Function at 0x42a720
Capabilities:
Query or enumerate registry value
Query service status

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd823
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x140
mov eax, dword [0x50c080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
push 0x14
push str.MBAMInstallerService
lea ecx, [ebp - 0x150]
movq qword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x150], xmm0
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0
call fcn.0040df90
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x138]
push 0xb
xorps xmm0, xmm0
mov dword [ebp - 0x128], 0
push str.MBAMService
movups xmmword [ebp - 0x138], xmm0
mov dword [ebp - 0x124], 0
call fcn.0040df90
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x120]
push 0xe
xorps xmm0, xmm0
mov dword [ebp - 0x110], 0
push str.MBAMProtection
movups xmmword [ebp - 0x120], xmm0
mov dword [ebp - 0x10c], 0
call fcn.0040df90
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x108]
push 0x11
xorps xmm0, xmm0
mov dword [ebp - 0xf8], 0
push str.MBAMWebProtection
movups xmmword [ebp - 0x108], xmm0
mov dword [ebp - 0xf4], 0
call fcn.0040df90
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xf0]
push 0xa
xorps xmm0, xmm0
mov dword [ebp - 0xe0], 0
push str.MBAMFarflt
movups xmmword [ebp - 0xf0], xmm0
mov dword [ebp - 0xdc], 0
call fcn.0040df90
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xd8]
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 0xc8], 0
push str.MBAMChameleon
movups xmmword [ebp - 0xd8], xmm0
mov dword [ebp - 0xc4], 0
call fcn.0040df90
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xc0]
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 0xb0], 0
push str.MBAMSwissArmy
movups xmmword [ebp - 0xc0], xmm0
mov dword [ebp - 0xac], 0
call fcn.0040df90
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa8]
push 8
xorps xmm0, xmm0
mov dword [ebp - 0x98], 0
push str.MBAMElam
movups xmmword [ebp - 0xa8], xmm0
mov dword [ebp - 0x94], 0
call fcn.0040df90
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x90]
push 0x12
xorps xmm0, xmm0
mov dword [ebp - 0x80], 0
push str.ESProtectionDriver
movups xmmword [ebp - 0x90], xmm0
mov dword [ebp - 0x7c], 0
call fcn.0040df90
lea ecx, [ebp - 0x150]
mov dword [ebp - 4], 8
push ecx
lea eax, [ebp - 0x78]
push eax
push ecx
lea ecx, [ebp - 0x40]
call fcn.0043cef0
push fcn.00406550
push 9
push 0x18
lea eax, [ebp - 0x150]
mov byte [ebp - 4], 0xa
push eax
call fcn.004911cf
push 0x20000004
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x48], edi
mov byte [ebp - 4], 0xb
test edi, edi
jne 0x42aa41
lea ecx, [ebp - 0x30]
call fcn.00467cf0
mov byte [ebp - 4], 0xc
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42a9a5
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0x3e3
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_OpenSCManager_failed:
mov ecx, eax
call fcn.00411050
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0041b590
push eax
call fcn.004113d0
mov ecx, dword [ebp - 0x1c]
add esp, 4
cmp ecx, 7
jbe 0x42aa38
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42aa2e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ae9d
push ecx
push edx
call fcn.00490f7d
add esp, 8
mov byte [ebp - 0x71], 0
jmp 0x42abe7
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x78], eax
cmp esi, eax
je 0x42abdc
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x42aa5f
mov eax, dword [esi]
push 5
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x34], esi
mov byte [ebp - 4], 0xd
test esi, esi
jne 0x42aa7c
mov byte [ebp - 4], 0xb
jmp 0x42aac8
lea eax, [ebp - 0x18]
mov dword [ebp - 0x4c], 0
push eax
push 0x24
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x18], 0
push eax
xorps xmm0, xmm0
push 0
push esi
movups xmmword [ebp - 0x6c], xmm0
movups xmmword [ebp - 0x5c], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x42acdf
cmp dword [ebp - 0x60], 0x430
je 0x42ac10
push esi
mov byte [ebp - 4], 0xb
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x70]
add esi, 0x18
mov dword [ebp - 0x70], esi
cmp esi, dword [ebp - 0x78]
jne 0x42aa55
mov eax, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x40]
