Function at 0x415050
Capabilities:
Enumerate services
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x22c
mov eax, dword [0x437070]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push ebp
push esi
xor ebx, ebx
push 4
push ebx
push ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
cmp ebp, ebx
mov dword [esp + 0x10], ebp
jne 0x4150a1
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x415113
call esi
mov esi, eax
cmp esi, ebx
jne 0x415278
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x20]
push edx
push ebx
push ebx
push 3
push 0x30
push ebp
call edi
mov esi, eax
test esi, esi
jne 0x415143
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x415127
test ebx, ebx
je 0x4150e0
push ebx
call fcn.004237fa
add esp, 4
mov esi, dword [esp + 0x18]
push esi
call fcn.004236b5
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x41511d
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x20]
push edx
push esi
push ebx
push 3
push 0x30
push ebp
call edi
mov esi, eax
test esi, esi
je 0x4150c6
jmp 0x415143
mov esi, 0xffffe5d4
jmp 0x415278
mov esi, 0xfffefffd
jmp 0x415277
test esi, esi
jne 0x415143
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x41517d
call esi
mov esi, eax
test esi, esi
jne 0x415277
mov ebp, dword [esp + 0x24]
xor esi, esi
test ebp, ebp
jbe 0x4151b2
mov edi, ebx
nop
mov eax, dword [edi]
mov ecx, str.SharedAccess
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x415187
test dx, dx
je 0x415179
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x415187
add eax, 4
add ecx, 4
test dx, dx
jne 0x415157
xor eax, eax
jmp 0x41518c
mov esi, 0xffffe5d4
jmp 0x415277
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4151a4
add esi, 1
add edi, 0x24
cmp esi, ebp
jb 0x415150
mov esi, 0xffffe5d4
jmp 0x415273
lea eax, [esi + esi*8]
mov edi, 4
cmp dword [ebx + eax*4 + 0xc], edi
je 0x4151bc
mov esi, 0xffffe5d4
jmp 0x415273
lea ecx, [esp + 0x10]
push ecx
push str.SOFTWAREApple_Inc.Bonjour
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, eax
test esi, esi
jne 0x415273
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x34]
push ecx
push esi
push str.ManageFirewall
push edx
mov dword [esp + 0x40], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x41520b
cmp dword [esp + 0x1c], eax
jne 0x415273
push 0x104
lea eax, [esp + 0x34]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
ja 0x415239
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x4152b9
call esi
mov esi, eax
test esi, esi
jne 0x415273
lea ecx, [esp + 0x30]
push str.Bonjour
push ecx
call fcn.004064f0
mov esi, eax
add esp, 8
test esi, esi
jne 0x415273
push edi
lea edx, [esp + 0x20]
push edx
push edi
push eax
mov eax, dword [esp + 0x20]
push str.ManageFirewall
push eax
mov dword [esp + 0x34], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov ebp, dword [esp + 0x14]
pop edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x415287
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x415294
push ebx
call fcn.004237fa
add esp, 4
test ebp, ebp
je 0x41529f
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [esp + 0x234]
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00423888
add esp, 0x22c
ret
mov esi, 0xffffe5d0
jmp 0x415273