Function at 0x4467f0
Capabilities:
Check if file exists
Query or enumerate registry value
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5970d3
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x62819c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x44], 0
call fcn.00444a60
add esp, 4
mov edi, dword [ebp - 0x60]
mov dword [ebp - 4], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], 1
cmp edi, dword [ebp - 0x5c]
je 0x446871
mov edi, edi
mov eax, dword [esi]
test eax, eax
je 0x446ee3
push eax
push dword [edi]
call fcn.00555852
add esp, 8
test eax, eax
je 0x446899
add edi, 0x2c
cmp edi, dword [ebp - 0x5c]
jne 0x446850
xor esi, esi
lea ecx, [ebp - 0x60]
call fcn.00447bd0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00545ec7
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x48], 0
mov byte [ebp - 4], 1
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x446ee3
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x34], esi
mov eax, dword [edi + 4]
mov ebx, dword [edi + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 2
test eax, eax
je 0x4468d9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0
push eax
push ebx
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [ebp - 0x48]
mov ebx, dword [edi + 0xc]
mov dword [ebp - 0x3c], 0
test eax, eax
je 0x4469a8
lea ecx, [ebp - 0x3c]
push ecx
push 0
lea ecx, [ebp - 0x30]
push ecx
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x30]
cmp eax, 1
je 0x446928
cmp eax, 2
jne 0x4469a8
lea ecx, [ebp - 0x34]
call fcn.00429490
mov edx, dword [ebp - 0x3c]
shr edx, 1
add edx, 1
js 0x446ef7
mov esi, dword [ebp - 0x34]
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x44695e
push edx
lea ecx, [ebp - 0x34]
call fcn.004296d0
mov esi, dword [ebp - 0x34]
lea eax, [ebp - 0x3c]
push eax
push esi
lea eax, [ebp - 0x30]
push eax
push 0
push ebx
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4469a8
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
shr eax, 1
mov word [esi + eax*2], cx
push dword [esi - 8]
push esi
call fcn.00555593
add esp, 8
test eax, eax
js 0x446ef7
cmp eax, dword [esi - 8]
jg 0x446ef7
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 0xc], 0
jne 0x446afb
push str.UninstallString
push dword [edi + 0xc]
call fcn.00555852
add esp, 8
test eax, eax
jne 0x446afb
mov ebx, dword [edi + 4]
mov byte [ebp - 4], 3
mov dword [ebp - 0x3c], eax
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x446eed
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 0x44], 1
lea esi, [eax + 0x10]
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x30], esi
push eax
push 0xf013f
push 0
push dword [edi + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x446ad0
push 0xf
push str.UninstallString
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.0042daa0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
push dword [ebp - 0x3c]
lea eax, [ebp - 0x40]
push eax
call fcn.004472a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 5
call fcn.0042a6a0
mov edx, dword [ebp - 0x40]
or eax, 0xffffffff
mov byte [ebp - 4], 4
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x446a72
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x446ab0
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x446aa6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x446f01
push edx
push ecx
call fcn.00546044
add esp, 8
push dword [ebp - 0x3c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x34]
call fcn.0042a6a0
mov byte [ebp - 4], 2
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446af8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x34]
mov ebx, dword [esi - 0xc]
test ebx, ebx
je 0x446e91
cmp ebx, 4
jg 0x446b1f
lea eax, [esi - 0x10]
push eax
call fcn.004293f0
add esp, 4
add eax, 0x10
mov dword [ebp - 0x30], eax
jmp 0x446b8c
mov ecx, dword [esi - 0x10]
test ecx, ecx
je 0x446b31
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x446b3f
call fcn.00428a90
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
add ebx, 0xfffffffc
lea ebx, [esi + ebx*2]
test ecx, ecx
je 0x446f06
test ebx, ebx
je 0x446ef7
mov eax, dword [ecx]
push 2
push 4
call dword [eax]
test eax, eax
je 0x446f10
add eax, 0x10
mov dword [ebp - 0x30], eax
cmp dword [eax - 8], 4
jl 0x446ef7
mov dword [eax - 0xc], 4
xor ecx, ecx
mov word [eax + 8], cx
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + 4]
mov dword [eax + 4], ecx
mov ebx, 2
mov dword [ebp - 0x44], ebx
push str..exe
push eax
call fcn.00555852
mov edx, dword [ebp - 0x30]
add esp, 8
test eax, eax
mov byte [ebp - 4], bl
