Function at 0x404f80
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46a64d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xa0
mov eax, dword [0x492110]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xac], edi
xor eax, eax
mov dword [edi + 0xc], 0
mov byte [ebp - 0x96], 0
mov byte [ebp - 0x95], 0
mov dword [ebp - 0x90], eax
cmp dword [edi], eax
je 0x40585c
mov eax, dword [edi + 4]
test eax, eax
je 0x40585c
cmp eax, 0x8000
ja 0x40585c
inc eax
mov esi, 0x105
cmp eax, esi
mov edx, 2
cmova esi, eax
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0xa0], esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00432c26
add esp, 4
mov dword [edi + 0xc], eax
test eax, eax
jne 0x405041
mov eax, 0xe
jmp 0x405861
push esi
push 0
push eax
call fcn.0042f1f0
add esp, 0xc
cmp dword [edi + 4], 2
jbe 0x40517c
mov eax, dword [edi]
mov dword [ebp - 0xa8], eax
cmp word [eax], 0x5c
je 0x40517c
cmp word [eax + 2], 0x3a
je 0x40517c
mov eax, dword [edi + 0xc]
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0x8c]
push eax
push 0x20219
push 0
push str.SoftwareMcAfeeSystemCore
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
test eax, eax
cmove ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x9c], ecx
test ecx, ecx
je 0x405144
lea eax, [esi + esi]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xa4]
lea eax, [ebp - 0x38]
push eax
push 0
push str.szInstallDir32
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x94], eax
test eax, eax
jne 0x40512b
mov eax, dword [ebp - 0xa4]
test eax, eax
je 0x40512b
push 0x487c74
push esi
push eax
call fcn.00404b90
test eax, eax
js 0x405115
mov eax, dword [ebp - 0xa8]
test eax, eax
je 0x40512b
push eax
push esi
push dword [ebp - 0xa4]
call fcn.00404b90
test eax, eax
jns 0x40512b
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x405144
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x94], 0
je 0x4051e0
push dword [edi + 0xc]
call fcn.00432c0b
add esp, 4
mov dword [edi + 0xc], 0
mov dword [ebp - 0xa0], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f
mov dword [ebp - 0x90], 2
setne byte [ebp - 0x95]
jmp 0x4051e0
mov eax, dword [edi]
mov ecx, dword [edi + 0xc]
test esi, esi
je 0x4051d9
cmp esi, 0x7fffffff
ja 0x4051d0
mov edi, SysReAllocString
mov edx, esi
sub edi, esi
mov esi, eax
sub esi, ecx
nop word [eax + eax]
lea eax, [edi + edx]
test eax, eax
je 0x4051bb
movzx eax, word [esi + ecx]
test ax, ax
je 0x4051bb
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x4051a0
mov edi, dword [ebp - 0xac]
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
jmp 0x4051d9
test esi, esi
je 0x4051d9
xor eax, eax
mov word [ecx], ax
mov byte [ebp - 0x96], 1
mov eax, dword [edi + 8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0xa4], eax
xor esi, esi
mov dword [ebp - 0x34], eax
xor eax, eax
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
mov edx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [ebp - 0x95], al
je 0x405248
push str.NCPrivateLoadAndValidateMPTDll:_Looking_in_current_directory_n
call edx
mov ecx, edi
call fcn.00404e00
mov edx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 0x90], eax
jmp 0x405299
cmp dword [edi + 0xc], 0
je 0x405293
push 0x50
lea eax, [ebp - 0x88]
push 0
push eax
call fcn.0042f1f0
add esp, 0xc
lea ecx, [ebp - 0x88]
push dword [edi + 0xc]
call fcn.004067b0
push 0
lea ecx, [ebp - 0x88]
call fcn.00406610
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x90], eax
call fcn.00406750
mov edx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x90]
cmp eax, 2
je 0x4052a9
