Function at 0x42a680
Capabilities:
Query or enumerate registry value
Query service status

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4afcb3
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x140
mov eax, dword [0x4de080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
push 0x14
push str.MBAMInstallerService
lea ecx, [ebp - 0x150]
movq qword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x150], xmm0
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0
call fcn.0040df90
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x138]
push 0xb
xorps xmm0, xmm0
mov dword [ebp - 0x128], 0
push str.MBAMService
movups xmmword [ebp - 0x138], xmm0
mov dword [ebp - 0x124], 0
call fcn.0040df90
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x120]
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x110], 0
push str.MBAMProtection
movups xmmword [ebp - 0x120], xmm0
mov dword [ebp - 0x10c], 0
call fcn.0040df90
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x108]
push 0x11
xorps xmm0, xmm0
mov dword [ebp - 0xf8], 0
push str.MBAMWebProtection
movups xmmword [ebp - 0x108], xmm0
mov dword [ebp - 0xf4], 0
call fcn.0040df90
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xf0]
push 0xa
xorps xmm0, xmm0
mov dword [ebp - 0xe0], 0
push str.MBAMFarflt
movups xmmword [ebp - 0xf0], xmm0
mov dword [ebp - 0xdc], 0
call fcn.0040df90
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xd8]
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 0xc8], 0
push str.MBAMChameleon
movups xmmword [ebp - 0xd8], xmm0
mov dword [ebp - 0xc4], 0
call fcn.0040df90
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xc0]
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 0xb0], 0
push str.MBAMSwissArmy
movups xmmword [ebp - 0xc0], xmm0
mov dword [ebp - 0xac], 0
call fcn.0040df90
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa8]
push 8
xorps xmm0, xmm0
mov dword [ebp - 0x98], 0
push str.MBAMElam
movups xmmword [ebp - 0xa8], xmm0
mov dword [ebp - 0x94], 0
call fcn.0040df90
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x90]
push 0x12
xorps xmm0, xmm0
mov dword [ebp - 0x80], 0
push str.ESProtectionDriver
movups xmmword [ebp - 0x90], xmm0
mov dword [ebp - 0x7c], 0
call fcn.0040df90
lea ecx, [ebp - 0x150]
mov dword [ebp - 4], 8
push ecx
lea eax, [ebp - 0x78]
push eax
push ecx
lea ecx, [ebp - 0x40]
call fcn.0043ce70
push fcn.00406550
push 9
push 0x18
lea eax, [ebp - 0x150]
mov byte [ebp - 4], 0xa
push eax
call fcn.004837af
push 0x20000004
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x48], edi
mov byte [ebp - 4], 0xb
test edi, edi
jne 0x42a9a1
lea ecx, [ebp - 0x30]
call fcn.00467c30
mov byte [ebp - 4], 0xc
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42a905
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e14e8
call fcn.00412510
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411040
mov edx, 0x4c14f8
mov ecx, eax
call fcn.00411040
push 0x3e3
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_OpenSCManager_failed:
mov ecx, eax
call fcn.00411040
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0041b4e0
push eax
call fcn.004113c0
mov ecx, dword [ebp - 0x1c]
add esp, 4
cmp ecx, 7
jbe 0x42a998
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42a98e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42adfd
push ecx
push edx
call fcn.0048355d
add esp, 8
mov byte [ebp - 0x71], 0
jmp 0x42ab47
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x78], eax
cmp esi, eax
je 0x42ab3c
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x42a9bf
mov eax, dword [esi]
push 5
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x34], esi
mov byte [ebp - 4], 0xd
test esi, esi
jne 0x42a9dc
mov byte [ebp - 4], 0xb
jmp 0x42aa28
lea eax, [ebp - 0x18]
mov dword [ebp - 0x4c], 0
push eax
push 0x24
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x18], 0
push eax
xorps xmm0, xmm0
push 0
push esi
movups xmmword [ebp - 0x6c], xmm0
movups xmmword [ebp - 0x5c], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x42ac3f
cmp dword [ebp - 0x60], 0x430
je 0x42ab70
push esi
mov byte [ebp - 4], 0xb
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x70]
add esi, 0x18
mov dword [ebp - 0x70], esi
cmp esi, dword [ebp - 0x78]
jne 0x42a9b5
mov eax, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x40]
mov dword [ebp - 0x78], eax
cmp esi, eax
je 0x42ab3c
nop dword [eax + eax]
push 0x22
