Function at 0x425cc0
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba7dd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xa8
mov eax, dword [0x4ff684]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x28], edi
xor esi, esi
mov dword [edi + 0xc], 0
mov byte [ebp - 0x9e], 0
mov byte [ebp - 0x9d], 0
mov dword [ebp - 0xac], esi
cmp dword [edi], esi
je 0x426312
mov eax, dword [edi + 4]
test eax, eax
je 0x426312
cmp eax, 0x8000
ja 0x426312
inc eax
mov edx, 0x105
cmp eax, edx
cmova edx, eax
xor ecx, ecx
mov dword [ebp - 0xa8], edx
mov eax, edx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004964ef
add esp, 4
mov dword [edi + 0xc], eax
test eax, eax
jne 0x425d7c
lea eax, [esi + 0xe]
jmp 0x426317
push dword [ebp - 0xa8]
push 0
push eax
call fcn.0048b4c0
add esp, 0xc
cmp dword [edi + 4], 2
jbe 0x425ec3
mov eax, dword [edi]
mov dword [ebp - 0xb8], eax
cmp word [eax], 0x5c
je 0x425ec3
cmp word [eax + 2], 0x3a
je 0x425ec3
mov eax, dword [edi + 0xc]
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0x9c]
push eax
push 0x20219
push 0
push str.SoftwareMcAfeeSystemCore
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
test eax, eax
cmove ecx, dword [ebp - 0x9c]
mov dword [ebp - 0xb4], ecx
test ecx, ecx
je 0x425e92
mov eax, dword [ebp - 0xa8]
add eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0xa4]
lea eax, [ebp - 0x48]
push eax
push 0
push str.szInstallDir32
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xb0], eax
test eax, eax
jne 0x425e7a
mov eax, dword [ebp - 0xa4]
test eax, eax
je 0x425e7a
push 0x4ea02c
push dword [ebp - 0xa8]
push eax
call fcn.004257c0
test eax, eax
js 0x425e64
mov eax, dword [ebp - 0xb8]
test eax, eax
je 0x425e7a
push eax
push dword [ebp - 0xa8]
push dword [ebp - 0xa4]
call fcn.004257c0
test eax, eax
jns 0x425e7a
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 0xb4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x425e92
push dword [ebp - 0xb4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xb0], esi
je 0x425f3b
push dword [edi + 0xc]
call fcn.0048f500
add esp, 4
mov dword [edi + 0xc], esi
mov dword [ebp - 0xa8], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f
mov esi, 2
mov dword [ebp - 0xac], esi
setne byte [ebp - 0x9d]
jmp 0x425f3b
mov eax, dword [edi]
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa8]
test eax, eax
je 0x425f34
cmp eax, 0x7fffffff
ja 0x425f2f
mov esi, SysReAllocString
mov edx, eax
sub esi, eax
sub dword [ebp - 0xa4], ecx
mov dword [ebp - 0xb0], esi
mov esi, dword [ebp - 0xa4]
mov edi, dword [ebp - 0xb0]
lea eax, [edi + edx]
test eax, eax
je 0x425f1b
movzx eax, word [esi + ecx]
test ax, ax
je 0x425f1b
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x425f00
mov edi, dword [ebp - 0x28]
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
xor esi, esi
mov word [eax], cx
jmp 0x425f34
xor eax, eax
mov word [ecx], ax
mov byte [ebp - 0x9e], 1
mov eax, dword [edi + 8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x2c], 0
movq qword [ebp - 0x34], xmm0
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
cmp byte [ebp - 0x9d], 0
mov dword [ebp - 4], 0
je 0x425fad
push str.NCPrivateLoadAndValidateMPTDll:_Looking_in_current_directory_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, edi
call fcn.00425b00
mov esi, eax
mov dword [ebp - 0xac], esi
jmp 0x42602e
cmp dword [edi + 0xc], 0
je 0x42602e
push 0x50
lea eax, [ebp - 0x98]
push 0
push eax
call fcn.0048b4c0
mov eax, dword [edi + 0xc]
add esp, 0xc
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x90]
push 0x44
push 0
push eax
call fcn.0048b4c0
add esp, 8
lea ecx, [ebp - 0x98]
call fcn.00427690
cmp byte [ebp - 0x98], 0
mov esi, eax
mov dword [ebp - 0xac], esi
je 0x42602e
lea eax, [ebp - 0x80]
mov dword [ebp - 0x24], 0xaac56b
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0x11d0cd44
push eax
push 0
mov dword [ebp - 0x1c], 0xc000c28c
