Function at 0x438010
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d955a
mov eax, dword fs:[0]
push eax
sub esp, 0x3a4
mov eax, dword [0x65afd4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push str.srl::Applications::Detect
lea ecx, [ebp - 0xc0]
call fcn.004128a0
mov dword [ebp - 4], 0
call fcn.00419ac0
cmp dword [eax + 4], 4
jl 0x43806f
push ecx
lea ecx, [ebp - 0xc0]
call fcn.00411500
mov byte [ebp - 4], 1
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov byte [ebp - 0x34c], 0
mov byte [ebp - 4], 2
push 0
push 0x116f3
lea ecx, [ebp - 0xa4]
call fcn.0041b320
mov byte [ebp - 4], 3
push 0
lea ecx, [ebp - 0x350]
push ecx
push eax
call fcn.004475a0
mov byte [ebp - 4], 4
mov dword [ebp - 0xa4], vtable.srl::GroupID.0
lea ecx, [ebp - 0x9c]
call fcn.004076c4
mov byte [ebp - 4], 5
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 1
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov byte [ebp - 0x354], 0
mov byte [ebp - 4], 6
push 0
push 0x116f5
lea ecx, [ebp - 0x7c]
call fcn.0041b320
mov byte [ebp - 4], 7
push 0
lea ecx, [ebp - 0x358]
push ecx
push eax
call fcn.004475a0
mov byte [ebp - 4], 8
mov dword [ebp - 0x7c], vtable.srl::GroupID.0
lea ecx, [ebp - 0x74]
call fcn.004076c4
mov byte [ebp - 4], 9
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 1
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov byte [ebp - 0x35c], 0
mov byte [ebp - 4], 0xa
push 0
push 0x116f7
lea ecx, [ebp - 0x2f0]
call fcn.0041b320
mov byte [ebp - 4], 0xb
push 0
lea ecx, [ebp - 0x360]
push ecx
push eax
call fcn.004475a0
mov byte [ebp - 4], 0xc
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x2e8]
call fcn.004076c4
mov byte [ebp - 4], 0xd
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 1
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov byte [ebp - 0x364], 0
mov byte [ebp - 4], 0xe
push 0
push 0x116f9
lea ecx, [ebp - 0x318]
call fcn.0041b320
mov byte [ebp - 4], 0xf
push 0
lea ecx, [ebp - 0x368]
push ecx
push eax
call fcn.004475a0
mov byte [ebp - 4], 0x10
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x310]
call fcn.004076c4
mov byte [ebp - 4], 0x11
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 1
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov byte [ebp - 0x36c], 0
mov byte [ebp - 4], 0x12
push 0
push 0x116fb
lea ecx, [ebp - 0x340]
call fcn.0041b320
mov byte [ebp - 4], 0x13
push 0
lea ecx, [ebp - 0x370]
push ecx
push eax
call fcn.004475a0
mov byte [ebp - 4], 0x14
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x338]
call fcn.004076c4
mov byte [ebp - 4], 0x15
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 1
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov byte [ebp - 0x374], 0
mov byte [ebp - 4], 0x16
push 0
push 0x11702
lea ecx, [ebp - 0xe8]
call fcn.0041b320
mov byte [ebp - 4], 0x17
push 0
lea ecx, [ebp - 0x378]
push ecx
push eax
call fcn.004475a0
mov byte [ebp - 4], 0x18
mov dword [ebp - 0xe8], vtable.srl::GroupID.0
lea ecx, [ebp - 0xe0]
call fcn.004076c4
mov byte [ebp - 4], 0x19
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 1
mov dword [ebp - 0x3b0], 0
mov dword [ebp - 0x3ac], 0
mov dword [ebp - 0x3a8], 0
mov byte [ebp - 4], 0x1a
push 0x20019
push str.SOFTWAREMacromediaFlashPlayer
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x3b0]
call fcn.0042f890
test eax, eax
jne 0x4384ce
mov dword [ebp - 0x3a4], 0x28
lea eax, [ebp - 0x3a4]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34c]
push eax
push 0
push str.CurrentVersion
mov edi, dword [ebp - 0x3b0]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4384d4
mov eax, dword [ebp - 0x34c]
cmp eax, 1
je 0x4383d0
cmp eax, 2
jne 0x4384d4
mov eax, dword [ebp - 0x3a4]
test eax, eax
je 0x4383f1
test al, 1
jne 0x4384d4
shr eax, 1
cmp word [ebp + eax*2 - 0x3e], 0
je 0x4383f7
jmp 0x4384d4
xor eax, eax
mov word [ebp - 0x3c], ax
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov byte [ebp - 0x37c], 1
mov byte [ebp - 4], 0x1b
push 0
push 0x116f1
lea ecx, [ebp - 0x110]
call fcn.0041b320
mov byte [ebp - 4], 0x1c
push 0
lea ecx, [ebp - 0x380]
push ecx
push eax
call fcn.004475a0
mov byte [ebp - 4], 0x1d
