Function at 0x4277e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f12b
mov eax, dword fs:[0]
push eax
sub esp, 0x840
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x840], ebx
push 5
xor eax, eax
mov dword [ebp - 0x848], 0
push str.guanf
lea ecx, [ebp - 0x82c]
mov dword [ebp - 0x818], 7
mov dword [ebp - 0x81c], 0
mov word [ebp - 0x82c], ax
call fcn.00403d10
mov dword [ebp - 4], 0
mov dword [ebp - 0x83c], 0
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
call fcn.00435fa0
test al, al
je 0x4278a5
sal dword [edi - 0x5d], cl
mov esi, dword [edi + 0x48]
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x83c]
push eax
push 0x20119
push 0
push str.SoftWare
push reloc.WS2_32.dll_bind
call esi
test eax, eax
je 0x42790f
xor eax, eax
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov ecx, ebx
mov word [ebx], ax
lea eax, [ebp - 0x82c]
push eax
call fcn.00403f30
mov ecx, dword [ebp - 0x818]
cmp ecx, 8
jb 0x427908
inc ecx
push ecx
push dword [ebp - 0x82c]
lea ecx, [ebp - 0x82c]
call fcn.00404090
mov eax, ebx
jmp 0x427bbb
call fcn.004360f0
test al, al
je 0x427939
and esi, edi
loopne 0x427947
mov ah, 0xf
jno 0x42795f
call 0xd088195b
invalid
lea eax, [ebp - 0x838]
push eax
push 0x20119
push 0
push 0x619710
push dword [ebp - 0x83c]
call esi
test eax, eax
je 0x4279b0
push dword [ebp - 0x83c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
adc eax, sym.imp.ADVAPI32.dll_RegCloseKey
mov esi, dword [ebp - 0x830]
xor eax, eax
mov ecx, esi
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
lea eax, [ebp - 0x82c]
push eax
call fcn.00403f30
mov eax, dword [ebp - 0x818]
cmp eax, 8
jb 0x4279a9
inc eax
lea ecx, [ebp - 0x82c]
push eax
push dword [ebp - 0x82c]
call fcn.00404090
mov eax, esi
jmp 0x427bbb
lea eax, [ebp - 0x834]
push eax
push 0x20119
push 0
push str.AppInfo
push dword [ebp - 0x838]
call esi
test eax, eax
je 0x427a1e
push dword [ebp - 0x838]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x834]
call esi
mov esi, dword [ebp - 0x830]
xor eax, eax
mov ecx, esi
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
lea eax, [ebp - 0x82c]
push eax
call fcn.00403f30
lea ecx, [ebp - 0x82c]
call fcn.00402d00
mov eax, esi
jmp 0x427bbb
call fcn.00436320
test al, al
je 0x427a47
mov ch, 0x94
fstp qword [ebx - 0x6efd95f0]
adc dword [esi], esi
and al, 0x45
stc
scasb al, byte es:[edi]
xchg edx, eax
scasd eax, dword es:[edi]
loop 0x427a98
dec edi
daa
mov edi, 0x45a194d7
mov bl, 0xc8
and bh, al
pop ds
mov eax, 0xe4e4e890
add byte [eax], al
call fcn.00435f30
test al, al
je 0x427a6c
iretd
push 0x800
lea eax, [ebp - 0x814]
push 0
push eax
call fcn.00576f50
add esp, 0xc
mov dword [ebp - 0x844], 0x400
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x814]
push eax
push 0
push 0
call dword [eax + 0x6a]
add byte [edx], ch
push str.Spreader
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x834]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
call fcn.00435de0
test al, al
je 0x427add
stc
in eax, dx
adc ecx, dword [esi + eax*8 - 0xe]
invalid
dec eax
adc byte [edx], bl
call fcn.00436400
test al, al
je 0x427afc
jg 0x427ad9
int1
xchg edx, eax
or byte [ebx + 0x67], ah
inc ecx
mov word [edx - 0x63], ss
cwde
retf
push dword [ebp - 0x838]
call edi
push dword [ebp - 0x83c]
call edi