mov dword [ebp - 0x18], 0xee95c24f
mov dword [ebp - 0x64], 2
call dword [sym.imp.WINTRUST.dll_WinVerifyTrust]
cmp esi, 2
je 0x42603f
cmp esi, 0x80092003
jne 0x426181
cmp byte [ebp - 0x9e], 0
jne 0x426181
push str.NCPrivateLoadAndValidateMPTDll:_Looking_in_EXE_directory_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0xac]
push eax
lea ecx, [ebp - 0x44]
call fcn.00425a10
test eax, eax
je 0x42617b
push 0
lea ecx, [ebp - 0x44]
call fcn.00425a10
mov eax, dword [ebp - 0x34]
mov esi, dword [edi + 4]
add eax, 2
mov ecx, dword [edi + 0xc]
add esi, eax
test ecx, ecx
je 0x4260a2
cmp dword [ebp - 0xa8], esi
jae 0x4260c8
push ecx
call fcn.0048f500
add esp, 4
mov dword [edi + 0xc], 0
xor ecx, ecx
mov dword [ebp - 0xa8], esi
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004964ef
add esp, 4
mov dword [edi + 0xc], eax
mov ecx, eax
mov esi, 0xe
test ecx, ecx
je 0x4261ab
mov esi, dword [edi]
lea ecx, [ebp - 0x44]
push 0
call fcn.00425a10
push esi
push eax
push str._ls_ls
push dword [ebp - 0xa8]
push dword [edi + 0xc]
call fcn.00425870
add esp, 0x14
test eax, eax
js 0x426174
push 0x50
lea eax, [ebp - 0x98]
push 0
push eax
call fcn.0048b4c0
mov eax, dword [edi + 0xc]
add esp, 0xc
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x90]
push 0x44
push 0
push eax
call fcn.0048b4c0
add esp, 8
lea ecx, [ebp - 0x98]
call fcn.00427690
cmp byte [ebp - 0x98], 0
mov esi, eax
je 0x426181
lea eax, [ebp - 0x80]
mov dword [ebp - 0x24], 0xaac56b
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0x11d0cd44
push eax
push 0
mov dword [ebp - 0x1c], 0xc000c28c
mov dword [ebp - 0x18], 0xee95c24f
mov dword [ebp - 0x64], 2
call dword [sym.imp.WINTRUST.dll_WinVerifyTrust]
jmp 0x426181
mov esi, 0x6f
jmp 0x4261ab
mov esi, dword [ebp - 0xac]
cmp esi, 0x800b010e
jg 0x4261a3
je 0x4262b3
cmp esi, 0x80092026
je 0x4262b3
cmp esi, 0x800b0101
jmp 0x4261a5
test esi, esi
je 0x4262b3
mov eax, dword [edi + 0xc]
mov dword [ebp - 0xa4], eax
test eax, eax
jne 0x4261c0
mov ecx, dword [edi]
mov dword [ebp - 0xa4], ecx
push 0
lea ecx, [ebp - 0x44]
call fcn.00425970
test eax, eax
je 0x42629a
mov eax, dword [ebp - 0xa4]
test eax, eax
je 0x42629a
mov ecx, 0x8000
cmp word [eax], 0
je 0x4261f3
add eax, 2
sub ecx, 1
jne 0x4261e5
mov eax, 0x8000
mov edx, ecx
sub eax, ecx
neg edx
sbb edx, edx
and edx, eax
mov dword [ebp - 0xb0], edx
test ecx, ecx
je 0x42629a
push 0
lea ecx, [ebp - 0x44]
call fcn.00425970
mov ecx, dword [ebp - 0xb0]
mov edx, 2
mov eax, dword [ebp - 0x3c]
add ecx, 0x200
add eax, ecx
xor ecx, ecx
mov dword [ebp - 0xb0], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004964ef
add esp, 4
mov dword [ebp - 0xac], eax
test eax, eax
je 0x42629a
push 0
lea ecx, [ebp - 0x44]
call fcn.00425970
mov ecx, dword [ebp - 0xa4]
push esi
push ecx
push eax
push str.NotComDllGetInterface:__ls_loading__ls__WinVerifyTrust_failed_with__08x_n
push dword [ebp - 0xb0]
push dword [ebp - 0xac]
call fcn.00425870
add esp, 0x18
push dword [ebp - 0xac]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [ebp - 0xac]
call fcn.0048f500
add esp, 4
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4262ee
push eax
call fcn.0048f500
add esp, 4
mov dword [edi + 0xc], 0
jmp 0x4262ee
mov eax, dword [edi + 0xc]
xor esi, esi
test eax, eax
je 0x4262e9
push 8
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [edi + 0x10], eax
test eax, eax
jne 0x4262ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [edi + 0xc]
mov esi, eax
call fcn.0048f500
add esp, 4
mov dword [edi + 0xc], 0
jmp 0x4262ee
mov esi, 0x54f
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4262fe
push eax
call fcn.004892ec
add esp, 4
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x42630e
push eax
call fcn.004892ec
add esp, 4
mov eax, esi
jmp 0x426317
mov eax, 0x57
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00488f07
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret