Function at 0x425870
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a1bb4
mov eax, dword fs:[0]
push eax
sub esp, 0xf0
mov eax, dword [0x5f237c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xd8], ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xd4], eax
xor eax, eax
mov dword [ebp - 0x80], eax
push str.DisplayName
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x84]
push esi
push eax
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0xdc], ebx
call fcn.00429b10
lea eax, [ebp - 0x78]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x78], 4
push eax
push 0
push str.SystemComponent
push dword [esi]
mov dword [ebp - 0x80], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x84]
or edi, 0xffffffff
cmp dword [ebp - 0x7c], 1
je 0x425ea5
cmp dword [eax - 0xc], 0
je 0x425ea5
test ebx, ebx
je 0x425ea5
push 0xfde9
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.00481080
add esp, 0xc
lea ecx, [ebx + 0x18]
push eax
call fcn.0041ec30
lea ecx, [ebp - 0xb4]
call fcn.00406620
lea eax, [ebp - 0xb4]
push esi
push eax
call fcn.00408ae0
add esp, 8
lea esi, [ebx + 0x48]
mov ecx, esi
push eax
call fcn.0041ec70
lea ecx, [ebp - 0xb4]
call fcn.00406670
cmp dword [ebx + 0x58], 0
je 0x425e9b
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.0056acc0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x4259af
mov esi, dword [esi]
push 0xfde9
lea eax, [ebp - 0xb4]
push esi
push eax
call fcn.00481080
cmp dword [ebp - 0xa0], 0x10
lea ecx, [ebp - 0x74]
push 0x64
push ecx
push dword [ebp - 0xa4]
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0xb4]
push eax
call fcn.0052acd0
lea ecx, [ebp - 0x74]
add esp, 0x1c
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4259f4
sub ecx, edx
lea eax, [ebp - 0x74]
push ecx
push eax
mov ecx, ebx
call fcn.0040ca10
mov ecx, dword [ebp - 0xd8]
lea eax, [ebp - 0x80]
push str.DisplayIcon
push dword [ebp - 0xe0]
push eax
call fcn.00429b10
push 0xfde9
push dword [eax]
lea eax, [ebp - 0x9c]
mov byte [ebp - 4], 2
push eax
call fcn.00481080
add esp, 0xc
lea edi, [ebx + 0x30]
mov ecx, edi
push eax
call fcn.0041ec30
lea ecx, [ebp - 0x9c]
call fcn.00406620
mov edx, dword [ebp - 0x80]
or eax, 0xffffffff
mov byte [ebp - 4], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x425a72
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi + 0x10]
test esi, esi
jne 0x425ad0
push dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd8]
lea eax, [ebp - 0xd4]
push eax
call fcn.00427b20
push 0xfde9
push dword [eax]
lea eax, [ebp - 0x9c]
mov byte [ebp - 4], 3
push eax
call fcn.00481080
add esp, 0xc
mov ecx, edi
push eax
call fcn.0041ec30
lea ecx, [ebp - 0x9c]
call fcn.00406620
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 1
call fcn.00406290
mov esi, dword [ebx + 0x40]
mov eax, dword [edi + 0x14]
mov ecx, edi
mov dword [ebp - 0x7c], edi
cmp eax, 0x10
jb 0x425ae2
mov ecx, dword [edi]
mov dword [ebp - 0x7c], ecx
mov edx, esi
test esi, esi
je 0x425b31
push esi
push 0x2c
push ecx
call fcn.0056c190
add esp, 0xc
mov edx, esi
test eax, eax
je 0x425b2e
sub eax, dword [ebp - 0x7c]
cmp eax, 0xffffffff
je 0x425b35
push eax
push 0
lea eax, [ebp - 0x9c]
mov ecx, edi
push eax
call fcn.0044bd30
push eax
mov ecx, edi
call fcn.0041ec30
lea ecx, [ebp - 0x9c]
call fcn.00406620
mov eax, dword [ebx + 0x44]
mov esi, dword [ebx + 0x40]
jmp 0x425b38
mov eax, dword [edi + 0x14]
mov esi, edx
jmp 0x425b38
mov eax, dword [edi + 0x14]
mov ecx, edi
mov ebx, eax
cmp eax, 0x10
jb 0x425b43
mov ecx, dword [edi]
add ecx, esi
mov dword [ebp - 0x78], ecx
mov ecx, edi
cmp eax, 0x10
jb 0x425b51
mov ecx, dword [edi]
add esi, ecx
mov ecx, edi
cmp eax, 0x10
jb 0x425b5c
mov ecx, dword [edi]
mov eax, esi
sub eax, ecx
push eax
push 0x22
push ecx
call fcn.0056c190
add esp, 0xc
mov ecx, esi
test eax, eax
cmovne ecx, eax
cmp ecx, esi
je 0x425ba9
lea eax, [ecx + 1]
mov dword [ebp - 0x7c], esi
sub dword [ebp - 0x7c], eax
xor edx, edx
cmp eax, esi
mov esi, dword [ebp - 0x7c]
cmova esi, edx
test esi, esi
je 0x425ba9
nop
mov bl, byte [eax]
cmp bl, 0x22