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427b15
sub ecx, edx
sar ecx, 1
mov dword [ebp - 0x840], ecx
call fcn.00435ec0
test al, al
je 0x427b43
mov fs, word [eax]
mov edi, 0xc3b6ab76
int 0xf2
bound ecx, qword [0x84071038]
mov bh, 0xe8
or dl, ch
add byte [eax], al
call fcn.00436550
test al, al
je 0x427b63
dec esi
mov esp, 0xcd0772d8
push esp
mov ebp, ebp
sahf
pop es
cwde
push ebx
jae 0x427bd3
int1
mov ch, 0xd4
sub dh, byte [ebp - 0x671703d0]
call 0xc0c67b6a
call fcn.00436400
test al, al
sal byte [edi + ebx - 0x54], 0xf7
iretd
je 0x427b8b
lodsb al, byte [esi]
test edi, 0xdd82f3d
jl 0x427be8
loop 0x427b69
clc
popfd
xor eax, dword [ebp + 0x3e]
popal
cmp byte [ebx - 0x5d3087b], dh
iretd
cmp dword [ebp - 0x840], 0
je 0x4279e5
mov ecx, dword [ebp - 0x830]
lea eax, [ebp - 0x814]
push eax
call fcn.004039f0
lea ecx, [ebp - 0x82c]
call fcn.00402d00
mov eax, dword [ebp - 0x830]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
pop ecx
add byte [ecx], ah
add byte [eax], al
add byte [eax - 0x7f], dl
in al, dx
inc esp
add al, byte [eax]
add byte [ecx + 0x627a40], ah
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x250], edx
mov ebx, ecx
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x24c], 0
push 0
push eax
call fcn.00576f50
add esp, 0xc
call fcn.00436710
test al, al
je 0x427c51
xor dword [eax], ebx
sbb ax, 0xa01d
sbb byte [0xde509022], dh
sub ebp, esi
mov dword fs:[0x3d8b0b45], eax
cmp al, 0x10
pop edx
add byte [ebp - 0x2177b], cl
jmp [eax + 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea eax, [ebp - 0x218]
push 0x104
push eax
xor esi, esi
push esi
push ebx
call edi
test eax, eax
jne 0x427e11
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x427df8
call fcn.00436860
test al, al
je 0x427ca7
nop
pop esp
sbb al, 0xea
and dword [edx + 0x57], edx
push edx
fisttp dword [eax + ebx*2]
ror byte [eax + eax], 1
mov ch, 0xc7
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x427ce5
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x427cd6
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00403d10
lea edx, [ebp - 0x230]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x248]
call int.004280d0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x427d6d
mov ecx, dword [ebp - 0x230]
inc eax
cmp eax, 0x7fffffff
ja 0x427e2d
add eax, eax
cmp eax, 0x1000
jb 0x427d64
test cl, 0x1f
jne 0x427e2d
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x427e2d
sub ecx, eax
cmp ecx, 4
jb 0x427e2d
cmp ecx, 0x23
ja 0x427e2d
mov ecx, eax
push ecx
call fcn.00570ea4
add esp, 4
mov ecx, dword [ebp - 0x250]
lea edx, [ebp - 0x248]
xor eax, eax
mov dword [ebp - 0x21c], 7
cmp dword [ebp - 0x234], 0x10
mov dword [ebp - 0x220], 0
cmovae edx, dword [ebp - 0x248]
mov word [ebp - 0x230], ax
call fcn.00425f30
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x234]
cmp eax, 0x10
jb 0x427df8
mov ecx, dword [ebp - 0x248]
inc eax
cmp eax, 0x1000
jb 0x427def
test cl, 0x1f
jne 0x427e2d
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x427e2d
sub ecx, eax
cmp ecx, 4
jb 0x427e2d
cmp ecx, 0x23
ja 0x427e2d
mov ecx, eax
push ecx
call fcn.00570ea4
add esp, 4
push 0x104
lea eax, [ebp - 0x218]
inc esi
push eax
push esi
push ebx
call edi
test eax, eax
je 0x427c71
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
call fcn.0057d383
int3