cmp eax, 0x80092003
jne 0x405541
cmp byte [ebp - 0x96], 0
jne 0x405541
push str.NCPrivateLoadAndValidateMPTDll:_Looking_in_EXE_directory_n
call edx
mov eax, 0x104
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x90], eax
nop
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00425070
mov esi, eax
add esp, 4
mov dword [ebp - 0x30], esi
test esi, esi
je 0x40537b
push dword [ebp - 0x90]
push esi
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x90], eax
jne 0x40534e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x405348
mov eax, dword [ebp - 0x90]
add eax, eax
push esi
mov dword [ebp - 0x90], eax
call fcn.00425080
mov eax, dword [ebp - 0x90]
add esp, 4
mov dword [ebp - 0x30], 0
jmp 0x4052d0
mov eax, dword [ebp - 0x94]
test eax, eax
je 0x40535f
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x2c], eax
xor eax, eax
jmp 0x405383
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov dword [ebp - 0x18], eax
call fcn.00425080
mov eax, dword [ebp - 0x18]
add esp, 4
xor esi, esi
mov dword [ebp - 0x30], esi
jmp 0x405383
mov eax, 0xe
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x90], eax
test esi, esi
je 0x4054ca
push 0x5c
push esi
call fcn.00430ebe
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x90], eax
test ecx, ecx
je 0x4054ca
sub ecx, esi
mov edx, 2
sar ecx, 1
mov dword [ebp - 0x8c], ecx
lea eax, [ecx + 1]
xor ecx, ecx
mov dword [ebp - 0x94], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00425070
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x90], eax
test edx, edx
je 0x40545b
mov ecx, dword [ebp - 0x94]
test ecx, ecx
je 0x40543d
cmp ecx, 0x7fffffff
ja 0x405434
mov eax, dword [ebp - 0x8c]
cmp eax, 0x7ffffffe
ja 0x405438
push eax
push esi
push ecx
mov edx, ecx
mov ecx, dword [ebp - 0x28]
call fcn.00404cf0
mov edx, dword [ebp - 0x28]
test eax, eax
js 0x40543d
mov ecx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x90], eax
jmp 0x40545d
test ecx, ecx
je 0x40543d
xor eax, eax
mov word [edx], ax
mov eax, 0x54f
push edx
mov dword [ebp - 0x90], eax
call fcn.00425080
add esp, 4
mov eax, 0x54f
xor edx, edx
mov dword [ebp - 0x28], edx
xor ecx, ecx
test edx, edx
je 0x405541
mov edx, dword [edi + 4]
add ecx, 2
add edx, ecx
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x94], edx
test ecx, ecx
je 0x40549a
mov eax, dword [ebp - 0xa0]
cmp eax, edx
jae 0x4054d0
push ecx
call fcn.00432c0b
mov edx, dword [ebp - 0x94]
add esp, 4
mov dword [edi + 0xc], 0
mov dword [ebp - 0xa0], edx
xor ecx, ecx
mov eax, edx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00432c26
mov dword [edi + 0xc], eax
mov ecx, eax
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0xa0]
jmp 0x4054d2
xor ecx, ecx
xor edx, edx
jmp 0x40545d
mov edx, ecx
mov dword [ebp - 0x90], 0xe
test ecx, ecx
je 0x405574
push dword [edi]
push dword [ebp - 0x28]
push str._ls_ls
push eax
push edx
call fcn.00404c00
add esp, 0x14
test eax, eax
js 0x405560
push 0x50
lea eax, [ebp - 0x88]
push 0
push eax
call fcn.0042f1f0
add esp, 0xc
lea ecx, [ebp - 0x88]
push dword [edi + 0xc]
call fcn.004067b0
push 0
lea ecx, [ebp - 0x88]
call fcn.00406610
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x90], eax
call fcn.00406750
mov eax, dword [ebp - 0x90]
cmp eax, 0x800b010e
jg 0x40556c
je 0x405821
cmp eax, 0x80092026
je 0x405821
cmp eax, 0x800b0101
jmp 0x40556e
mov dword [ebp - 0x90], 0x6f
jmp 0x405574
test eax, eax
je 0x405821
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x405583
mov eax, dword [edi]
mov dword [ebp - 0x18], eax
test esi, esi
jne 0x405600
mov edi, 0x104
