Function at 0x42a840
Capabilities:
Query or enumerate registry value
Query service status

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bcf73
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x140
mov eax, dword [0x50b080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
push 0x14
push str.MBAMInstallerService
lea ecx, [ebp - 0x150]
movq qword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x150], xmm0
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0
call fcn.0040df90
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x138]
push 0xb
xorps xmm0, xmm0
mov dword [ebp - 0x128], 0
push str.MBAMService
movups xmmword [ebp - 0x138], xmm0
mov dword [ebp - 0x124], 0
call fcn.0040df90
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x120]
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x110], 0
push str.MBAMProtection
movups xmmword [ebp - 0x120], xmm0
mov dword [ebp - 0x10c], 0
call fcn.0040df90
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x108]
push 0x11
xorps xmm0, xmm0
mov dword [ebp - 0xf8], 0
push str.MBAMWebProtection
movups xmmword [ebp - 0x108], xmm0
mov dword [ebp - 0xf4], 0
call fcn.0040df90
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xf0]
push 0xa
xorps xmm0, xmm0
mov dword [ebp - 0xe0], 0
push str.MBAMFarflt
movups xmmword [ebp - 0xf0], xmm0
mov dword [ebp - 0xdc], 0
call fcn.0040df90
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xd8]
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 0xc8], 0
push str.MBAMChameleon
movups xmmword [ebp - 0xd8], xmm0
mov dword [ebp - 0xc4], 0
call fcn.0040df90
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xc0]
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 0xb0], 0
push str.MBAMSwissArmy
movups xmmword [ebp - 0xc0], xmm0
mov dword [ebp - 0xac], 0
call fcn.0040df90
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa8]
push 8
xorps xmm0, xmm0
mov dword [ebp - 0x98], 0
push str.MBAMElam
movups xmmword [ebp - 0xa8], xmm0
mov dword [ebp - 0x94], 0
call fcn.0040df90
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x90]
push 0x12
xorps xmm0, xmm0
mov dword [ebp - 0x80], 0
push str.ESProtectionDriver
movups xmmword [ebp - 0x90], xmm0
mov dword [ebp - 0x7c], 0
call fcn.0040df90
lea ecx, [ebp - 0x150]
mov dword [ebp - 4], 8
push ecx
lea eax, [ebp - 0x78]
push eax
push ecx
lea ecx, [ebp - 0x40]
call fcn.0043d1f0
push fcn.00406550
push 9
push 0x18
lea eax, [ebp - 0x150]
mov byte [ebp - 4], 0xa
push eax
call fcn.0049091f
push 0x20000004
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x48], edi
mov byte [ebp - 4], 0xb
test edi, edi
jne 0x42ab61
lea ecx, [ebp - 0x30]
call fcn.00467d30
mov byte [ebp - 4], 0xc
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42aac5
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x3e6
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_OpenSCManager_failed:
mov ecx, eax
call fcn.00411050
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0041b670
push eax
call fcn.004113d0
mov ecx, dword [ebp - 0x1c]
add esp, 4
cmp ecx, 7
jbe 0x42ab58
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42ab4e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42afbd
push ecx
push edx
call fcn.004906cd
add esp, 8
mov byte [ebp - 0x71], 0
jmp 0x42ad07
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x78], eax
cmp esi, eax
je 0x42acfc
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x42ab7f
mov eax, dword [esi]
push 5
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x34], esi
mov byte [ebp - 4], 0xd
test esi, esi
jne 0x42ab9c
mov byte [ebp - 4], 0xb
jmp 0x42abe8
lea eax, [ebp - 0x18]
mov dword [ebp - 0x4c], 0
push eax
push 0x24
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x18], 0
push eax
xorps xmm0, xmm0
push 0
push esi
movups xmmword [ebp - 0x6c], xmm0
movups xmmword [ebp - 0x5c], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x42adff
cmp dword [ebp - 0x60], 0x430
je 0x42ad30
push esi
mov byte [ebp - 4], 0xb
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x70]
add esi, 0x18
mov dword [ebp - 0x70], esi
cmp esi, dword [ebp - 0x78]
jne 0x42ab75
mov eax, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x40]
mov dword [ebp - 0x78], eax
cmp esi, eax
je 0x42acfc
nop dword [eax + eax]
push 0x22
xorps xmm0, xmm0
mov dword [ebp - 0x70], 0
push str.SYSTEMCurrentControlSetServices_
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x20], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x1c], 0
call fcn.0040df90
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x10
call fcn.0040dab0
cmp dword [ebp - 0x1c], 7
lea ecx, [ebp - 0x70]
push ecx
push 0x20019
lea eax, [ebp - 0x30]
cmova eax, dword [ebp - 0x30]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42acb2
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34], 4
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x44], 4
push eax
push 0
push str.DeleteFlag
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42aca9
cmp dword [ebp - 0x18], 1
je 0x42aebb
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x42acf0
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42ace6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42afbd
push ecx
push edx
call fcn.004906cd
add esp, 8
add esi, 0x18
cmp esi, dword [ebp - 0x78]
jne 0x42ac10
mov byte [ebp - 0x71], 0
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [ebp - 0x40]
call fcn.0043ff80
mov al, byte [ebp - 0x71]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00490396
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea ecx, [ebp - 0x30]
call fcn.00467d30
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42ad47
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x3fe
mov ecx, eax
call fcn.0040f7e0
mov edx, 0x4eb7a8
mov ecx, eax
call fcn.00411050
mov edx, dword [ebp - 0x70]
cmp dword [edx + 0x14], 7
mov ecx, dword [edx + 0x10]
jbe 0x42ad95
mov edx, dword [edx]
push ecx
mov ecx, eax
call fcn.00412550
add esp, 4
mov edx, str._marked_for_deletion
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov ecx, dword [ebp - 0x1c]
add esp, 4
cmp ecx, 7
jbe 0x42adef
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42ade5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42afc2
push ecx
push edx
call fcn.004906cd
add esp, 8
push esi
mov byte [ebp - 0x71], 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x42ad00
lea ecx, [ebp - 0x30]
call fcn.00467d30
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42ae16
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x3f8
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_QueryServiceStatusEx_failed:
mov ecx, eax
call fcn.00411050
mov dword [ebp - 0x78], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x78]
push eax
call fcn.0041b670
push eax
call fcn.004113d0
mov ecx, dword [ebp - 0x1c]
add esp, 4
cmp ecx, 7
jbe 0x42aeab
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42aea1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42afc7
push ecx
push edx
call fcn.004906cd
add esp, 8
push esi
mov byte [ebp - 0x71], 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x42ad00
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x60]
call fcn.00467d30
mov byte [ebp - 4], 0x11
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42aedb
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x416
mov ecx, eax
call fcn.0040f7e0
mov edx, 0x4eb7a8
mov ecx, eax
call fcn.00411050
cmp dword [esi + 0x14], 7
mov ecx, dword [esi + 0x10]
jbe 0x42af26
mov esi, dword [esi]
push ecx
mov edx, esi
mov ecx, eax
call fcn.00412550
add esp, 4
mov edx, str._marked_for_deletion
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov ecx, dword [ebp - 0x4c]
add esp, 4
cmp ecx, 7
jbe 0x42af7e
mov edx, dword [ebp - 0x60]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42af74
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42afcc
push ecx
push edx
call fcn.004906cd
add esp, 8
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x42afb4
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42afaa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42afd1
push ecx
push edx
call fcn.004906cd
add esp, 8
mov byte [ebp - 0x71], 1
jmp 0x42ad00
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
call fcn.004958ff
int3