Function at 0x443a00
Capabilities:
Link many functions at runtime
Query or enumerate registry value
Set registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x561898
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x178
mov eax, dword [0x5b0514]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x5ba980]
push str.ntdll.dll
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x6c], 0
lea edi, [eax + 0x5b0]
mov dword [ebp - 0x68], 0
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x443a9a
push str.RtlGetNtVersionNumbers
push esi
mov dword [ebp - 0x20], 0
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x443a93
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x68]
push ecx
lea ecx, [ebp - 0x6c]
push ecx
call eax
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push dword [ebp - 0x68]
lea eax, [ebp - 0x184]
push dword [ebp - 0x6c]
push str._d._d
push eax
call fcn.00413710
mov esi, eax
add esp, 0x10
cmp edi, esi
je 0x443ae4
mov ecx, edi
call fcn.00407320
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x170]
cmp edx, 8
jb 0x443b24
mov ecx, dword [ebp - 0x184]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x443b1a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44461b
push edx
push ecx
call fcn.00497cc1
add esp, 8
xor eax, eax
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x170], 7
mov word [ebp - 0x184], ax
call fcn.00415510
call fcn.00416750
push 0x58d1ac
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x443b74
push 0x58d1ac
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x443bd4
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.GetNativeSystemInfo
push esi
call edi
test eax, eax
je 0x443bb7
xorps xmm0, xmm0
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x64]
push ecx
movups xmmword [ebp - 0x64], xmm0
movups xmmword [ebp - 0x54], xmm0
call eax
mov ax, word [ebp - 0x64]
cmp ax, 9
je 0x443bae
cmp ax, 6
jne 0x443bda
mov dword [ebp - 0x1c], 1
jmp 0x443bda
push str.IsWow64Process
push esi
call edi
mov esi, eax
test esi, esi
je 0x443bda
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call esi
jmp 0x443bda
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp dword [ebp - 0x1c], 0
setne al
movzx eax, al
push eax
push 1
push str.General
call fcn.0043b040
push 1
push 2
push str.General
call fcn.0043b040
push 0
push 3
push str.General
call fcn.0043b040
push 0
push 4
push str.General
call fcn.0043b040
push 0x45
xor eax, eax
mov dword [ebp - 0x90], 0
push str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x8c], 7
mov word [ebp - 0xa0], ax
call fcn.00410900
mov esi, dword [ebp - 0x7c]
lea ecx, [ebp - 0xa0]
add esi, 0x5e0
mov dword [ebp - 4], 0
push esi
xor edx, edx
call fcn.0040ba60
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov edx, dword [ebp - 0x8c]
cmp edx, 8
jb 0x443cb2
mov ecx, dword [ebp - 0xa0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x443ca8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x444620
push edx
push ecx
call fcn.00497cc1
add esp, 8
xor eax, eax
mov dword [ebp - 0x90], 0
push 0x46
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x8c], 7
mov word [ebp - 0xa0], ax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], ax
call fcn.00410900
push esi
xor edx, edx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xb8]
call fcn.0040ba60
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov edx, dword [ebp - 0xa4]
cmp edx, 8
jb 0x443d57
mov ecx, dword [ebp - 0xb8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x443d4d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x444625
push edx
push ecx
call fcn.00497cc1
add esp, 8
push 1
xor eax, eax
mov dword [ebp - 0xa8], 0
push str.General
mov dword [ebp - 0xa4], 7
mov word [ebp - 0xb8], ax
call fcn.0043b1e0
test eax, eax
je 0x443ede
push 0x45
xor eax, eax
mov dword [ebp - 0xc0], 0
push str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xbc], 7
mov word [ebp - 0xd0], ax
call fcn.00410900
push esi
mov edx, 1
mov dword [ebp - 4], 2
lea ecx, [ebp - 0xd0]
call fcn.0040ba60
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov edx, dword [ebp - 0xbc]
cmp edx, 8
jb 0x443e19
mov ecx, dword [ebp - 0xd0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x443e0f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44462a
push edx
push ecx