mov dword [ebp - 0x78], eax
cmp esi, eax
je 0x42abdc
nop dword [eax + eax]
push 0x22
xorps xmm0, xmm0
mov dword [ebp - 0x70], 0
push str.SYSTEMCurrentControlSetServices_
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x20], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x1c], 0
call fcn.0040df90
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x10
call fcn.0040dab0
cmp dword [ebp - 0x1c], 7
lea ecx, [ebp - 0x70]
push ecx
push 0x20019
lea eax, [ebp - 0x30]
cmova eax, dword [ebp - 0x30]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42ab92
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34], 4
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x44], 4
push eax
push 0
push str.DeleteFlag
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42ab89
cmp dword [ebp - 0x18], 1
je 0x42ad9b
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x42abd0
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42abc6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42ae9d
push ecx
push edx
call fcn.00490f7d
add esp, 8
add esi, 0x18
cmp esi, dword [ebp - 0x78]
jne 0x42aaf0
mov byte [ebp - 0x71], 0
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [ebp - 0x40]
call fcn.0043fc80
mov al, byte [ebp - 0x71]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00490c46
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea ecx, [ebp - 0x30]
call fcn.00467cf0
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42ac27
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0x3fb
mov ecx, eax
call fcn.0040f7e0
mov edx, 0x4ec7a8
mov ecx, eax
call fcn.00411050
mov edx, dword [ebp - 0x70]
cmp dword [edx + 0x14], 7
mov ecx, dword [edx + 0x10]
jbe 0x42ac75
mov edx, dword [edx]
push ecx
mov ecx, eax
call fcn.00412550
add esp, 4
mov edx, str._marked_for_deletion
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov ecx, dword [ebp - 0x1c]
add esp, 4
cmp ecx, 7
jbe 0x42accf
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42acc5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42aea2
push ecx
push edx
call fcn.00490f7d
add esp, 8
push esi
mov byte [ebp - 0x71], 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x42abe0
lea ecx, [ebp - 0x30]
call fcn.00467cf0
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42acf6
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0x3f5
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_QueryServiceStatusEx_failed:
mov ecx, eax
call fcn.00411050
mov dword [ebp - 0x78], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x78]
push eax
call fcn.0041b590
push eax
call fcn.004113d0
mov ecx, dword [ebp - 0x1c]
add esp, 4
cmp ecx, 7
jbe 0x42ad8b
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42ad81
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42aea7
push ecx
push edx
call fcn.00490f7d
add esp, 8
push esi
mov byte [ebp - 0x71], 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x42abe0
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x60]
call fcn.00467cf0
mov byte [ebp - 4], 0x11
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x42adbb
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.C:JenkinsworkspaceMBAM_WindowsA_MB5_MBSetup_srcMBSetupMBSetup.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0x413
mov ecx, eax
call fcn.0040f7e0
mov edx, 0x4ec7a8
mov ecx, eax
call fcn.00411050
cmp dword [esi + 0x14], 7
mov ecx, dword [esi + 0x10]
jbe 0x42ae06
mov esi, dword [esi]
push ecx
mov edx, esi
mov ecx, eax
call fcn.00412550
add esp, 4
mov edx, str._marked_for_deletion
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov ecx, dword [ebp - 0x4c]
add esp, 4
cmp ecx, 7
jbe 0x42ae5e
mov edx, dword [ebp - 0x60]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42ae54
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42aeac
push ecx
push edx
call fcn.00490f7d
add esp, 8
mov ecx, dword [ebp - 0x1c]
cmp ecx, 7
jbe 0x42ae94
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42ae8a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42aeb1
push ecx
push edx
call fcn.00490f7d
add esp, 8
mov byte [ebp - 0x71], 1
jmp 0x42abe0
call fcn.004961af
call fcn.004961af
call fcn.004961af
call fcn.004961af
call fcn.004961af
int3