Function at 0x402919
Capabilities:
Query or enumerate registry value
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
call sym.NPROTECT.EXE__NPSystemGetWindowsType_0
cmp eax, 2
jne 0x402a4d
and dword [ebp - 8], 0
and dword [0x422054], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x402957
xor eax, eax
jmp 0x402c51
push 0xf01ff
push str.SymEvent
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [0x422068], eax
cmp dword [0x422068], 0
jne 0x40297f
xor eax, eax
jmp 0x402c51
push 0
push 0
push dword [0x422068]
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0
jne 0x4029c9
cmp dword [ebp - 4], 0x420
je 0x4029c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push str.Error_starting_SymEvent
push dword [ebp - 4]
call fcn.004011a9
pop ecx
pop ecx
xor eax, eax
jmp 0x402c51
push 0xf01ff
push str.NPDriver
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [0x42206c], eax
push 0
push 0
push dword [0x42206c]
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0xc], 0
jne 0x402a30
cmp dword [ebp - 4], 0x420
je 0x402a30
push str.Error_starting_NPDriver
push dword [ebp - 4]
call fcn.004011a9
pop ecx
pop ecx
call fcn.00402c53
xor eax, eax
jmp 0x402c51
push str.Nprotect.sys_and_Symevent.sys_successfully_loaded
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
mov dword [0x422054], 1
push 1
pop eax
jmp 0x402c51
cmp dword [0x422054], 0
jne 0x402c4e
call sym.NPROTECT.EXE__LoadNprotectDynaLoad_0
mov dword [0x422054], eax
cmp dword [0x422054], 0
jne 0x402c43
mov dword [ebp - 0x28], 0x7d2
push 0x12c
call fcn.0040e453
pop ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
push 0x12c
call fcn.0040e453
pop ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
push 0x12c
call fcn.0040e453
pop ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x20], eax
push 0x258
call fcn.0040e453
pop ecx
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], eax
push 0x104
call fcn.0040e453
pop ecx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x10], eax
push 0x12c
push dword [ebp - 0x1c]
push 0x442
push dword [0x42203c]
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x12c
push dword [ebp - 0x2c]
push 0x7d0
push dword [0x42203c]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x24]
push eax
push 1
push 0
push str.SOFTWARESymantecNorton_Utilities7.0Install
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x402b8f
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x34], 0x104
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x30]
push eax
push 0
push str.InstallDir
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
jne 0x402b8f
push str.NPROTECT.VXD
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x10]
call fcn.0040a83f
pop ecx
neg eax
sbb eax, eax
neg eax
add eax, 0x7d1
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x14], 0
je 0x402b9c
mov dword [ebp - 0x28], 0x7d1
push 0x12c
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [0x42203c]
call dword [sym.imp.USER32.dll_LoadStringA]
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp dword [0x422058], 0
je 0x402bd8
mov eax, dword [0x422058]
mov dword [ebp - 0x60], eax
jmp 0x402be0
mov eax, dword [0x422040]
mov dword [ebp - 0x60], eax
push 0x10010
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp - 0x60]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
call fcn.0040b71d
pop ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x50], eax
push dword [ebp - 0x50]
call fcn.0040b71d
pop ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x54], eax
push dword [ebp - 0x54]
call fcn.0040b71d
pop ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x58], eax
push dword [ebp - 0x58]
call fcn.0040b71d
pop ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x5c], eax
push dword [ebp - 0x5c]
call fcn.0040b71d
pop ecx
xor eax, eax
jmp 0x402c51
push str.NprotectVxD_successfully_loaded
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
push 1
pop eax
leave
ret