nop dword [eax]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00425070
mov esi, eax
add esp, 4
mov dword [ebp - 0x30], esi
test esi, esi
je 0x4057dd
push edi
push esi
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x9c], eax
cmp edi, eax
jne 0x4055f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4055ef
push esi
add edi, edi
call fcn.00425080
add esp, 4
mov dword [ebp - 0x30], 0
jmp 0x405590
mov eax, dword [ebp - 0x9c]
test eax, eax
je 0x4056ab
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4057dd
mov ecx, 0x8000
cmp word [eax], 0
je 0x40561e
add eax, 2
sub ecx, 1
jne 0x405610
mov eax, 0x8000
mov edx, ecx
sub eax, ecx
neg edx
sbb edx, edx
and edx, eax
mov dword [ebp - 0xa0], edx
test ecx, ecx
je 0x4057dd
test esi, esi
jne 0x4056f0
mov edi, 0x104
nop dword [eax + eax]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00425070
mov esi, eax
add esp, 4
mov dword [ebp - 0x30], esi
test esi, esi
je 0x4056ea
push edi
push esi
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x94], eax
cmp edi, eax
jne 0x4056c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4056c1
push esi
add edi, edi
call fcn.00425080
add esp, 4
mov dword [ebp - 0x30], 0
jmp 0x405650
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call fcn.00425080
add esp, 4
xor esi, esi
jmp 0x4057dd
mov eax, dword [ebp - 0x94]
test eax, eax
je 0x4056d6
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x2c], eax
jmp 0x4056f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call fcn.00425080
add esp, 4
xor esi, esi
mov dword [ebp - 0x30], esi
mov edx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x9c]
add edx, 0x200
xor ecx, ecx
add eax, edx
mov edx, 2
mov dword [ebp - 0xa8], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00432c26
add esp, 4
mov dword [ebp - 0x8c], eax
test eax, eax
je 0x4057dd
test esi, esi
jne 0x4057a7
mov edi, 0x104
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00425070
mov esi, eax
add esp, 4
test esi, esi
je 0x4057a7
push edi
push esi
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x94], eax
cmp edi, eax
jne 0x405792
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40578c
push esi
add edi, edi
call fcn.00425080
add esp, 4
mov dword [ebp - 0x30], 0
jmp 0x405734
mov eax, dword [ebp - 0x94]
test eax, eax
jne 0x4057a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call fcn.00425080
add esp, 4
xor esi, esi
mov eax, dword [ebp - 0x90]
mov edi, dword [ebp - 0x8c]
push eax
mov eax, dword [ebp - 0x18]
push eax
push esi
push str.NotComDllGetInterface:__ls_loading__ls__WinVerifyTrust_failed_with__08x_n
push dword [ebp - 0xa8]
push edi
call fcn.00404c00
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push edi
call fcn.00432c0b
add esp, 4
mov edi, dword [ebp - 0xac]
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4057fa
push eax
call fcn.00432c0b
add esp, 4
mov dword [edi + 0xc], 0
mov edi, dword [ebp - 0x90]
test esi, esi
je 0x40580d
push esi
call fcn.00425080
add esp, 4
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x40581d
push eax
call fcn.00425080
add esp, 4
mov eax, edi
jmp 0x405861
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x90], 0
test eax, eax
je 0x405855
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [edi + 0x10], eax
test eax, eax
jne 0x4057fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [edi + 0xc]
mov dword [ebp - 0x90], eax
jmp 0x4057eb
mov edi, 0x54f
jmp 0x405800
mov eax, 0x57
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042db8f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret