Function at 0x200041bc
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x92c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x2000c208
push 0x64
push dword [ebp + 8]
mov ecx, 0x20011430
mov ebx, eax
push 0x2000e8d8
call fcn.20004cdb
mov esi, 0x2000ea94
lea edi, [ebp - 0x14]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x14]
mov dword [0x200115d8], 1
push eax
push ebx
movsb byte es:[edi], byte [esi]
call fcn.200038b9
xor ebx, ebx
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 0x10], eax
je 0x20004a45
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0xc
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp + 0xb], bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x28]
push str.UnregServer
push eax
call edi
test eax, eax
jne 0x2000424d
mov ecx, 0x20011430
call fcn.20004ca2
jmp 0x20004b15
push 0xa
lea eax, [ebp - 0x28]
push dword [ebp - 0x10]
push eax
call esi
lea eax, [ebp - 0x28]
push str.RegServer
push eax
call edi
test eax, eax
jne 0x2000427b
push ebx
push 1
mov ecx, 0x20011430
call fcn.20004b5a
mov dword [ebp - 0xc], eax
mov byte [ebp + 0xb], 1
push 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x10]
push eax
call esi
lea eax, [ebp - 0x28]
push str.Service
push eax
call edi
test eax, eax
jne 0x200042aa
push 1
push 1
mov ecx, 0x20011430
call fcn.20004b5a
mov dword [ebp - 0xc], eax
mov byte [ebp + 0xb], 1
cmp byte [ebp + 0xb], 1
jne 0x20004a45
cmp dword [ebp - 0xc], ebx
jne 0x20004a3d
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
call fcn.200038b9
pop ecx
pop ecx
push 0x2000ea70
push eax
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x20004320
lea eax, [ebp + 8]
push eax
push 0x20019
push ebx
push str.SOFTWAREHewlett_PackardHPB_BiDi_Port_Resolver
push 0x80000002
call fcn.2000587d
add esp, 0x14
test eax, eax
jne 0x20004a3d
push str.IsCOM
push dword [ebp + 8]
call fcn.2000572c
pop ecx
mov edi, eax
pop ecx
push dword [ebp + 8]
call esi
cmp edi, 1
jne 0x20004a3d
mov byte [ebp - 0x828], 1
mov byte [ebp - 0x827], bl
mov byte [ebp - 0x826], 4
mov byte [ebp - 0x825], 0x80
mov byte [ebp - 0x824], 0xd8
mov byte [ebp - 0x823], bl
mov byte [ebp - 0x822], bl
mov byte [ebp - 0x821], bl
mov byte [ebp - 0x820], 0xf4
mov byte [ebp - 0x81f], bl
mov byte [ebp - 0x81e], bl
mov byte [ebp - 0x81d], bl
mov byte [ebp - 0x81c], bl
mov byte [ebp - 0x81b], bl
mov byte [ebp - 0x81a], bl
mov byte [ebp - 0x819], bl
mov byte [ebp - 0x818], 0x14
mov byte [ebp - 0x817], bl
mov byte [ebp - 0x816], bl
mov byte [ebp - 0x815], bl
mov byte [ebp - 0x814], 2
mov byte [ebp - 0x813], bl
mov byte [ebp - 0x812], 0xc4
mov byte [ebp - 0x811], bl
mov byte [ebp - 0x810], 8
mov byte [ebp - 0x80f], bl
mov byte [ebp - 0x80e], bl
mov byte [ebp - 0x80d], bl
mov byte [ebp - 0x80c], 1
mov byte [ebp - 0x80b], bl
