Function at 0x4380d8
Capabilities:
Create thread
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66d44b
mov eax, dword fs:[0]
push eax
mov eax, 0xf520
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0xf524], ebx
mov eax, dword [ebp + 8]
mov esi, dword [0x73daac]
mov edi, dword [0x73dab0]
mov dword [ebp - 0xf508], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xf514], eax
cmp esi, edi
je 0x43815a
push 0x18
pop ebx
mov ecx, esi
call fcn.00444e51
add esi, ebx
cmp esi, edi
jne 0x438137
mov eax, dword [0x73daac]
mov ebx, dword [ebp - 0xf524]
mov dword [0x73dab0], eax
mov eax, dword [ebp - 0xf514]
lea ecx, [ebp - 0xf520]
xor edi, edi
push ecx
push dword [ebp + 0x10]
push edi
push eax
push dword [ebp - 0xf508]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43817f
xor eax, eax
jmp 0x438633
mov esi, edi
jmp 0x43847a
push edi
push edi
push edi
push edi
lea eax, [ebp - 0xf528]
mov dword [ebp - 0xf528], 0x3e8
push eax
lea eax, [ebp - 0x3fc]
push eax
push esi
push dword [ebp - 0xf520]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x438486
cmp byte [ebp - 0x3fc], 0x7b
jne 0x4381da
push 0x6cc52c
push dword [ebp - 0xf514]
call fcn.00639500
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.Policies
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.Classes
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.Clients
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.InstalledOptions
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.Wow6432Node
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.AI_RecycleBin
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.Microsoft
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.Google
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.Adobe
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.Mozilla
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.MozillaPlugins
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.Intel
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.ODBC
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.NVIDIA_Corporation
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.RegisteredApplications
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.Volatile
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.Synaptics
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.SyncIntegrationClients
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.dotnet
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.JavaSoft
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.Caphyon
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push str.Yandex
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x438479
lea eax, [ebp - 0x3fc]
push eax
lea ecx, [ebp - 0xf504]
call fcn.0044441f
mov dword [ebp - 4], edi
lea ecx, [ebp - 0xf504]
mov eax, dword [0x73dab0]
push ecx
cmp eax, dword [0x73dab4]
je 0x43845f
mov ecx, eax
call fcn.004443f8
push 0x18
pop eax
add dword [0x73dab0], eax
jmp 0x43846a
push eax
mov ecx, 0x73daac
call fcn.004460a2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf504]
call fcn.00444e51
inc esi
cmp dword [ebx + 0x5b878], edi
je 0x438186
push dword [ebp - 0xf520]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebx + 0x5b878], edi
jne 0x438630
mov eax, dword [0x73dab0]
mov esi, edi
sub eax, dword [0x73daac]
push 0x18
cdq
pop ecx
idiv ecx
xor edx, edx
mov dword [ebp - 0xf510], edi
push 0x3c
pop ebx
mov ecx, eax
mov dword [ebp - 0xf518], esi
div ebx
mov eax, ecx
mov dword [ebp - 0xf50c], edx
xor edx, edx
div ebx
lea ebx, [ebp - 0xf0f4]
mov dword [ebp - 0xf51c], eax
mov edx, dword [ebp - 0xf50c]
xor ecx, ecx
cmp ecx, edx
sbb ecx, ecx
and dword [ebp - 0xf50c], 0
neg ecx
add ecx, eax
cmp dword [ebp - 0xf50c], edx
lea eax, [edx - 1]
sbb edx, edx
and edx, eax
mov dword [ebp - 0xf50c], edx
test ecx, ecx
je 0x4385ae
mov edx, dword [ebp - 0xf524]
cmp dword [edx + 0x5b878], edi
jne 0x4385ae
mov eax, dword [ebp - 0xf510]
lea esi, [ebx - 0x3f8]
push dword [ebp - 0xf514]
mov dword [ebx - 4], eax
add eax, ecx
mov dword [ebp - 0xf510], eax
dec eax
mov dword [ebx], eax
mov eax, dword [ebp - 0xf508]
mov dword [ebx - 0x3f4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx - 8], eax
lea eax, [ebx - 0x3f0]
push 0x3e8
push eax
mov dword [ebx + 4], ecx
mov dword [esi], edx
call fcn.006494f3
add esp, 0xc
push edi
push 0x10000
push esi
push 0x437c59
push 0x3d090
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [ebp - 0xf518]
add ebx, 0x400
mov dword [ebp + esi*4 - 0x4ec], eax
inc esi
mov eax, dword [ebp - 0xf51c]
mov dword [ebp - 0xf518], esi
cmp esi, 0x3c
jb 0x4384de
mov ecx, esi
mov eax, esi
and ecx, 0x3f
push 0
pop ebx
setne bl
mov dword [ebp - 0xf510], ecx
shr eax, 6
add ebx, eax
je 0x43861a
lea eax, [ebx - 1]
mov esi, edi
lea edx, [ebp - 0x4ec]
mov dword [ebp - 0xf51c], eax
mov dword [ebp - 0xf508], edx
cmp esi, dword [ebp - 0xf51c]
push 0x40
pop eax
push 0xffffffffffffffff
push 1
cmove eax, ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [ebp - 0xf508]
inc esi
mov ecx, dword [ebp - 0xf510]
add edx, 0x100
mov dword [ebp - 0xf508], edx
cmp esi, ebx
jb 0x4385df
mov esi, dword [ebp - 0xf518]
test esi, esi
je 0x438630
push dword [ebp + edi*4 - 0x4ec]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, esi
jb 0x43861e
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.006122f0
leave
ret 0xc