Function at 0x442730
Capabilities:
Check if file exists
Query or enumerate registry value
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x597923
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x61ce74]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x44], 0
call fcn.004409c0
add esp, 4
mov edi, dword [ebp - 0x60]
mov dword [ebp - 4], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], 1
cmp edi, dword [ebp - 0x5c]
je 0x4427b1
mov edi, edi
mov eax, dword [esi]
test eax, eax
je 0x442e23
push eax
push dword [edi]
call fcn.0054b581
add esp, 8
test eax, eax
je 0x4427d9
add edi, 0x2c
cmp edi, dword [ebp - 0x5c]
jne 0x442790
xor esi, esi
lea ecx, [ebp - 0x60]
call fcn.00443b10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053d079
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x48], 0
mov byte [ebp - 4], 1
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x442e23
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x34], esi
mov eax, dword [edi + 4]
mov ebx, dword [edi + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x48]
mov byte [ebp - 4], 2
test eax, eax
je 0x442819
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0
push eax
push ebx
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [ebp - 0x48]
mov ebx, dword [edi + 0xc]
mov dword [ebp - 0x3c], 0
test eax, eax
je 0x4428e8
lea ecx, [ebp - 0x3c]
push ecx
push 0
lea ecx, [ebp - 0x30]
push ecx
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x30]
cmp eax, 1
je 0x442868
cmp eax, 2
jne 0x4428e8
lea ecx, [ebp - 0x34]
call fcn.00426010
mov edx, dword [ebp - 0x3c]
shr edx, 1
add edx, 1
js 0x442e37
mov esi, dword [ebp - 0x34]
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x44289e
push edx
lea ecx, [ebp - 0x34]
call fcn.00426250
mov esi, dword [ebp - 0x34]
lea eax, [ebp - 0x3c]
push eax
push esi
lea eax, [ebp - 0x30]
push eax
push 0
push ebx
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4428e8
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
shr eax, 1
mov word [esi + eax*2], cx
push dword [esi - 8]
push esi
call fcn.0054b2c2
add esp, 8
test eax, eax
js 0x442e37
cmp eax, dword [esi - 8]
jg 0x442e37
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 0xc], 0
jne 0x442a3b
push str.UninstallString
push dword [edi + 0xc]
call fcn.0054b581
add esp, 8
test eax, eax
jne 0x442a3b
mov ebx, dword [edi + 4]
mov byte [ebp - 4], 3
mov dword [ebp - 0x3c], eax
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x442e2d
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 0x44], 1
lea esi, [eax + 0x10]
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x30], esi
push eax
push 0xf013f
push 0
push dword [edi + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x442a10
push 0xf
push str.UninstallString
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00439df0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
push dword [ebp - 0x3c]
lea eax, [ebp - 0x40]
push eax
call fcn.004431e0
add esp, 0xc
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 5
call fcn.00427100
mov edx, dword [ebp - 0x40]
or eax, 0xffffffff
mov byte [ebp - 4], 4
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4429b2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x4429f0
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4429e6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x442e41
push edx
push ecx
call fcn.0053d0af
add esp, 8
push dword [ebp - 0x3c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x34]
call fcn.00427100
mov byte [ebp - 4], 2
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x442a38
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x34]
mov ebx, dword [esi - 0xc]
test ebx, ebx
je 0x442dd1
cmp ebx, 4
jg 0x442a5f
lea eax, [esi - 0x10]
push eax
call fcn.00425f70
add esp, 4
add eax, 0x10
mov dword [ebp - 0x30], eax
jmp 0x442acc
mov ecx, dword [esi - 0x10]
test ecx, ecx
je 0x442a71
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x442a7f
call fcn.00421b80
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
add ebx, 0xfffffffc
lea ebx, [esi + ebx*2]
test ecx, ecx
je 0x442e46
test ebx, ebx
je 0x442e37
mov eax, dword [ecx]
push 2
push 4
call dword [eax]
test eax, eax
je 0x442e50
add eax, 0x10
mov dword [ebp - 0x30], eax
cmp dword [eax - 8], 4
jl 0x442e37
mov dword [eax - 0xc], 4
xor ecx, ecx
mov word [eax + 8], cx
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + 4]
mov dword [eax + 4], ecx
mov ebx, 2
mov dword [ebp - 0x44], ebx
push str..exe
push eax
call fcn.0054b581
mov edx, dword [ebp - 0x30]
add esp, 8
test eax, eax
mov byte [ebp - 4], bl
sete byte [ebp - 0x35]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x442b06
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x35], 0
je 0x442b7e
cmp dword [esi - 0xc], 0
je 0x442b7e
push 0x5c
push esi
call fcn.005422aa
add esp, 8
test eax, eax
je 0x442b2a
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
jne 0x442b42
push 0x2f
push esi
call fcn.005422aa
add esp, 8
test eax, eax
je 0x442b7e
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x442b7e
push eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x34]
call fcn.00442e60
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 7
call fcn.00427100
mov edx, dword [ebp - 0x4c]
or eax, 0xffffffff
mov byte [ebp - 4], 2
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x442b7b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x34]
mov edx, dword [edi + 0x18]
mov ecx, edx
mov eax, dword [edi + 0x14]
sub ecx, eax
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x30], eax
cmp ecx, 4
jae 0x442ba3
mov dword [ebp - 0x50], 1
jmp 0x442cd7
cmp eax, edx
je 0x442cd7
jmp 0x442bb0
mov ecx, dword [esi - 0x10]
mov byte [ebp - 4], 8
test ecx, ecx
je 0x442bc4
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x442bd8
call fcn.00421b80
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
test eax, eax
je 0x442e23
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
push 1
push 0x5b14ac
push dword [esi - 0xc]
add eax, 0x10
or ebx, 4
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push esi
push eax
mov dword [ebp - 0x44], ebx
call fcn.00427890
add esp, 0x14
mov esi, dword [ebp - 0x3c]
mov ecx, dword [esi - 0x10]
lea eax, [esi - 0x10]
mov byte [ebp - 4], 9
mov dword [ebp - 0x54], eax
test ecx, ecx
je 0x442c1f
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x442c33
call fcn.00421b80
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
test eax, eax
je 0x442e23
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
or ebx, 8
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], ebx
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
push dword [esi - 0xc]
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.00427890
mov esi, dword [ebp - 0x40]
add esp, 0x14
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov byte [ebp - 4], 8
sete byte [ebp - 0x35]
and ebx, 0xfffffff7
mov dword [ebp - 0x44], ebx
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x442c91
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x54]
and ebx, 0xfffffffb
mov dword [ebp - 0x44], ebx
or eax, 0xffffffff
mov byte [ebp - 4], 2
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x442cb3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x35], 0
jne 0x442cd0
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x34]
add eax, 4
mov dword [ebp - 0x30], eax
cmp eax, dword [edi + 0x18]
jne 0x442bb0
jmp 0x442cd7
mov dword [ebp - 0x50], 0
mov edx, dword [edi + 0x24]
mov ecx, edx
mov eax, dword [edi + 0x20]
sub ecx, eax
mov dword [ebp - 0x30], eax
cmp ecx, 4
jae 0x442cf6
mov esi, dword [ebp - 0x34]
mov ebx, 1
jmp 0x442dd3
cmp eax, edx
je 0x442dce
mov edi, edi
xor esi, esi
push 4
push esi
push esi
mov dword [ebp - 0x54], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x442dac
mov esi, ebx
cmp ebx, 0xffffffff
je 0x442dac
mov ecx, dword [ebp - 0x30]
push 4
push dword [ecx]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x442d92
cmp esi, 0xffffffff
je 0x442d95
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x442d5a
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
jmp 0x442dbc
mov eax, dword [ebp - 0x28]
cmp eax, 6
je 0x442d73
cmp eax, 4
je 0x442d73
mov dword [ebp - 0x40], 0
cmp eax, 3
jne 0x442d7a
mov dword [ebp - 0x40], 1
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
cmp dword [ebp - 0x40], 0
jne 0x442ce9
jmp 0x442dbc
mov eax, dword [ebp - 0x54]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
je 0x442da7
cmp eax, 0xffffffff
je 0x442da7
push eax
call esi
push ebx
call esi
jmp 0x442dbc
test esi, esi
je 0x442dbc
cmp esi, 0xffffffff
je 0x442dbc
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x30]
add eax, 4
mov dword [ebp - 0x30], eax
cmp eax, dword [edi + 0x24]
jne 0x442d00
mov esi, dword [ebp - 0x34]
xor ebx, ebx
mov byte [ebp - 4], 1
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x442def
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x442dfd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x4c], 0
je 0x4427b1
cmp dword [ebp - 0x50], 0
je 0x4427b1
test ebx, ebx
je 0x4427b1
mov esi, 1
jmp 0x4427b3
push 0x80004005
call fcn.00425f50
push 0x80004005
call fcn.00425f50
push 0x80070057
call fcn.00425f50
call fcn.0054b0c3
push 0x80004005
call fcn.00425f50
call fcn.004264f0
int3