sete byte [ebp - 0x35]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x446bc6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x35], 0
je 0x446c3e
cmp dword [esi - 0xc], 0
je 0x446c3e
push 0x5c
push esi
call fcn.0054bdba
add esp, 8
test eax, eax
je 0x446bea
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
jne 0x446c02
push 0x2f
push esi
call fcn.0054bdba
add esp, 8
test eax, eax
je 0x446c3e
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x446c3e
push eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x34]
call fcn.00446f20
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 7
call fcn.0042a6a0
mov edx, dword [ebp - 0x4c]
or eax, 0xffffffff
mov byte [ebp - 4], 2
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x446c3b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x34]
mov edx, dword [edi + 0x18]
mov ecx, edx
mov eax, dword [edi + 0x14]
sub ecx, eax
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x30], eax
cmp ecx, 4
jae 0x446c63
mov dword [ebp - 0x50], 1
jmp 0x446d97
cmp eax, edx
je 0x446d97
jmp 0x446c70
mov ecx, dword [esi - 0x10]
mov byte [ebp - 4], 8
test ecx, ecx
je 0x446c84
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x446c98
call fcn.00428a90
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
test eax, eax
je 0x446ee3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
push 1
push 0x5ad728
push dword [esi - 0xc]
add eax, 0x10
or ebx, 4
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push esi
push eax
mov dword [ebp - 0x44], ebx
call fcn.0042ae30
add esp, 0x14
mov esi, dword [ebp - 0x3c]
mov ecx, dword [esi - 0x10]
lea eax, [esi - 0x10]
mov byte [ebp - 4], 9
mov dword [ebp - 0x54], eax
test ecx, ecx
je 0x446cdf
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x446cf3
call fcn.00428a90
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
test eax, eax
je 0x446ee3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
or ebx, 8
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], ebx
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
push dword [esi - 0xc]
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.0042ae30
mov esi, dword [ebp - 0x40]
add esp, 0x14
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov byte [ebp - 4], 8
sete byte [ebp - 0x35]
and ebx, 0xfffffff7
mov dword [ebp - 0x44], ebx
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446d51
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x54]
and ebx, 0xfffffffb
mov dword [ebp - 0x44], ebx
or eax, 0xffffffff
mov byte [ebp - 4], 2
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x446d73
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x35], 0
jne 0x446d90
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x34]
add eax, 4
mov dword [ebp - 0x30], eax
cmp eax, dword [edi + 0x18]
jne 0x446c70
jmp 0x446d97
mov dword [ebp - 0x50], 0
mov edx, dword [edi + 0x24]
mov ecx, edx
mov eax, dword [edi + 0x20]
sub ecx, eax
mov dword [ebp - 0x30], eax
cmp ecx, 4
jae 0x446db6
mov esi, dword [ebp - 0x34]
mov ebx, 1
jmp 0x446e93
cmp eax, edx
je 0x446e8e
mov edi, edi
xor esi, esi
push 4
push esi
push esi
mov dword [ebp - 0x54], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x446e6c
mov esi, ebx
cmp ebx, 0xffffffff
je 0x446e6c
mov ecx, dword [ebp - 0x30]
push 4
push dword [ecx]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x446e52
cmp esi, 0xffffffff
je 0x446e55
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x446e1a
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
jmp 0x446e7c
mov eax, dword [ebp - 0x28]
cmp eax, 6
je 0x446e33
cmp eax, 4
je 0x446e33
mov dword [ebp - 0x40], 0
cmp eax, 3
jne 0x446e3a
mov dword [ebp - 0x40], 1
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
cmp dword [ebp - 0x40], 0
jne 0x446da9
jmp 0x446e7c
mov eax, dword [ebp - 0x54]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x446e67
cmp eax, 0xffffffff
je 0x446e67
push eax
call esi
push ebx
call esi
jmp 0x446e7c
test esi, esi
je 0x446e7c
cmp esi, 0xffffffff
je 0x446e7c
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x30]
add eax, 4
mov dword [ebp - 0x30], eax
cmp eax, dword [edi + 0x24]
jne 0x446dc0
mov esi, dword [ebp - 0x34]
xor ebx, ebx
mov byte [ebp - 4], 1
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x446eaf
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x446ebd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x4c], 0
je 0x446871
cmp dword [ebp - 0x50], 0
je 0x446871
test ebx, ebx
je 0x446871
mov esi, 1
jmp 0x446873
push 0x80004005
call fcn.004293d0
push 0x80004005
call fcn.004293d0
push 0x80070057
call fcn.004293d0
call fcn.00555394
push 0x80004005
call fcn.004293d0
call fcn.00429970
int3