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x108]
call fcn.004076c4
mov byte [ebp - 4], 0x1e
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x348]
call fcn.0045af20
mov esi, eax
mov byte [ebp - 4], 0x1f
push 0
push 0x116f2
lea ecx, [ebp - 0x138]
call fcn.0041b320
mov byte [ebp - 4], 0x20
push 0
push esi
push eax
call fcn.004475a0
mov byte [ebp - 4], 0x21
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x130]
call fcn.004076c4
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x348]
call fcn.0045b200
jmp 0x4384d4
mov edi, dword [ebp - 0x3b0]
lea ecx, [ebp - 0x54]
call fcn.00407bea
mov byte [ebp - 4], 0x22
push str.wmplayer.exe
lea ecx, [ebp - 0x6c]
call fcn.004076f8
mov byte [ebp - 4], 0x23
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.00437a40
mov bl, al
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x6c]
call fcn.004076c4
test bl, bl
je 0x438612
lea ecx, [ebp - 0x6c]
call fcn.00407bea
mov byte [ebp - 4], 0x24
lea edx, [ebp - 0x6c]
lea ecx, [ebp - 0x54]
call fcn.004378c0
test al, al
je 0x438606
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov byte [ebp - 0x384], 1
mov byte [ebp - 4], 0x25
push 0
push 0x116f3
lea ecx, [ebp - 0x160]
call fcn.0041b320
mov byte [ebp - 4], 0x26
push 0
lea ecx, [ebp - 0x388]
push ecx
push eax
call fcn.004475a0
mov byte [ebp - 4], 0x27
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x158]
call fcn.004076c4
mov byte [ebp - 4], 0x28
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 0x24
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x348]
call fcn.0045b070
mov esi, eax
mov byte [ebp - 4], 0x29
push 0
push 0x11611
lea ecx, [ebp - 0x188]
call fcn.0041b320
mov byte [ebp - 4], 0x2a
push 0
push esi
push eax
call fcn.004475a0
mov byte [ebp - 4], 0x2b
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x180]
call fcn.004076c4
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x348]
call fcn.0045b200
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x6c]
call fcn.004076c4
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x54]
cmp dword [ebp - 0x40], 8
cmovae eax, dword [ebp - 0x54]
xor ecx, ecx
mov word [eax], cx
push str.AcroRd32.exe
lea ecx, [ebp - 0x6c]
call fcn.004076f8
mov byte [ebp - 4], 0x2c
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.00437a40
mov bl, al
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x6c]
call fcn.004076c4
test bl, bl
je 0x43875b
lea ecx, [ebp - 0x6c]
call fcn.00407bea
mov byte [ebp - 4], 0x2d
lea edx, [ebp - 0x6c]
lea ecx, [ebp - 0x54]
call fcn.004378c0
test al, al
je 0x43874f
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov byte [ebp - 0x38c], 1
mov byte [ebp - 4], 0x2e
push 0
push 0x116f5
lea ecx, [ebp - 0x1b0]
call fcn.0041b320
mov byte [ebp - 4], 0x2f
push 0
lea ecx, [ebp - 0x390]
push ecx
push eax
call fcn.004475a0
mov byte [ebp - 4], 0x30
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x1a8]
call fcn.004076c4
mov byte [ebp - 4], 0x31
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 0x2d
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x348]
call fcn.0045b070
mov esi, eax
mov byte [ebp - 4], 0x32
push 0
push 0x116f6
lea ecx, [ebp - 0x1d8]
call fcn.0041b320
mov byte [ebp - 4], 0x33
push 0
push esi
push eax
call fcn.004475a0
mov byte [ebp - 4], 0x34
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x1d0]
call fcn.004076c4
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x348]
call fcn.0045b200
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x6c]
call fcn.004076c4
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x54]
cmp dword [ebp - 0x40], 8
cmovae eax, dword [ebp - 0x54]
xor ecx, ecx
mov word [eax], cx
push str.QuickTimePlayer.exe
lea ecx, [ebp - 0x6c]
call fcn.004076f8
mov byte [ebp - 4], 0x35
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.00437a40
mov bl, al
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x6c]
call fcn.004076c4
test bl, bl
je 0x4388a4
lea ecx, [ebp - 0x6c]
call fcn.00407bea
mov byte [ebp - 4], 0x36
lea edx, [ebp - 0x6c]
lea ecx, [ebp - 0x54]
call fcn.004378c0
test al, al
je 0x438898