mov byte [ebp - 0x80a], 0x14
mov byte [ebp - 0x809], bl
mov byte [ebp - 0x808], 1
mov byte [ebp - 0x807], bl
mov byte [ebp - 0x806], bl
mov byte [ebp - 0x805], bl
mov byte [ebp - 0x804], 1
mov byte [ebp - 0x803], 1
mov byte [ebp - 0x802], bl
mov byte [ebp - 0x801], bl
mov byte [ebp - 0x800], bl
mov byte [ebp - 0x7ff], bl
mov byte [ebp - 0x7fe], bl
mov byte [ebp - 0x7fd], 5
mov byte [ebp - 0x7fc], 2
mov byte [ebp - 0x7fb], bl
mov byte [ebp - 0x7fa], bl
mov byte [ebp - 0x7f9], bl
mov byte [ebp - 0x7f8], bl
mov byte [ebp - 0x7f7], bl
mov byte [ebp - 0x7f6], 0x18
mov byte [ebp - 0x7f5], bl
mov byte [ebp - 0x7f4], 1
mov byte [ebp - 0x7f3], bl
mov byte [ebp - 0x7f2], bl
mov byte [ebp - 0x7f1], bl
mov byte [ebp - 0x7f0], 1
mov byte [ebp - 0x7ef], 2
mov byte [ebp - 0x7ee], bl
mov byte [ebp - 0x7ed], bl
mov byte [ebp - 0x7ec], bl
mov byte [ebp - 0x7eb], bl
mov byte [ebp - 0x7ea], bl
mov byte [ebp - 0x7e9], 5
mov byte [ebp - 0x7e8], 0x20
mov byte [ebp - 0x7e7], bl
mov byte [ebp - 0x7e6], bl
mov byte [ebp - 0x7e5], bl
mov byte [ebp - 0x7e4], 0x21
mov byte [ebp - 0x7e3], 2
mov byte [ebp - 0x7e2], bl
mov byte [ebp - 0x7e1], bl
mov byte [ebp - 0x7e0], bl
mov byte [ebp - 0x7df], bl
mov byte [ebp - 0x7de], 0x18
mov byte [ebp - 0x7dd], bl
mov byte [ebp - 0x7dc], 1
mov byte [ebp - 0x7db], bl
mov byte [ebp - 0x7da], bl
mov byte [ebp - 0x7d9], bl
mov byte [ebp - 0x7d8], 1
mov byte [ebp - 0x7d7], 1
mov byte [ebp - 0x7d6], bl
mov byte [ebp - 0x7d5], bl
mov byte [ebp - 0x7d4], bl
mov byte [ebp - 0x7d3], bl
mov byte [ebp - 0x7d2], bl
mov byte [ebp - 0x7d1], 1
mov byte [ebp - 0x7d0], bl
mov byte [ebp - 0x7cf], bl
mov byte [ebp - 0x7ce], bl
mov byte [ebp - 0x7cd], bl
mov byte [ebp - 0x7cc], 0x21
mov byte [ebp - 0x7cb], 2
mov byte [ebp - 0x7ca], bl
mov byte [ebp - 0x7c9], bl
mov byte [ebp - 0x7c8], bl
mov byte [ebp - 0x7c7], bl
mov byte [ebp - 0x7c6], 0x18
mov byte [ebp - 0x7c5], bl
mov byte [ebp - 0x7c4], 1
mov byte [ebp - 0x7c3], bl
mov byte [ebp - 0x7c2], bl
mov byte [ebp - 0x7c1], bl
mov byte [ebp - 0x7c0], 1
mov byte [ebp - 0x7bf], 2
mov byte [ebp - 0x7be], bl
mov byte [ebp - 0x7bd], bl
mov byte [ebp - 0x7bc], bl
mov byte [ebp - 0x7bb], bl
mov byte [ebp - 0x7ba], bl
mov byte [ebp - 0x7b9], 5
mov byte [ebp - 0x7b8], 0x20
mov byte [ebp - 0x7b7], bl
mov byte [ebp - 0x7b6], bl
mov byte [ebp - 0x7b5], bl
mov byte [ebp - 0x7b4], 0x20
mov byte [ebp - 0x7b3], 2
mov byte [ebp - 0x7b2], bl
mov byte [ebp - 0x7b1], bl
mov byte [ebp - 0x7b0], bl
mov byte [ebp - 0x7af], bl
mov byte [ebp - 0x7ae], 0x18
mov byte [ebp - 0x7ad], bl
mov byte [ebp - 0x7ac], 1
mov byte [ebp - 0x7ab], bl
mov byte [ebp - 0x7aa], bl
mov byte [ebp - 0x7a9], bl
mov byte [ebp - 0x7a8], 1
mov byte [ebp - 0x7a7], 1
mov byte [ebp - 0x7a6], bl
mov byte [ebp - 0x7a5], bl
mov byte [ebp - 0x7a4], bl
mov byte [ebp - 0x7a3], bl
mov byte [ebp - 0x7a2], bl
mov byte [ebp - 0x7a1], 5
mov byte [ebp - 0x7a0], 4
mov byte [ebp - 0x79f], bl
mov byte [ebp - 0x79e], bl
mov byte [ebp - 0x79d], bl
mov byte [ebp - 0x79c], 0x20
mov byte [ebp - 0x79b], 2
mov byte [ebp - 0x79a], bl
mov byte [ebp - 0x799], bl
mov byte [ebp - 0x798], bl
mov byte [ebp - 0x797], bl
mov byte [ebp - 0x796], 0x18
mov byte [ebp - 0x795], bl
mov byte [ebp - 0x794], 1
mov byte [ebp - 0x793], bl
mov byte [ebp - 0x792], bl
mov byte [ebp - 0x791], bl
mov byte [ebp - 0x790], 1
mov byte [ebp - 0x78f], 1
mov byte [ebp - 0x78e], bl
mov byte [ebp - 0x78d], bl
mov byte [ebp - 0x78c], bl
mov byte [ebp - 0x78b], bl
mov byte [ebp - 0x78a], bl
mov byte [ebp - 0x789], 5
mov byte [ebp - 0x788], 0x12
mov byte [ebp - 0x787], bl
mov byte [ebp - 0x786], bl
mov byte [ebp - 0x785], bl
mov byte [ebp - 0x784], 0x20
mov byte [ebp - 0x783], 2
mov byte [ebp - 0x782], bl
mov byte [ebp - 0x781], bl
mov byte [ebp - 0x780], bl
mov byte [ebp - 0x77f], bl
mov byte [ebp - 0x77e], 0x18
mov byte [ebp - 0x77d], bl
mov byte [ebp - 0x77c], 1
mov byte [ebp - 0x77b], bl
mov byte [ebp - 0x77a], bl
mov byte [ebp - 0x779], bl
mov byte [ebp - 0x778], 1
mov byte [ebp - 0x777], 1
mov byte [ebp - 0x776], bl
mov byte [ebp - 0x775], bl
mov byte [ebp - 0x774], bl
mov byte [ebp - 0x773], bl
mov byte [ebp - 0x772], bl
mov byte [ebp - 0x771], 5
mov byte [ebp - 0x770], 0xb
mov byte [ebp - 0x76f], bl
mov byte [ebp - 0x76e], bl
mov byte [ebp - 0x76d], bl
mov byte [ebp - 0x76c], 0x20
mov byte [ebp - 0x76b], 2
mov byte [ebp - 0x76a], bl
mov byte [ebp - 0x769], bl
mov byte [ebp - 0x768], bl
mov byte [ebp - 0x767], bl
mov byte [ebp - 0x766], 0x18
mov byte [ebp - 0x765], bl
mov byte [ebp - 0x764], 1
mov byte [ebp - 0x763], bl
mov byte [ebp - 0x762], bl
mov byte [ebp - 0x761], bl
mov byte [ebp - 0x760], 1
mov byte [ebp - 0x75f], 2
mov byte [ebp - 0x75e], bl
mov byte [ebp - 0x75d], bl
mov byte [ebp - 0x75c], bl
mov byte [ebp - 0x75b], bl
mov byte [ebp - 0x75a], bl
mov byte [ebp - 0x759], 5
mov byte [ebp - 0x758], 0x20
mov byte [ebp - 0x757], bl
mov byte [ebp - 0x756], bl
mov byte [ebp - 0x755], bl
mov byte [ebp - 0x754], 0x22
mov byte [ebp - 0x753], 2
mov byte [ebp - 0x752], bl
mov byte [ebp - 0x751], bl
mov byte [ebp - 0x750], 1
mov byte [ebp - 0x74f], 5
mov byte [ebp - 0x74e], bl
mov byte [ebp - 0x74d], bl
mov byte [ebp - 0x74c], bl
mov byte [ebp - 0x74b], bl
mov byte [ebp - 0x74a], bl
mov byte [ebp - 0x749], 5
mov byte [ebp - 0x748], 0x15
mov byte [ebp - 0x747], bl
mov byte [ebp - 0x746], bl
mov byte [ebp - 0x745], bl
mov byte [ebp - 0x744], 0xa0
mov byte [ebp - 0x743], 0x5f
mov byte [ebp - 0x742], 0x84
mov byte [ebp - 0x741], 0x1f
