Function at 0x40cf90
Capabilities:
Modify service
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x424284]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x228], eax
mov edi, 0x4201bc
mov dword [ebp - 0x214], ebx
test esi, esi
je 0x40d443
cmp word [esi], bx
je 0x40d443
lea eax, [ebx + 5]
call fcn.0040c9c0
mov dword [ebp - 0x218], eax
test eax, eax
jne 0x40d00b
push 0x400001fb
call fcn.004147fb
add eax, 0x40
push eax
call fcn.00402220
add esp, 8
pop edi
pop esi
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
movzx ecx, word [esi]
xor ebx, ebx
mov dword [ebp - 0x208], ebx
mov eax, esi
test cx, cx
je 0x40d236
inc dword [ebp - 0x214]
cmp cx, 0x2b
jne 0x40d037
mov dword [ebp - 0x208], eax
mov ebx, eax
jmp 0x40d040
test cx, cx
je 0x40d049
lea esp, [esp]
add eax, 2
cmp word [eax], 0
jne 0x40d040
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x40d021
test ebx, ebx
je 0x40d236
lea ecx, [ebp - 0x20c]
push ecx
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlServiceGroupOrder
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40d0be
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.00402080
push eax
push str.SYSTEMCurrentControlSetControlServiceGroupOrder
push str._s:__s_n
call fcn.004147fb
add eax, 0x40
push eax
call fcn.00414cb9
add esp, 0x10
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x20c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 0x21c]
push edx
push 0
lea eax, [ebp - 0x224]
push eax
push 0
push str.List
push ecx
call edi
test eax, eax
jne 0x40d1cd
mov edx, dword [ebp - 0x21c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edx
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x208], eax
test eax, eax
jne 0x40d143
push str.set_service_dependencies__
push str.groups
push 0xc00001fa
call fcn.004147fb
add eax, 0x40
push eax
call fcn.00402220
add esp, 0x10
pop edi
pop esi
mov eax, 3
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x21c]
push ecx
push eax
mov eax, dword [ebp - 0x20c]
lea edx, [ebp - 0x224]
push edx
push 0
push str.List
push eax
call edi
test eax, eax
je 0x40d223
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.00402080
push eax
push str.List
push str.SYSTEMCurrentControlSetControlServiceGroupOrder
push str._s_s:__s
call fcn.004147fb
add eax, 0x40
push eax
call fcn.00414cb9
mov ecx, dword [ebp - 0x208]
add esp, 0x14
push ecx
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 4
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
cmp eax, 2
je 0x40d229
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.00402080
push eax
push str.List
push str.SYSTEMCurrentControlSetControlServiceGroupOrder
push str._s_s:__s
call fcn.004147fb
add eax, 0x40
push eax
call fcn.00414cb9
mov eax, dword [ebp - 0x20c]
add esp, 0x14
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 4
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x208]
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x214]
shl edx, 9
add edx, 4
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x220], 0
cmp word [esi], 0
je 0x40d416
cmp word [esi], 0x2b
jne 0x40d357
cmp word [esi + 2], 0
lea edi, [esi + 2]
je 0x40d2b8
cmp word [ebx], 0
je 0x40d2b8
call fcn.004080a0
test eax, eax
jne 0x40d318
cmp word [ebx], ax
je 0x40d2a9
jmp 0x40d2a0
add ebx, 2
cmp word [ebx], 0
jne 0x40d2a0
add ebx, 2
cmp word [ebx], 0
jne 0x40d286
mov ebx, dword [ebp - 0x208]
mov edx, dword [ebp - 0x210]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call edi
test ebx, ebx
je 0x40d2e0
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov edi, 0x433
call fcn.00402080
push eax
push esi
push str._s:__s
call fcn.004147fb
add eax, 0x40
push eax
call fcn.00414cb9
add esp, 0x10
pop edi
pop esi
mov eax, 5
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
mov eax, ebx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d320
sub eax, edx
sar eax, 1
add eax, eax
push eax
push ebx
push edi
call fcn.00414290
push esi
push 0x4200a8
push 0xffffffffffffffff
lea ecx, [ebp - 0x204]
push 0x100
push ecx
call fcn.004149b0
add esp, 0x20
jmp 0x40d379
mov eax, dword [ebp - 0x218]
push 0x100
lea edx, [ebp - 0x204]
push edx
push 4
push esi
push eax
call fcn.0040c9f0
add esp, 0x14
test eax, eax
je 0x40d3dc
lea eax, [ebp - 0x204]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d382
mov ebx, dword [ebp - 0x220]
sub eax, edx
sar eax, 1
lea edi, [eax + 1]
mov eax, dword [ebp - 0x210]
lea ecx, [edi + edi]
push ecx
lea edx, [ebp - 0x204]
push edx
lea ecx, [eax + ebx*2]
push ecx
call fcn.00414290
add ebx, edi
add esp, 0xc
cmp word [esi], 0
mov dword [ebp - 0x220], ebx
je 0x40d3ce
add esi, 2
cmp word [esi], 0
jne 0x40d3c5
mov ebx, dword [ebp - 0x208]
add esi, 2
jmp 0x40d262
mov eax, dword [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call edi
test ebx, ebx
je 0x40d404
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40d2e0
test ebx, ebx
je 0x40d42a
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [ebp - 0x210]
mov ebx, dword [ebp - 0x214]
mov eax, dword [ebp - 0x228]
push 0
push 0
push 0
push edi
push 0
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x40d4b2
test ebx, ebx
je 0x40d47a
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.00402080
push eax
push 0x4000020b
call fcn.004147fb
add eax, 0x40
push eax
call fcn.00402220
add esp, 0xc
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x40d4c6
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0041427b
mov esp, ebp
pop ebp
ret