Function at 0x4154d0
Capabilities:
Enumerate services
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x228
mov eax, dword [0x436090]
push ebp
push esi
push edi
xor edi, edi
push 4
push edi
push edi
mov dword [esp + 0x23c], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
cmp ebp, edi
jne 0x41551b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x41558d
call esi
mov esi, eax
cmp esi, edi
jne 0x4156ce
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
push edi
push edi
push 3
push 0x30
push ebp
call ebx
mov esi, eax
test esi, esi
jne 0x4155bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x4155a1
test edi, edi
je 0x41555a
push edi
call fcn.00423699
add esp, 4
mov esi, dword [esp + 0x1c]
push esi
call fcn.00423687
mov edi, eax
add esp, 4
test edi, edi
je 0x415597
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
push esi
push edi
push 3
push 0x30
push ebp
call ebx
mov esi, eax
test esi, esi
je 0x415540
jmp 0x4155bd
mov esi, 0xffffe5d4
jmp 0x4156ce
mov esi, 0xfffefffd
jmp 0x4156cd
test esi, esi
jne 0x4155bd
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x41560a
call esi
mov esi, eax
test esi, esi
jne 0x4156cd
mov eax, dword [esp + 0x18]
xor esi, esi
test eax, eax
jbe 0x41560a
mov ebx, edi
lea esp, [esp]
mov eax, dword [ebx]
push str.SharedAccess
push eax
call fcn.00424746
add esp, 8
test eax, eax
je 0x4155fa
mov eax, dword [esp + 0x18]
inc esi
add ebx, 0x24
cmp esi, eax
jb 0x4155d0
mov esi, 0xffffe5d4
jmp 0x4156cd
lea ecx, [esi + esi*8]
mov eax, dword [edi + ecx*4 + 0xc]
mov ebx, 4
cmp eax, ebx
je 0x415614
mov esi, 0xffffe5d4
jmp 0x4156cd
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREApple_Computer__Inc.Bonjour
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, eax
test esi, esi
jne 0x4156cd
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x30]
push edx
push esi
push str.ManageFirewall
push eax
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x415665
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4156cd
push 0x208
lea ecx, [esp + 0x30]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
ja 0x415693
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x41570d
call esi
mov esi, eax
test esi, esi
jne 0x4156cd
lea edx, [esp + 0x2c]
push 0x42fe8c
push edx
call fcn.00406530
mov esi, eax
add esp, 8
test esi, esi
jne 0x4156cd
mov ecx, dword [esp + 0x10]
push ebx
lea eax, [esp + 0x18]
push eax
push ebx
push esi
push str.ManageFirewall
push ecx
mov dword [esp + 0x2c], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
pop ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4156dd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4156ea
push edi
call fcn.00423699
add esp, 4
test ebp, ebp
je 0x4156f5
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [esp + 0x230]
pop edi
mov eax, esi
pop esi
pop ebp
call fcn.0042373b
add esp, 0x228
ret
mov esi, 0xffffe5d0
jmp 0x4156cd