Function at 0x41b348
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
sub esp, 0xee0
lea ebp, [esp - 4]
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0xee0], eax
push 0x24
mov eax, 0x4bdc6e
call fcn.004603b7
mov edi, ecx
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp + 0xddd]
push ebx
push eax
mov byte [ebp + 0xddc], bl
call fcn.0045fa70
push esi
lea eax, [ebp + 0xcd9]
push ebx
push eax
mov byte [ebp + 0xcd8], bl
call fcn.0045fa70
mov esi, 0x206
push esi
lea eax, [ebp + 0x6c2]
push ebx
push eax
mov word [ebp + 0x6c0], bx
call fcn.0045fa70
push esi
lea eax, [ebp + 0x2b2]
push ebx
push eax
mov word [ebp + 0x2b0], bx
call fcn.0045fa70
push esi
lea eax, [ebp + 0x4ba]
push ebx
push eax
mov word [ebp + 0x4b8], bx
call fcn.0045fa70
add esp, 0x3c
lea ecx, [ebp]
call fcn.004281cf
lea eax, [ebp + 0x6c0]
push eax
lea ecx, [ebp]
mov dword [ebp - 4], ebx
call fcn.004295df
lea eax, [ebp + 0xddc]
push eax
lea eax, [ebp + 0x6c0]
push eax
call fcn.0042c364
push str.smartcloud_service_name
lea eax, [ebp + 0xddc]
push eax
lea eax, [ebp + 0xcd8]
push 0x4c870c
push eax
call fcn.0045f97d
add esp, 0x18
lea eax, [ebp + 0xcd8]
push eax
lea ecx, [ebp + 0x294]
call fcn.004010c0
lea eax, [ebp + 0x294]
push eax
lea ecx, [ebp + 0x20c]
mov byte [ebp - 4], 1
call fcn.0042f72a
push ebx
push 1
lea ecx, [ebp + 0x294]
mov byte [ebp - 4], bl
call fcn.004012b0
lea eax, [ebp + 0x294]
push eax
lea ecx, [ebp + 0x20c]
call fcn.0042f832
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 2
jb 0x41b48b
mov eax, dword [eax + 4]
jmp 0x41b48e
add eax, 4
lea ecx, [ebp + 0x2b0]
push ecx
push eax
call fcn.0042c33b
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp + 0x294]
call fcn.004012b0
lea eax, [ebp + 0x2b0]
push eax
mov ecx, edi
call fcn.0041a881
lea eax, [ebp + 0x4b8]
push eax
push str.ServiceName
mov ecx, edi
call fcn.0041a8ef
lea eax, [ebp + 0x4b8]
push eax
mov ecx, edi
call fcn.0041a881
lea eax, [ebp - 0x10]
push eax
push 9
push ebx
push str.SYSTEMCurrentControlSet_services_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x41b529
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.004091bd
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xee0]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0xee4
leave
ret
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
push 0x4df45c
lea ecx, [ebp + 0x278]
mov byte [ebp - 4], 3
call fcn.00401130
push esi
lea eax, [ebp + 0x8ca]
push ebx
push eax
mov byte [ebp - 4], 4
mov word [ebp + 0x8c8], bx
call fcn.0045fa70
push esi
lea eax, [ebp + 0xad2]
push ebx
push eax
mov word [ebp + 0xad0], bx
call fcn.0045fa70
lea eax, [ebp + 0x8c8]
push str.smartcloudpyime
push eax
call fcn.0045fd44
lea eax, [ebp + 0x8c8]
push eax
call fcn.0045fe9a
add esp, 0x24
cmp eax, 3
jae 0x41b5c8
push ebx
push str.UnInstallService
push str.MoreName_is_Empty_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
xor ebx, ebx
inc ebx
push ebx
lea ecx, [ebp + 0x278]
call fcn.00401330
lea ecx, [ebp - 0x28]
call fcn.00416045
jmp 0x41b4f8
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x104
push edi
lea eax, [ebp + 0xad0]
push eax
mov dword [ebp - 0x14], ebx
push ebx
jmp 0x41b64c
lea eax, [ebp + 0xad0]
push eax
lea ecx, [ebp + 0x294]
call fcn.00401130
lea eax, [ebp + 0xad0]
push eax
mov byte [ebp - 4], 5
call fcn.004608cd
lea eax, [ebp + 0x8c8]
push eax
lea eax, [ebp + 0xad0]
push eax
call fcn.00460605
add esp, 0xc
cmp eax, ebx
je 0x41b62c
lea eax, [ebp + 0x294]
push eax
lea ecx, [ebp - 0x28]
call fcn.00416734
push ebx
push 1
lea ecx, [ebp + 0x294]
mov byte [ebp - 4], 4
call fcn.00401330
inc dword [ebp - 0x14]
push edi
lea eax, [ebp + 0xad0]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x41b5e1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x18]
call fcn.004053da
jmp 0x41b6e0
push str.SYSTEMCurrentControlSet_services_
lea ecx, [ebp + 0x294]
call fcn.00401130
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.00405128
cmp dword [eax + 0x18], 8
jb 0x41b696
mov eax, dword [eax + 4]
jmp 0x41b699
add eax, 4
push eax
lea ecx, [ebp + 0x294]
call fcn.00401f50
cmp dword [ebp + 0x2ac], 8
mov eax, dword [ebp + 0x298]
jae 0x41b6ba
lea eax, [ebp + 0x298]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push ebx
push 1
lea ecx, [ebp + 0x294]
mov byte [ebp - 4], 4
call fcn.00401330
lea ecx, [ebp - 0x18]
call fcn.00416fce
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x30]
call fcn.004053da
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x18]
call fcn.004335b3
test al, al
je 0x41b66f
jmp 0x41b5ab