xorps xmm0, xmm0
mov dword [ebp - 0x70], 0
push str.SYSTEMCurrentControlSetServices_
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x20], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x1c], 0
call fcn.0040df90
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x10
call fcn.0040dab0
cmp dword [ebp - 0x1c], 7
lea ecx, [ebp - 0x70]
push ecx
push 0x20019
lea eax, [ebp - 0x30]
cmova eax, dword [ebp - 0x30]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42aaf2
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34], 4
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x44], 4
push eax
push 0
push str.DeleteFlag
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42aae9
cmp dword [ebp - 0x18], 1
je 0x42acfb
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x42ab30
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42ab26
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42adfd
push ecx
push edx
call fcn.0048355d
add esp, 8
add esi, 0x18
cmp esi, dword [ebp - 0x78]
jne 0x42aa50
mov byte [ebp - 0x71], 0
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [ebp - 0x40]
call fcn.0043fc00
mov al, byte [ebp - 0x71]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00483226
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea ecx, [ebp - 0x30]
call fcn.00467c30
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42ab87
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e14e8
call fcn.00412510
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411040
mov edx, 0x4c14f8
mov ecx, eax
call fcn.00411040
push 0x3fb
mov ecx, eax
call fcn.0040f7e0
mov edx, 0x4c1738
mov ecx, eax
call fcn.00411040
mov edx, dword [ebp - 0x70]
cmp dword [edx + 0x14], 7
mov ecx, dword [edx + 0x10]
jbe 0x42abd5
mov edx, dword [edx]
push ecx
mov ecx, eax
call fcn.00412510
add esp, 4
mov edx, str._marked_for_deletion
mov ecx, eax
call fcn.00411040
push eax
call fcn.004113c0
mov ecx, dword [ebp - 0x1c]
add esp, 4
cmp ecx, 7
jbe 0x42ac2f
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42ac25
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ae02
push ecx
push edx
call fcn.0048355d
add esp, 8
push esi
mov byte [ebp - 0x71], 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x42ab40
lea ecx, [ebp - 0x30]
call fcn.00467c30
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42ac56
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e14e8
call fcn.00412510
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411040
mov edx, 0x4c14f8
mov ecx, eax
call fcn.00411040
push 0x3f5
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_QueryServiceStatusEx_failed:
mov ecx, eax
call fcn.00411040
mov dword [ebp - 0x78], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x78]
push eax
call fcn.0041b4e0
push eax
call fcn.004113c0
mov ecx, dword [ebp - 0x1c]
add esp, 4
cmp ecx, 7
jbe 0x42aceb
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42ace1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ae07
push ecx
push edx
call fcn.0048355d
add esp, 8
push esi
mov byte [ebp - 0x71], 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x42ab40
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x60]
call fcn.00467c30
mov byte [ebp - 4], 0x11
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42ad1b
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4e14e8
call fcn.00412510
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411040
mov edx, 0x4c14f8
mov ecx, eax
call fcn.00411040
push 0x413
mov ecx, eax
call fcn.0040f7e0
mov edx, 0x4c1738
mov ecx, eax
call fcn.00411040
cmp dword [esi + 0x14], 7
mov ecx, dword [esi + 0x10]
jbe 0x42ad66
mov esi, dword [esi]
push ecx
mov edx, esi
mov ecx, eax
call fcn.00412510
add esp, 4
mov edx, str._marked_for_deletion
mov ecx, eax
call fcn.00411040
push eax
call fcn.004113c0
mov ecx, dword [ebp - 0x4c]
add esp, 4
cmp ecx, 7
jbe 0x42adbe
mov edx, dword [ebp - 0x60]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42adb4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ae0c
push ecx
push edx
call fcn.0048355d
add esp, 8
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x42adf4
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42adea
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ae11
push ecx
push edx
call fcn.0048355d
add esp, 8
mov byte [ebp - 0x71], 1
jmp 0x42ab40
call fcn.0048878f
call fcn.0048878f
call fcn.0048878f
call fcn.0048878f
call fcn.0048878f
int3