je 0x425b9a
mov byte [ecx], bl
inc ecx
inc edx
inc eax
cmp edx, esi
jne 0x425b90
mov ebx, dword [ebp - 0xdc]
mov ebx, dword [ebx + 0x44]
mov eax, edi
cmp ebx, 0x10
jb 0x425bb2
mov eax, dword [edi]
mov edx, dword [edi + 0x10]
mov esi, ecx
sub esi, eax
cmp edx, esi
jb 0x425ee3
sub dword [ebp - 0x78], ecx
mov eax, edx
mov ecx, dword [ebp - 0x78]
sub eax, esi
cmp eax, ecx
cmovb ecx, eax
mov eax, edi
mov dword [ebp - 0x78], ecx
cmp ebx, 0x10
jb 0x425bdc
mov eax, dword [edi]
lea ecx, [eax + esi]
mov eax, dword [ebp - 0x78]
sub edx, eax
add eax, ecx
mov dword [edi + 0x10], edx
sub edx, esi
inc edx
push edx
push eax
push ecx
call fcn.0056b6d0
add esp, 0xc
cmp dword [edi + 0x10], 0
je 0x425d47
push edi
lea ecx, [ebp - 0x9c]
call fcn.0041c200
cmp dword [edi + 0x14], 0x10
mov edx, edi
mov byte [ebp - 4], 4
jb 0x425c1b
mov edx, dword [edi]
mov eax, dword [edi + 0x10]
test eax, eax
je 0x425c6b
or ecx, 0xffffffff
dec eax
cmp eax, ecx
cmovb ecx, eax
add ecx, edx
cmp byte [ecx], 0x2c
je 0x425c3c
cmp ecx, edx
je 0x425c6b
dec ecx
cmp byte [ecx], 0x2c
jne 0x425c32
sub ecx, edx
cmp ecx, 0xffffffff
je 0x425c6b
push ecx
push 0
lea eax, [ebp - 0xfc]
mov ecx, edi
push eax
call fcn.0044bd30
push eax
lea ecx, [ebp - 0x9c]
call fcn.0041ec30
lea ecx, [ebp - 0xfc]
call fcn.00406620
cmp dword [ebp - 0x88], 0x10
lea eax, [ebp - 0x9c]
push 0xfde9
cmovae eax, dword [ebp - 0x9c]
push eax
lea eax, [ebp - 0xfc]
mov dword [ebp - 0x78], 0
push eax
call fcn.004811c0
add esp, 0xc
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 5
jb 0x425ca7
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x78]
call fcn.0041bd40
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 7
call fcn.00406670
push 0x5af9d4
push 0x5b0150
lea ecx, [ebp - 0x78]
call fcn.0040a130
push str..exe
push dword [ebp - 0x78]
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x425d30
mov ebx, dword [ebp - 0xdc]
push dword [ebp - 0x78]
lea ecx, [ebx + 0x60]
call fcn.00414340
cmp dword [ebx + 0x70], 0
jne 0x425d30
mov ecx, dword [ebp - 0xd8]
lea eax, [ebp - 0xd4]
push str.UninstallString
push dword [ebp - 0xe0]
push eax
call fcn.00429b10
push dword [eax]
lea ecx, [ebx + 0x60]
mov byte [ebp - 4], 8
call fcn.00414340
lea ecx, [ebp - 0xd4]
call fcn.00406290
lea ecx, [ebp - 0x78]
call fcn.00406290
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 1
call fcn.00406620
lea eax, [ebp - 0xcc]
push edi
push eax
call fcn.0046e960
add esp, 8
cmp dword [ebp - 0xbc], 0
mov byte [ebp - 4], 9
je 0x425dc6
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0xcc]
call fcn.0046e330
push str..ico
mov ebx, 1
mov byte [ebp - 4], 0xa
push eax
mov dword [ebp - 0x80], ebx
call fcn.00417b60
add esp, 8
test al, al
jne 0x425dbd
lea eax, [ebp - 0xfc]
push eax
lea ecx, [ebp - 0xcc]
call fcn.0046e330
push str..icon
push eax
mov ebx, 3
call fcn.00417b60
add esp, 8
test al, al
je 0x425dcc
mov byte [ebp - 0xcd], 1
jmp 0x425dd3
mov ebx, dword [ebp - 0xe4]
mov byte [ebp - 0xcd], 0
test bl, 2
je 0x425de6
lea ecx, [ebp - 0xfc]
and ebx, 0xfffffffd
call fcn.00406670
mov dword [ebp - 4], 9
test bl, 1
je 0x425dfd
lea ecx, [ebp - 0x9c]
call fcn.00406670
cmp byte [ebp - 0xcd], 0
je 0x425e78
mov ebx, dword [ebp - 0xd8]
lea eax, [ebx + 0x230]
push eax
push 0
push 0
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.00408300
add esp, 0x14
push 0
lea eax, [ebp - 0x9c]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp - 0xcc]
mov ecx, ebx
push eax
call fcn.004201b0
lea eax, [ebp - 0xfc]
push eax
lea ecx, [ebp - 0x9c]
call fcn.0046ab80
push eax
mov ecx, edi
call fcn.0041ec30
lea ecx, [ebp - 0xfc]
call fcn.00406620
lea ecx, [ebp - 0x9c]
call fcn.00406670
lea ecx, [ebp - 0xcc]
call fcn.00406670
lea ecx, [ebp - 0xb4]
call fcn.00406620
mov eax, dword [ebp - 0x84]
mov bl, 1
or edi, 0xffffffff
jmp 0x425ea7
mov eax, dword [ebp - 0x84]
xor bl, bl
jmp 0x425ea7
xor bl, bl
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x425ec3
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045a51d
mov esp, ebp
pop ebp
ret 0xc
call fcn.0040c2e0
int3