mov byte [ebp - 0x740], 0x5e
mov byte [ebp - 0x73f], 0x2e
mov byte [ebp - 0x73e], 0x6b
mov byte [ebp - 0x73d], 0x49
mov byte [ebp - 0x73c], 0xce
mov byte [ebp - 0x73b], 0x12
mov byte [ebp - 0x73a], 3
mov byte [ebp - 0x739], 3
mov byte [ebp - 0x738], 0xf4
mov byte [ebp - 0x737], 1
mov byte [ebp - 0x736], bl
mov ecx, 0x1bc
xor eax, eax
lea edi, [ebp - 0x718]
mov byte [ebp - 0x735], bl
mov byte [ebp - 0x734], 1
mov byte [ebp - 0x733], 5
mov byte [ebp - 0x732], bl
mov byte [ebp - 0x731], bl
mov byte [ebp - 0x730], bl
mov byte [ebp - 0x72f], bl
mov byte [ebp - 0x72e], bl
mov byte [ebp - 0x72d], 5
mov byte [ebp - 0x72c], 0x15
mov byte [ebp - 0x72b], bl
mov byte [ebp - 0x72a], bl
mov byte [ebp - 0x729], bl
mov byte [ebp - 0x728], 0xa0
mov byte [ebp - 0x727], 0x5f
mov byte [ebp - 0x726], 0x84
mov byte [ebp - 0x725], 0x1f
mov byte [ebp - 0x724], 0x5e
mov byte [ebp - 0x723], 0x2e
mov byte [ebp - 0x722], 0x6b
mov byte [ebp - 0x721], 0x49
mov byte [ebp - 0x720], 0xce
mov byte [ebp - 0x71f], 0x12
mov byte [ebp - 0x71e], 3
mov byte [ebp - 0x71d], 3
mov byte [ebp - 0x71c], 0xf4
mov byte [ebp - 0x71b], 1
mov byte [ebp - 0x71a], bl
mov byte [ebp - 0x719], bl
rep stosd dword es:[edi], eax
lea eax, [ebp + 8]
push eax
push 0x20006
push ebx
push str.AppID55F3F296_4775_4AE9_B0AA_52393842EF3C
push 0x80000000
call fcn.2000587d
add esp, 0x14
test eax, eax
jne 0x20004a3d
lea eax, [ebp - 0x828]
push 0x110
push eax
push 3
push str.LaunchPermission
push dword [ebp + 8]
call fcn.200058cf
add esp, 0x14
push dword [ebp + 8]
call esi
mov eax, dword [ebp - 0xc]
jmp 0x20004b15
mov esi, 0x20019
lea ecx, [ebp - 4]
push esi
push str.AppID
push 0x80000000
mov dword [ebp - 4], ebx
call fcn.20004b1c
mov edi, eax
cmp edi, ebx
je 0x20004a7d
cmp dword [ebp - 4], ebx
je 0x20004b13
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x20004b13
push esi
push str.55F3F296_4775_4AE9_B0AA_52393842EF3C
push dword [ebp - 4]
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.20004b1c
mov edi, eax
cmp edi, ebx
jne 0x20004af6
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x104
push eax
lea eax, [ebp - 0x92c]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push str.LocalService
mov dword [ebp + 8], ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
mov dword [0x200115d8], ebx
jne 0x20004ad3
mov dword [0x200115d8], 1
mov esi, 0x20011410
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, 0x20011430
call fcn.20004f5f
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov edi, dword [0x200115c4]
cmp dword [ebp - 8], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x20004b09
push dword [ebp - 8]
call esi
mov dword [ebp - 8], ebx
cmp dword [ebp - 4], ebx
je 0x20004b13
push dword [ebp - 4]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10