Function at 0x425330
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xffffffffffffffff
push 0x4cb386
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x50a4c0]
xor eax, esp
mov dword [esp + 0x13c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 0x154]
mov dword fs:[0], eax
mov eax, dword [esp + 0x164]
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
cmp byte [esi + 0x964], bl
jne 0x425bef
call fcn.00438730
mov byte [esp + 0x1b], 1
call fcn.00436e80
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
test al, al
je 0x4253c0
call ebp
mov edi, eax
call fcn.00442230
push edi
mov edi, eax
call fcn.00441820
mov ecx, eax
mov eax, str.initruntime_safemode
call fcn.00441d20
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
setne cl
mov byte [esi + 7], cl
call fcn.00436e80
test al, al
je 0x42542b
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov esi, eax
cmp byte [esi], bl
je 0x42542b
mov ecx, esi
call fcn.00441e20
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x425403
mov dword [esi + 4], ebx
jmp 0x42542b
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x42542b
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00436e80
test al, al
je 0x425451
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov ecx, eax
mov eax, str.initruntime_installpath
call fcn.00441d20
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
call fcn.00425f10
test al, al
jne 0x425466
mov byte [esp + 0x1b], bl
call fcn.00436e80
test al, al
je 0x4254c1
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov esi, eax
cmp byte [esi], bl
je 0x4254c1
mov ecx, esi
call fcn.00441e20
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x425499
mov dword [esi + 4], ebx
jmp 0x4254c1
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x4254c1
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00436e80
test al, al
je 0x4254e7
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov ecx, eax
mov eax, str.initruntime_TempPath
call fcn.00441d20
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
call fcn.00425d80
test al, al
jne 0x4254fc
mov byte [esp + 0x1b], bl
call fcn.00436e80
test al, al
je 0x425557
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov esi, eax
cmp byte [esi], bl
je 0x425557
mov ecx, esi
call fcn.00441e20
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x42552f
mov dword [esi + 4], ebx
jmp 0x425557
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x425557
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00436e80
test al, al
je 0x42557d
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov ecx, eax
mov eax, str.initruntime_VistaIE7
call fcn.00441d20
mov esi, dword [esp + 0x20]
call fcn.00425c20
test al, al
jne 0x42558e
mov byte [esp + 0x1b], bl
call fcn.00436e80
test al, al
je 0x4255e9
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov esi, eax
cmp byte [esi], bl
je 0x4255e9
mov ecx, esi
call fcn.00441e20
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x4255c1
mov dword [esi + 4], ebx
jmp 0x4255e9
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x4255e9
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00436e80
test al, al
je 0x42560f
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov ecx, eax
mov eax, str.initruntime_DataPath
call fcn.00441d20
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
push esi
call fcn.00425fb0
test al, al
jne 0x42562a
mov byte [esp + 0x1b], bl
jmp 0x4256af
call fcn.00436e80
test al, al
je 0x42565c
mov dword [esp + 0x1c], str.initruntime_ProfilePath
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov ecx, eax
mov eax, str.initruntime_ProfilePath
call fcn.00441d20
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ecx, esi
mov dword [esp + 0x15c], ebx
call fcn.004265f0
test al, al
je 0x42567d
mov eax, esi
call fcn.00426a10
test al, al
jne 0x425681
mov byte [esp + 0x1b], bl
mov dword [esp + 0x15c], 0xffffffff
call fcn.00436e80
test al, al
je 0x4256af
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
cmp byte [eax], bl
je 0x4256af
call fcn.00441dd0
call fcn.00436e80
test al, al
je 0x42570a
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov esi, eax
cmp byte [esi], bl
je 0x42570a
mov ecx, esi
call fcn.00441e20
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x4256e2
mov dword [esi + 4], ebx
jmp 0x42570a
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x42570a
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00436e80
test al, al
je 0x425730
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov ecx, eax
mov eax, str.initruntime_SetBuildNo
call fcn.00441d20
call fcn.00430710
mov edx, dword [esp + 0x20]
push eax
add edx, 0x4be
push 0xb
push edx
call fcn.004a575e
add esp, 0xc
call fcn.00436e80
test al, al
je 0x4257a6
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov esi, eax
cmp byte [esi], bl
je 0x4257a6
mov ecx, esi
call fcn.00441e20
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x42577e
mov dword [esi + 4], ebx
jmp 0x4257a6
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x4257a6
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00436e80
test al, al
je 0x4257cc
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov ecx, eax