call fcn.00497cc1
add esp, 8
xor eax, eax
mov dword [ebp - 0xc0], 0
push 0x46
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xbc], 7
mov word [ebp - 0xd0], ax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.00410900
push esi
mov edx, 1
mov dword [ebp - 4], 3
lea ecx, [ebp - 0xe8]
call fcn.0040ba60
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov edx, dword [ebp - 0xd4]
cmp edx, 8
jb 0x443ec1
mov ecx, dword [ebp - 0xe8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x443eb7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44462f
push edx
push ecx
call fcn.00497cc1
add esp, 8
xor eax, eax
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
push 0x1a
xor eax, eax
mov dword [ebp - 0xf0], 0
push str.HKEY_CURRENT_USERSOFTWARE
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.00410900
mov esi, dword [ebp - 0x7c]
lea ecx, [ebp - 0x100]
add esi, 0x5ec
mov dword [ebp - 4], 4
push esi
xor edx, edx
call fcn.0040ba60
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov edx, dword [ebp - 0xec]
cmp edx, 8
jb 0x443f75
mov ecx, dword [ebp - 0x100]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x443f6b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x444634
push edx
push ecx
call fcn.00497cc1
add esp, 8
xor eax, eax
mov dword [ebp - 0xf0], 0
push 0x1b
push str.HKEY_LOCAL_MACHINESOFTWARE
lea ecx, [ebp - 0x118]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], 7
mov word [ebp - 0x118], ax
call fcn.00410900
push esi
xor edx, edx
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x118]
call fcn.0040ba60
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov edx, dword [ebp - 0x104]
cmp edx, 8
jb 0x44401a
mov ecx, dword [ebp - 0x118]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x444010
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x444639
push edx
push ecx
call fcn.00497cc1
add esp, 8
push 1
xor eax, eax
mov dword [ebp - 0x108], 0
push str.General
mov dword [ebp - 0x104], 7
mov word [ebp - 0x118], ax
call fcn.0043b1e0
test eax, eax
je 0x4441a1
push 0x1a
xor eax, eax
mov dword [ebp - 0x120], 0
push str.HKEY_CURRENT_USERSOFTWARE
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x11c], 7
mov word [ebp - 0x130], ax
call fcn.00410900
push esi
mov edx, 1
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x130]
call fcn.0040ba60
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov edx, dword [ebp - 0x11c]
cmp edx, 8
jb 0x4440dc
mov ecx, dword [ebp - 0x130]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4440d2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44463e
push edx
push ecx
call fcn.00497cc1
add esp, 8
xor eax, eax
mov dword [ebp - 0x120], 0
push 0x1b
push str.HKEY_LOCAL_MACHINESOFTWARE
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x11c], 7
mov word [ebp - 0x130], ax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], 7
mov word [ebp - 0x148], ax
call fcn.00410900
push esi
mov edx, 1
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x148]
call fcn.0040ba60
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov edx, dword [ebp - 0x134]
cmp edx, 8
jb 0x444184
mov ecx, dword [ebp - 0x148]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44417a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x444643
push edx
push ecx
call fcn.00497cc1
add esp, 8
xor eax, eax
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 7
mov word [ebp - 0x148], ax
push str.kernel32.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x4441e0
push str.GetSystemFirmwareTable
push esi
call edi
push str.EnumSystemFirmwareTables
push esi
mov dword [0x5ba970], eax
call edi
cmp dword [0x5ba970], 0
mov dword [0x5ba96c], eax
je 0x4441e0
test eax, eax
je 0x4441e0
mov esi, 1
jmp 0x4441e2
xor esi, esi
call fcn.004153b0
test eax, eax
jne 0x4441f4
call fcn.00415450
test eax, eax
je 0x444202
push 1
push 0
push str.Status
call fcn.0043b040
test esi, esi
je 0x4444ad
lea eax, [ebp - 0x80]
mov dword [ebp - 0x70], 0
push eax
xor edx, edx
mov dword [ebp - 0x80], 0
mov ecx, 0x52534d42
call fcn.0043a530
mov esi, eax
add esp, 4
test esi, esi
je 0x444292
mov edi, dword [ebp - 0x80]
mov edx, 0xa
push edi
push esi
mov ecx, str.VirtualBox
call fcn.0043a490
add esp, 8
test eax, eax
jne 0x444278
push edi
push esi
lea edx, [eax + 4]
mov ecx, str.vbox
call fcn.0043a490
