Function at 0x4024d1
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
push 8
call fcn.004109fb
add esp, 4
mov dword [ebp - 0x18], eax
mov edi, eax
mov esi, 0x414247
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.00410d10
add esp, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402554
push ebx
call fcn.00410a01
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40256b
mov eax, 0x414246
push eax
push 1
mov ebx, 0x130
call fcn.00410e10
add esp, 0x10
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esp
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [0x414e51]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
nop
nop
nop
nop
cmp dword [ebp - 0x24], esp
je 0x4025b0
push 6
call fcn.00410a07
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x402a83
push str.DisplayName
push dword [ebp - 4]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
mov ecx, 3
call fcn.004022c7
add esp, 0xc
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 0x80000004
push 0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4025f3
mov eax, 0x414246
push eax
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x698
call fcn.00411200
add esp, 0x28
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x402625
push ebx
call fcn.00410a01
add esp, 4
mov eax, dword [ebp - 0x24]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x402639
push ebx
call fcn.00410a01
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
push str.UninstallString
push dword [ebp - 4]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
mov ecx, 3
call fcn.004022c7
add esp, 0xc
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 0x80000004
push 0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x402673
mov eax, 0x414246
push eax
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x698
call fcn.00411200
add esp, 0x28
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x4026a5
push ebx
call fcn.00410a01
add esp, 4
mov eax, dword [ebp - 0x24]
push eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4026b9
push ebx
call fcn.00410a01
add esp, 4
pop eax
mov dword [ebp - 0x14], eax
push 0x80000002
push 0
push 0
push 0
push 0
push 0
push 0x80000004
push 0
push 0x414333
push 0x80000004
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x4026ee
mov eax, 0x414246
push eax
push 4
mov ebx, 0x148
call fcn.004113a0
add esp, 0x34
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
je 0x4029e7
push 0
push 0
push 0
push 0x80000004
push 0
push 0x414342
push 0x80000004
push 0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x402733
mov eax, 0x414246
push eax
push 3
mov ebx, 0x190
call fcn.00411470
add esp, 0x28
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [ebp - 0x18]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x40276b
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x402767
imul eax, dword [ebx]
jmp 0x40275c
mov ecx, eax
test ecx, ecx
je 0x40278a
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x402783
push ebx
push eax
call fcn.00410a01
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x402771
call fcn.00410a01
add esp, 4
pop eax
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x18]
call fcn.00402490
push ebx
push ecx
mov ebx, dword [ebp - 0x18]
call fcn.004024b0
dec eax
jns 0x4027b8
push 4
call fcn.00410a07
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x4027cb
push 1
call fcn.00410a07
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0x24], ebx
push 0x80000002
push 0
push 0
mov ebx, 6
call fcn.004024c9
push 0x80000004
push 0
push 0x414246
push 0x80000004
push 0
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
test eax, eax
jne 0x40280a
mov eax, 0x414246
push eax
push 0x80000004
push 0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x40281e
mov eax, 0x414246
push eax
push 6
mov ebx, 0x180
call fcn.00411710
add esp, 0x4c
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x402848
push ebx
call fcn.00410a01
add esp, 4
pop eax
mov dword [ebp - 0x1c], eax
push 0x80000002
push 0
push 1
mov ebx, 6
call fcn.004024c9
push 0x80000004
push 0
push 0x414246
push 0x80000004
push 0
push 0x4142c0
push 0x80000004
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x40288d
mov eax, 0x414246
push eax
push 6
mov ebx, 0x180
call fcn.00411710
add esp, 0x4c
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4028b7
push ebx
call fcn.00410a01
add esp, 4
pop eax
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
call fcn.00402490
push ebx
push ecx
mov ebx, dword [ebp - 0x18]
call fcn.004024b0
mov dword [ebp - 0x28], eax
fild dword [ebp - 0x28]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
fsub qword [0x41424f]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
call fcn.00401d29
dec eax
jns 0x4028fa
push 4
call fcn.00410a07
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x40290d
push 1
call fcn.00410a07
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 0x34], ebx
push 0x414342
mov ebx, dword [ebp - 0x34]
push dword [ebx]
mov ecx, 2
call fcn.004022c7
add esp, 8
mov dword [ebp - 0x38], eax
push 0x80000002
push 0
push 0
mov ebx, 6
call fcn.004024c9
push 0x80000004
push 0
push 0x414246
push 0x80000004
push 0
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x402964
mov eax, 0x414246
push eax
push 0x80000004
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x402978
mov eax, 0x414246
push eax
push 6
mov ebx, 0x180
call fcn.00411710
add esp, 0x4c
mov dword [ebp - 0x3c], eax
mov ebx, dword [ebp - 0x38]
test ebx, ebx
je 0x40299e
push ebx
call fcn.00410a01
add esp, 4
push str.SogouExeSogouExe.exe
push dword [ebp - 0x3c]
mov ecx, 2
call fcn.004022c7
add esp, 8
mov dword [ebp - 0x40], eax
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x4029c6
push ebx
call fcn.00410a01
add esp, 4
mov eax, dword [ebp - 0x40]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
test ebx, ebx
je 0x4029dc
push ebx
call fcn.00410a01
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
jmp 0x402a83
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.00410d10
add esp, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402a1c
push ebx
call fcn.00410a01
add esp, 4
pop eax
mov dword [ebp - 4], eax
inc dword [ebp - 0xc]
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x402a36
mov eax, 0x414246
push eax
push 1
mov ebx, 0x130
call fcn.00410e10
add esp, 0x10
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esp
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [0x414e51]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
nop
nop
nop
nop
cmp dword [ebp - 0x24], esp
je 0x402a7b
push 6
call fcn.00410a07
add esp, 4
mov dword [ebp - 8], eax
jmp 0x4025b3
mov dword [ebp - 0x20], esp
push dword [0x414e51]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
nop
nop
nop
cmp dword [ebp - 0x20], esp
je 0x402aa8
push 6
call fcn.00410a07
add esp, 4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x402ac4
push eax
mov ebx, eax
call fcn.0040225c
inc eax
push eax
call fcn.004109fb
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x402ac9
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x402ada
push ebx
call fcn.00410a01
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x402aea
push ebx
call fcn.00410a01
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x402afa
push ebx
call fcn.00410a01
add esp, 4
mov ebx, dword [ebp - 0x18]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x402b18
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x402b14
imul eax, dword [ebx]
jmp 0x402b09
mov ecx, eax
test ecx, ecx
je 0x402b37
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x402b30
push ebx
push eax
call fcn.00410a01
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x402b1e
call fcn.00410a01
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x402b4f
push ebx
call fcn.00410a01
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4