mov eax, str.initruntime_SetCommandLine
call fcn.00441d20
mov eax, dword [esp + 0x20]
call fcn.00426a50
test al, al
jne 0x4257dd
mov byte [esp + 0x1b], bl
call fcn.00436e80
test al, al
je 0x425838
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov esi, eax
cmp byte [esi], bl
je 0x425838
mov ecx, esi
call fcn.00441e20
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x425810
mov dword [esi + 4], ebx
jmp 0x425838
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x425838
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00436e80
test al, al
je 0x42585e
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov ecx, eax
mov eax, str.initruntime_SetProcessShortName
call fcn.00441d20
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
call fcn.00426aa0
test al, al
jne 0x425873
mov byte [esp + 0x1b], bl
call fcn.00436e80
test al, al
je 0x4258ce
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov esi, eax
cmp byte [esi], bl
je 0x4258ce
mov ecx, esi
call fcn.00441e20
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x4258a6
mov dword [esi + 4], ebx
jmp 0x4258ce
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x4258ce
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00436e80
test al, al
je 0x4258f4
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov ecx, eax
mov eax, str.initruntime_CheckMetro
call fcn.00441d20
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
call fcn.00427bd0
test al, al
jne 0x42590a
mov byte [esp + 0x1b], bl
call fcn.00436e80
test al, al
je 0x425965
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov esi, eax
cmp byte [esi], bl
je 0x425965
mov ecx, esi
call fcn.00441e20
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x42593d
mov dword [esi + 4], ebx
jmp 0x425965
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x425965
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00436e80
test al, al
je 0x42598b
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov ecx, eax
mov eax, str.initruntime_CheckConfig
call fcn.00441d20
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
call fcn.00427510
test al, al
jne 0x4259a0
mov byte [esp + 0x1b], bl
call fcn.00436e80
test al, al
je 0x4259fb
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov esi, eax
cmp byte [esi], bl
je 0x4259fb
mov ecx, esi
call fcn.00441e20
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x4259d3
mov dword [esi + 4], ebx
jmp 0x4259fb
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x4259fb
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00436e80
test al, al
je 0x425a21
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov ecx, eax
mov eax, str.initruntime_CheckCorrectFullShape
call fcn.00441d20
mov esi, dword [esp + 0x20]
call fcn.00427fd0
test al, al
jne 0x425a32
mov byte [esp + 0x1b], bl
call fcn.00436e80
test al, al
je 0x425a8d
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov esi, eax
cmp byte [esi], bl
je 0x425a8d
mov ecx, esi
call fcn.00441e20
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x425a65
mov dword [esi + 4], ebx
jmp 0x425a8d
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x425a8d
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
call fcn.00436e80
test al, al
je 0x425ab3
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov ecx, eax
mov eax, str.initruntime_CheckIgnoreCancel
call fcn.00441d20
mov esi, dword [esp + 0x20]
cmp byte [esi + 0x966], bl
jne 0x425ae1
mov edx, dword [esi]
mov eax, dword [edx + 4]
push str.outlook.exe
mov ecx, esi
call eax
push eax
call fcn.004a5ede
add esp, 8
test eax, eax
jne 0x425ae1
mov byte [esi + 0x9b5], 1
call fcn.00436e80
test al, al
je 0x425b3c
call ebp
mov esi, eax
call fcn.00442230
push esi
mov edi, eax
call fcn.00441820
mov esi, eax
cmp byte [esi], bl
je 0x425b3c
mov ecx, esi
call fcn.00441e20
mov eax, dword [esi + 4]
cmp eax, ebx
jg 0x425b14
mov dword [esi + 4], ebx
jmp 0x425b3c
mov dword [esi + eax*8 + 0xfc8], ebx
mov dword [esi + eax*8 + 0xfcc], ebx
add dword [esi + 4], 0xffffffff
je 0x425b3c
add esi, 8
mov dword [esp + 0x1c], esi
mov ebx, dword [esp + 0x1c]
rdtsc
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor ebx, ebx
lea ecx, [esp + 0x28]
call fcn.00430920
mov edi, dword [esp + 0x24]
lea esi, [esp + 0x28]
mov dword [esp + 0x15c], 1
call fcn.0042fa20
mov esi, dword [esp + 0x20]
call fcn.00428100
test al, al
jne 0x425b6e
mov byte [esp + 0x1b], bl
call fcn.00428520
test al, al
je 0x425b7d
cmp byte [esp + 0x1b], bl
jne 0x425bc2
mov ecx, edi
call fcn.0042c990
push 0x4f0b10
push 0x4f0ffc
mov edx, eax
call fcn.00430eb0
add esp, 8
mov dword [esp + 0x28], vtable.t_str.0
cmp byte [esp + 0x144], bl
jne 0x425bbe
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x34]
cmp eax, ecx
je 0x425bbe
push eax
call fcn.004a4a7f
add esp, 4
xor al, al
jmp 0x425bf1
mov byte [esi + 0x964], 1
mov dword [esp + 0x28], vtable.t_str.0
cmp byte [esp + 0x144], bl
jne 0x425bef
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x34]
cmp eax, edx
je 0x425bef
push eax
call fcn.004a4a7f
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x154]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.004a4a25
add esp, 0x14c
ret 4