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov byte [ebp - 0x394], 1
mov byte [ebp - 4], 0x37
push 0
push 0x116f7
lea ecx, [ebp - 0x200]
call fcn.0041b320
mov byte [ebp - 4], 0x38
push 0
lea ecx, [ebp - 0x398]
push ecx
push eax
call fcn.004475a0
mov byte [ebp - 4], 0x39
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x1f8]
call fcn.004076c4
mov byte [ebp - 4], 0x3a
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 0x36
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x348]
call fcn.0045b070
mov esi, eax
mov byte [ebp - 4], 0x3b
push 0
push 0x116f8
lea ecx, [ebp - 0x228]
call fcn.0041b320
mov byte [ebp - 4], 0x3c
push 0
push esi
push eax
call fcn.004475a0
mov byte [ebp - 4], 0x3d
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x220]
call fcn.004076c4
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x348]
call fcn.0045b200
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x6c]
call fcn.004076c4
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x54]
cmp dword [ebp - 0x40], 8
cmovae eax, dword [ebp - 0x54]
xor ecx, ecx
mov word [eax], cx
push str.Winword.exe
lea ecx, [ebp - 0x6c]
call fcn.004076f8
mov byte [ebp - 4], 0x3e
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.00437a40
mov bl, al
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x6c]
call fcn.004076c4
test bl, bl
je 0x4389ed
lea ecx, [ebp - 0x6c]
call fcn.00407bea
mov byte [ebp - 4], 0x3f
lea edx, [ebp - 0x6c]
lea ecx, [ebp - 0x54]
call fcn.004378c0
test al, al
je 0x4389e1
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov byte [ebp - 0x39c], 1
mov byte [ebp - 4], 0x40
push 0
push 0x116f9
lea ecx, [ebp - 0x250]
call fcn.0041b320
mov byte [ebp - 4], 0x41
push 0
lea ecx, [ebp - 0x3a0]
push ecx
push eax
call fcn.004475a0
mov byte [ebp - 4], 0x42
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x248]
call fcn.004076c4
mov byte [ebp - 4], 0x43
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 0x3f
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x348]
call fcn.0045b070
mov esi, eax
mov byte [ebp - 4], 0x44
push 0
push 0x116fa
lea ecx, [ebp - 0x278]
call fcn.0041b320
mov byte [ebp - 4], 0x45
push 0
push esi
push eax
call fcn.004475a0
mov byte [ebp - 4], 0x46
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x270]
call fcn.004076c4
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x348]
call fcn.0045b200
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x6c]
call fcn.004076c4
lea ecx, [ebp - 0x6c]
call fcn.00407bea
mov byte [ebp - 4], 0x47
push str.3F0FC462_CDC1_4CD9_8E84_84D89B914EAA
lea ecx, [ebp - 0x94]
call fcn.004076f8
mov byte [ebp - 4], 0x48
lea edx, [ebp - 0x6c]
lea ecx, [ebp - 0x94]
call fcn.00437db0
mov bl, al
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x94]
call fcn.004076c4
test bl, bl
je 0x438b09
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov byte [ebp - 0x344], 1
mov byte [ebp - 4], 0x49
push 0
push 0x11702
lea ecx, [ebp - 0x2a0]
call fcn.0041b320
mov byte [ebp - 4], 0x4a
push 0
lea ecx, [ebp - 0x348]
push ecx
push eax
call fcn.004475a0
mov byte [ebp - 4], 0x4b
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x298]
call fcn.004076c4
mov byte [ebp - 4], 0x4c
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 0x47
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x348]
call fcn.0045b070
mov esi, eax
mov byte [ebp - 4], 0x4d
push 0
push 0x11703
lea ecx, [ebp - 0x2c8]
call fcn.0041b320
mov byte [ebp - 4], 0x4e
push 0
push esi
push eax
call fcn.004475a0
mov byte [ebp - 4], 0x4f
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x2c0]
call fcn.004076c4
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x348]
call fcn.0045b200
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x6c]
call fcn.004076c4
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x54]
call fcn.004076c4
mov byte [ebp - 4], 1
test edi, edi
je 0x438b3a
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x3b0], 0
mov dword [ebp - 0x3ac], 0
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0]
call fcn.004127e0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005a8a56
mov esp, ebp
pop ebp
ret