Function at 0x425480
Capabilities:
Access peb ldr_data
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x459c23
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x234
push ebx
push esi
push edi
xor esi, esi
mov dword [esp + 0x248], esi
mov eax, dword [0x4631a0]
mov dword [esp + 0x34], 1
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], eax
mov cx, word [0x468b0c]
xor eax, eax
mov word [esp + 0x38], cx
mov ecx, 0x81
lea edi, [esp + 0x3a]
lea edx, [esp + 0x24]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x38]
push edx
mov edx, dword [esp + 0x25c]
lea ecx, [esp + 0x38]
push eax
push ecx
push edx
push str.Software360desktoppopmsg
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x260], 3
mov dword [esp + 0x3c], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4257f6
cmp dword [esp + 0x24], esi
je 0x4257f6
lea eax, [esp + 0x38]
test eax, eax
je 0x42554f
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [esp + 0x38]
lea ecx, [esp + 0xc]
push edx
push eax
call fcn.00408770
mov esi, dword [sym.imp.MSVCRT.dll_swscanf]
lea eax, [esp + 0x28]
lea ecx, [esp + 0x20]
push eax
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push str._d._d._d._d
push ecx
call esi
add esp, 0x18
cmp eax, 4
je 0x42564e
mov eax, dword [esp + 0xc]
mov ecx, dword [0x4631a4]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x4255c1
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4255c1
mov eax, dword [esp + 0xc]
add eax, 0xfffffff4
push eax
call fcn.0044bf22
add esp, 4
mov eax, dword [esp + 0x250]
mov edx, dword [0x4631a4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4255f2
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4255f2
mov edx, dword [esp + 0x250]
add edx, 0xfffffff4
push edx
call fcn.0044bf22
add esp, 4
mov eax, dword [esp + 0x254]
mov edx, dword [0x4631a4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x425623
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x425623
mov edx, dword [esp + 0x254]
add edx, 0xfffffff4
push edx
call fcn.0044bf22
add esp, 4
mov eax, dword [esp + 0x258]
mov edx, dword [0x4631a4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4258ba
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4258ba
jmp 0x4258a7
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x25c]
lea eax, [esp + 0x38]
push edx
push eax
push str._d._d._d._d
push ecx
call esi
add esp, 0x18
cmp eax, 4
je 0x4256f8
mov eax, dword [esp + 0xc]
mov ecx, dword [0x4631a4]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x4256aa
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4256aa
mov eax, dword [esp + 0xc]
add eax, 0xfffffff4
push eax
call fcn.0044bf22
add esp, 4
mov eax, dword [esp + 0x250]
mov edx, dword [0x4631a4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4256db
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4256db
mov edx, dword [esp + 0x250]
add edx, 0xfffffff4
push edx
call fcn.0044bf22
add esp, 4
lea ecx, [esp + 0x254]
call fcn.00401c80
lea ecx, [esp + 0x258]
call fcn.00401c80
jmp 0x4258ba
mov eax, dword [esp + 0x30]
push ebp
cdq
mov ecx, 0x10
call fcn.00457a50
mov esi, eax
mov eax, dword [esp + 0x20]
mov edi, edx
mov ecx, 0x10
cdq
or esi, eax
or edi, edx
mov eax, esi
mov edx, edi
call fcn.00457a50
mov esi, eax
mov eax, dword [esp + 0x30]
mov edi, edx
mov ecx, 0x10
cdq
or esi, eax
or edi, edx
mov eax, esi
mov edx, edi
call fcn.00457a50
mov edi, eax
mov eax, dword [esp + 0x14]
mov esi, edx
mov ecx, 0x10
cdq
or edi, eax
mov eax, dword [esp + 0x18]
or esi, edx
cdq
call fcn.00457a50
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov ebp, edx
mov ecx, 0x10
cdq
or ebx, eax
or ebp, edx
mov eax, ebx
mov edx, ebp
call fcn.00457a50
mov ebx, eax
mov eax, dword [esp + 0x24]
mov ebp, edx
mov ecx, 0x10
cdq
or ebx, eax
or ebp, edx
mov eax, ebx
mov edx, ebp
call fcn.00457a50
mov ebx, eax
mov eax, dword [esp + 0x2c]
mov ecx, edx
pop ebp
cdq
or ecx, edx
or ebx, eax
cmp esi, ecx
jl 0x4257c2
jg 0x4257a8
cmp edi, ebx
jbe 0x4257c2
lea ecx, [esp + 0xc]
call fcn.00401c80
lea ecx, [esp + 0x250]
call fcn.00401c80
jmp 0x4256db
lea ecx, [esp + 0xc]
call fcn.00401c80
lea ecx, [esp + 0x250]
call fcn.00401c80
lea ecx, [esp + 0x254]
call fcn.00401c80
lea ecx, [esp + 0x258]
call fcn.00401c80
xor eax, eax
jmp 0x4258bf
mov eax, dword [esp + 0xc]
mov edx, dword [0x4631a4]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x425827
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x425827
mov edx, dword [esp + 0xc]
add edx, 0xfffffff4
push edx
call fcn.0044bf22
add esp, 4
mov eax, dword [esp + 0x250]
mov edx, dword [0x4631a4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x425858
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x425858
mov edx, dword [esp + 0x250]
add edx, 0xfffffff4
push edx
call fcn.0044bf22
add esp, 4
mov eax, dword [esp + 0x254]
mov edx, dword [0x4631a4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x425889
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x425889
mov edx, dword [esp + 0x254]
add edx, 0xfffffff4
push edx
call fcn.0044bf22
add esp, 4
mov eax, dword [esp + 0x258]
mov edx, dword [0x4631a4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4258ba
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4258ba
mov edx, dword [esp + 0x258]
add edx, 0xfffffff4
push edx
call fcn.0044bf22
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x240]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x240
ret 0xc