx
shr eax, 5
add eax, dword [ebp - 0x1044]
xor eax, dword [ebp - 0x1030]
xor eax, esi
sub ebx, eax
mov esi, ebx
shl esi, 4
cmp ecx, 0x493
jne 0x4025dd
lea eax, [ebp - 0x1020]
push eax
call dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStructA]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_UpdateResourceW]
push 0
lea eax, [ebp - 0x104c]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedExchangeAdd]
push 0
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.DLL_GetConsoleAliasExesW]
mov ecx, dword [0x4e41278]
add esi, dword [ebp - 0x1054]
mov dword [ebp - 0x1030], esi
cmp ecx, 0xc58
jne 0x40260e
lea eax, [ebp - 0x1068]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
push 0
call dword [sym.imp.KERNEL32.DLL_GetThreadPriority]
mov ecx, dword [0x4e41278]
mov esi, ebx
shr esi, 5
cmp ecx, 0x21a
jne 0x40263e
push dword [ebp - 0x104c]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_EnumTimeFormatsW]
mov ecx, dword [0x4e41278]
add esi, dword [ebp - 0x1050]
cmp ecx, 0x722
jne 0x40265f
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileWithProgressW]
mov ecx, dword [0x4e41278]
mov edx, dword [ebp - 0x1038]
lea eax, [edi + ebx]
xor esi, eax
add edi, 0x61c88647
xor esi, dword [ebp - 0x1030]
sub edx, esi
xor esi, esi
mov dword [ebp - 0x1038], edx
cmp ecx, 0xe8d
jne 0x4026d9
lea eax, [ebp - 0x101c]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetCPInfo]
push esi
push esi
lea eax, [ebp - 0x808]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_FormatMessageW]
xor eax, eax
mov dword [ebp - 0x1040], eax
lea eax, [ebp - 0x1058]
push eax
push dword [ebp - 0x1040]
lea eax, [ebp - 0xc08]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_ReadConsoleOutputCharacterA]
mov ecx, dword [0x4e41278]
mov edx, dword [ebp - 0x1038]
dec dword [ebp - 0x1048]
mov eax, dword [ebp - 0x1034]
jne 0x40250d
mov edi, dword [ebp - 0x103c]
xorps xmm0, xmm0
movlpd qword [0x4e38950], xmm0
mov dword [edi], edx
cmp dword [0x4e41278], 0xc02
jne 0x402728
xor eax, eax
mov dword [ebp - 0x1034], eax
lea eax, [ebp - 0x1058]
push eax
push dword [ebp - 0x1034]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_WriteConsoleOutputCharacterA]
mov dword [edi + 4], ebx
cmp dword [0x4e41278], 0x9aa
jne 0x402756
push esi
push esi
push esi
lea eax, [ebp - 0x103c]
mov dword [ebp - 0x103c], esi
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
call dword [sym.imp.KERNEL32.DLL_CreateTimerQueue]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040526a
mov esp, ebp
pop ebp
ret