Function at 0x407820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
mov eax, dword [0x41403c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 1
je 0x407857
cmp dword [ebp - 0x28c], 2
je 0x407c1d
jmp 0x407d35
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x288]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str..sys
lea eax, [ebp - 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x4272d4
push 4
push str._r_n_r_n
mov ecx, dword [0x416b74]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp + 0x10]
push edx
push str.__s.AddReg__r_n
push 0xfe
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x10
push 0
push 0x4272d4
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea edx, [ebp - 0x208]
push edx
mov eax, dword [0x416b74]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x10]
push ecx
push str.HKLM___Services___s_SysprepCleanup_0x00010001_1_r_n
push 0xfe
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x10
push 0
push 0x4272d4
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [0x416b74]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x4272d0
push 0xfe
lea eax, [ebp - 0x108]
push eax
push str.ErrorControl
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
call dword [sym.imp.SETUPAPI.dll_SetupGetLineTextA]
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push str.HKLM___Services___s_ErrorControl_0x00010001__s_r_n
push 0xfe
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
push 0
push 0x4272d4
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [0x416b74]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x4272d0
push 0xfe
lea eax, [ebp - 0x108]
push eax
push str.StartType
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
call dword [sym.imp.SETUPAPI.dll_SetupGetLineTextA]
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push str.HKLM___Services___s_Start_0x00010001__s_r_n
push 0xfe
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
push 0
push 0x4272d4
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [0x416b74]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x4272d0
push 0xfe
lea eax, [ebp - 0x108]
push eax
push str.ServiceType
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
call dword [sym.imp.SETUPAPI.dll_SetupGetLineTextA]
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push str.HKLM___Services___s_Type_0x00010001__s_r_n
push 0xfe
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
push 0
push 0x4272d4
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [0x416b74]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x4272d0
push 0xfe
lea eax, [ebp - 0x108]
push eax
push str.LoadOrderGroup
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
call dword [sym.imp.SETUPAPI.dll_SetupGetLineTextA]
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push str.HKLM___Services___s_Group____s__r_n
push 0xfe
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
push 0
push 0x4272d4
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [0x416b74]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x4272d0
push 0xfe
lea eax, [ebp - 0x108]
push eax
push str.DisplayName
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
call dword [sym.imp.SETUPAPI.dll_SetupGetLineTextA]
test eax, eax
je 0x407ba4
movzx eax, byte [0x4272c4]
test eax, eax
je 0x407b56
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 0x10]
push eax
push str.HKLM___Services___s_DisplayName____s___s___r_n
push 0xfe
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x18
jmp 0x407b7b
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 0x10]
push eax
push str.HKLM___Services___s_DisplayName____s__r_n
push 0xfe
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
push 0
push 0x4272d4
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [0x416b74]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x4272d0
push 0xfe
lea edx, [ebp - 0x108]
push edx
push str.ServiceBinary
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.SETUPAPI.dll_SetupGetLineTextA]
lea edx, [ebp - 0x288]
push edx
mov eax, dword [ebp + 0x10]
push eax
push str.HKLM___Services___s_ImagePath_0x00020000__System32DRIVERS_s__r_n
push 0xfe
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
push 0
push 0x4272d4
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [0x416b74]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x407d35
mov edx, dword [ebp + 0x18]
push edx
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 4
push str.PCI_
lea ecx, [ebp - 0x248]
push ecx
call fcn.00401373
add esp, 0xc
test eax, eax
jne 0x407c51
mov byte [ebp - 0x245], 0x23
jmp 0x407c72
push 5
push str.SCSI_
lea edx, [ebp - 0x248]
push edx
call fcn.00401373
add esp, 0xc
test eax, eax
jne 0x407c72
mov byte [ebp - 0x244], 0x23
push 0x4272d0
push 0x40
lea eax, [ebp - 0x108]
push eax
push str.ClassGUID
push str.Version
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.SETUPAPI.dll_SetupGetLineTextA]
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x248]
push eax
push str.HKLM___CriticalDatabase___s_ClassGUID____s__r_n
push 0xfe
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
push 0
push 0x4272d4
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [0x416b74]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x248]
push eax
push str.HKLM___CriticalDatabase___s_Service____s__r_n
push 0xfe
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
push 0
push 0x4272d4
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [0x416b74]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401035
mov esp, ebp
pop ebp
ret 0x14