add esp, 8
test eax, eax
jne 0x444278
push edi
push esi
lea edx, [eax + 4]
mov ecx, str.VBOX
call fcn.0043a490
add esp, 8
test eax, eax
je 0x44427f
mov dword [ebp - 0x70], 1
push esi
call fcn.0052ad51
add esp, 4
cmp dword [ebp - 0x70], 0
jne 0x44449f
xor edi, edi
push 0x1000
mov dword [ebp - 0x84], edi
call fcn.0052ad56
add esp, 4
mov dword [ebp - 0x78], eax
mov edx, 0x1000
mov ecx, eax
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub edx, 1
jne 0x4442b1
push 0x1000
push eax
push 0x41435049
call dword [0x5ba96c]
mov ecx, eax
shr ecx, 2
mov dword [ebp - 0x74], ecx
cmp eax, 4
jb 0x44437f
test ecx, ecx
je 0x44437f
xor esi, esi
test ecx, ecx
je 0x444384
lea eax, [ebp - 0x70]
mov dword [ebp - 0x70], 0
push eax
mov eax, dword [ebp - 0x78]
mov ecx, 0x41435049
mov edx, dword [eax + esi*4]
call fcn.0043a530
add esp, 4
mov edi, eax
mov edx, 0xa
mov ecx, str.VirtualBox
push dword [ebp - 0x70]
push edi
call fcn.0043a490
add esp, 8
test eax, eax
jne 0x44435a
push dword [ebp - 0x70]
lea edx, [eax + 4]
mov ecx, str.vbox
push edi
call fcn.0043a490
add esp, 8
test eax, eax
jne 0x44435a
push dword [ebp - 0x70]
lea edx, [eax + 4]
mov ecx, str.VBOX
push edi
call fcn.0043a490
add esp, 8
test eax, eax
je 0x444364
mov dword [ebp - 0x84], 1
push edi
call fcn.0052ad51
inc esi
add esp, 4
cmp esi, dword [ebp - 0x74]
jb 0x4442f0
mov edi, dword [ebp - 0x84]
jmp 0x444384
mov edi, 1
push dword [ebp - 0x78]
call fcn.0052ad51
add esp, 4
test edi, edi
jne 0x44449f
lea eax, [ebp - 0x74]
mov dword [ebp - 0x74], edi
push eax
xor edx, edx
mov ecx, 0x52534d42
call fcn.0043a530
mov edi, eax
add esp, 4
test edi, edi
je 0x4443d9
push dword [ebp - 0x74]
mov edx, 6
mov ecx, str.VMware
push edi
call fcn.0043a490
push edi
mov esi, eax
call fcn.0052ad51
add esp, 0xc
test esi, esi
jne 0x44449f
push 0x1000
xor edi, edi
call fcn.0052ad56
mov esi, eax
add esp, 4
mov dword [ebp - 0x78], esi
mov edx, 0x1000
mov ecx, esi
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub edx, 1
jne 0x4443f4
push 0x1000
push esi
push 0x41435049
call dword [0x5ba96c]
mov ecx, eax
shr ecx, 2
mov dword [ebp - 0x20], ecx
cmp eax, 4
jb 0x44448d
test ecx, ecx
je 0x44448d
xor eax, eax
mov dword [ebp - 0x74], eax
test ecx, ecx
je 0x444492
nop word [eax + eax]
mov edx, dword [esi + eax*4]
lea ecx, [ebp - 0x88]
push ecx
mov ecx, 0x41435049
mov dword [ebp - 0x88], 0
call fcn.0043a530
add esp, 4
mov esi, eax
mov edx, 6
mov ecx, str.VMWARE
push dword [ebp - 0x88]
push esi
call fcn.0043a490
test eax, eax
mov eax, 1
push esi
cmovne edi, eax
call fcn.0052ad51
mov eax, dword [ebp - 0x74]
add esp, 0xc
mov esi, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x74], eax
cmp eax, dword [ebp - 0x20]
jb 0x444430
jmp 0x444492
mov edi, 1
push esi
call fcn.0052ad51
add esp, 4
test edi, edi
je 0x4444ad
push 1
push 0
push str.Status
call fcn.0043b040
xor edi, edi
mov dword [ebp - 0x16c], 3
mov dword [ebp - 0x168], 4
xor esi, esi
mov dword [ebp - 0x164], 6
mov dword [ebp - 0x160], 5
mov dword [ebp - 0x15c], 0xa
mov dword [ebp - 0x158], 0xb
mov dword [ebp - 0x154], 7
mov dword [ebp - 0x150], 9
mov dword [ebp - 0x14c], 8
nop dword [eax + eax]
push dword [ebp + esi*4 - 0x16c]
push str.Status
call fcn.0043b1e0
test eax, eax
je 0x444528
bts edi, esi
inc esi
cmp esi, 9
jb 0x444510
mov esi, dword [ebp - 0x7c]
mov ecx, esi
mov dword [esi + 0x5fc], edi
call fcn.00444650
push str.UIDowner
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x18], 0
push str.Software_s
push eax
mov dword [ebp - 0x24], 4
call fcn.00413710
add esp, 0xc
lea ecx, [ebp - 0x24]
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x40]
push ecx
push str.usestime
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 4
lea ecx, [ebp - 0x18]
test eax, eax
push ecx
push 4
push str.usestime
lea eax, [ebp - 0x3c]
jne 0x4445a3
inc dword [ebp - 0x18]
jmp 0x4445aa
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x28], 8
cmovae eax, dword [ebp - 0x3c]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x5f8], eax
cmp edx, 8
jb 0x4445fd
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4445f3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x444648
push edx
push ecx
call fcn.00497cc1
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00497cb0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
int3