Function at 0x425b60
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e0719
mov eax, dword fs:[0]
push eax
mov eax, 0x22ac
call fcn.0046cf20
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x22a0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x22b8], eax
call fcn.0047337c
test al, al
je 0x425bcb
or byte [ecx - 0x229f7b], cl
dec dword [ebx - 0x7a76f3bb]
dec eax
invalid
push edi
in al, 0x49
cmpsb byte [esi], byte es:[edi]
jns 0x425b94
jg 0x425c12
mov al, byte [0x73cc6e97]
fbld tbyte [esi + ebx*2]
out 0xc6, eax
cmp al, ah
wait
dec ebx
das
shl byte [ecx - 0x62c93aaa], 1
notrack call fcn.0047351a
call fcn.0047351a
test al, al
je 0x425be6
push edi
fist word [esp]
xchg cl, ch
fild qword [ecx - 0x74278a85]
arpl word [ecx], di
ret 0x7e04
mov dword [ebp - 0x22b0], 0
mov dword [ebp - 0x22ac], 0
mov dword [ebp - 0x22a8], 0
push 0x20
push str.e414e1adb8fa99e471bfdc0c317ef8bf
lea ecx, [ebp - 0x2248]
mov dword [ebp - 4], 0
inc ebp
cld
add byte [eax], al
add byte [eax], al
mov dword [ebp - 0x2234], 0xf
mov dword [ebp - 0x2238], 0
mov byte [ebp - 0x2248], 0
call fcn.00406060
lea eax, [ebp - 0x2248]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x22b0]
call fcn.00418fb0
mov eax, dword [ebp - 0x2234]
mov byte [ebp - 4], 0
cmp eax, 0x10
jb 0x425c70
inc eax
lea ecx, [ebp - 0x2248]
push eax
push dword [ebp - 0x2248]
call fcn.00405840
push 0x20
push str.5391e61b01dab8851e6029984c58469e
lea ecx, [ebp - 0x2248]
mov dword [ebp - 0x2234], 0xf
mov dword [ebp - 0x2238], 0
mov byte [ebp - 0x2248], 0
call fcn.00406060
lea eax, [ebp - 0x2248]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x22b0]
call fcn.00418fb0
mov eax, dword [ebp - 0x2234]
mov byte [ebp - 4], 0
cmp eax, 0x10
jb 0x425cd5
inc eax
lea ecx, [ebp - 0x2248]
push eax
push dword [ebp - 0x2248]
call fcn.00405840
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x229c], 0
push 0
push eax
call fcn.004830b0
mov esi, dword [ebp - 0x22a0]
lea eax, [ebp - 0x218]
add esp, 0xc
xor ebx, ebx
mov dword [ebp - 0x2294], ebx
mov dword [ebp - 0x22a4], ebx
push 0x104
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x426212
test ebx, ebx
jne 0x426212
lea eax, [ebp - 0x229c]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4261de
invalid
call fcn.0047337c
test al, al
je 0x425d6d
sbb ebp, dword [eax - 0x36]
inc byte [edi - 0x266667df]
cmp ch, byte es:[ebp + 0x7d9e9d1e]
sub al, 0x13
pop esi
ja 0x425d30
and dword [eax + 0x3a26d999], ebx
lodsd eax, dword [esi]
push ds
popfd
sahf
jge 0x425d90
adc ebx, dword [esi + 0x77]
enter 0xfffffffffffff3c3, 0x1d
sbb al, 0x2c
ret
call fcn.0047355f
test al, al
je 0x425d8c
push esp
outsd dx, dword [esi]
mov byte [0x666cdac0], bl
in al, dx
dec edx
xor bh, dl
invalid
call fcn.004734d5
test al, al
je 0x425dad
add byte [eax + eax*8 - 0x2bcce78c], al
xor edx, esp
test al, 0x36
stosd dword es:[edi], eax
xchg ecx, eax
jge 0xfdfe9be5
je 0x425d58
cmp ebp, edx
jl 0x425dc9
dec edx
dec esp
imul eax, dword [ebp + 0x10], 0xdb73e83d
add al, 0
call fcn.00473925
test al, al
je 0x425dd0
push esp
and cl, dh
invalid
not byte [0x7b83b5c9]
cli
xor eax, eax
mov dword [ebp - 0x2234], 7
mov dword [ebp - 0x2238], 0
mov word [ebp - 0x2248], ax
cmp word [ebp - 0x218], ax
jne 0x425dfa
xor ecx, ecx
jmp 0x425e12
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425e03
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2248]
call fcn.00402650
lea eax, [ebp - 0x2248]
mov byte [ebp - 4], 3
push eax
call fcn.0045803e
add esp, 4
mov dword [ebp - 0x224c], 7
xor eax, eax
mov dword [ebp - 0x2250], 0
mov word [ebp - 0x2260], ax
lea ecx, [ebp - 0x2260]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x2248]
push eax
call fcn.00402530
push 1
push 0x5e8b24
lea ecx, [ebp - 0x2260]
mov byte [ebp - 4], 4
call fcn.00405710
push 9
push 0x5e8b28
lea ecx, [ebp - 0x2260]
call fcn.00405710
lea eax, [ebp - 0x2260]
push eax
lea eax, [ebp - 0x2278]
push eax
call fcn.00456cea
add esp, 8
mov esi, dword [ebp - 0x22b0]
mov ebx, dword [ebp - 0x22ac]
mov byte [ebp - 4], 5
mov dword [ebp - 0x2298], 0
cmp esi, ebx
je 0x425f1c
cmp dword [esi + 0x14], 0x10
jb 0x425ed0
mov edi, dword [esi]
jmp 0x425ed2
mov edi, esi
lea ecx, [ebp - 0x2278]
call fcn.00429910
nop dword [eax]
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x425f00
test cl, cl
je 0x425efc
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x425f00
add eax, 2
add edi, 2
test cl, cl
jne 0x425ee0
xor eax, eax
jmp 0x425f05
sbb eax, eax
or eax, 1
test eax, eax
je 0x425f12
add esi, 0x18
cmp esi, ebx
jne 0x425ec6
jmp 0x425f1c
mov dword [ebp - 0x2298], 1
call fcn.004736fd
test al, al
je 0x425f43
xchg edi, eax
inc esi
pop ss
and eax, 0x7b66339d
xchg edi, eax
xlatb
push ss
and byte [ecx - 0x6f0c3b3c], dh
or byte [esi - 0x3f504e1b], 0xcf
pop ecx
sar dh, cl
and eax, 0x68bd8330
invalid
cmp dword [ebp - 0x2298], 0
je 0x426143
push 0x2000
lea eax, [ebp - 0x2218]
mov dword [ebp - 0x2298], 0x1000
push 0
push eax
call fcn.004830b0
xor eax, eax
mov dword [ebp - 0x22b4], 1
add esp, 0xc
mov dword [ebp - 0x221c], 7
mov dword [ebp - 0x2220], 0
mov word [ebp - 0x2230], ax
lea eax, [ebp - 0x2298]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x2218]
push eax
lea eax, [ebp - 0x22b4]
push eax
push 0
push str.UninstallString
push dword [ebp - 0x229c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x426119
lea eax, [ebp - 0x2218]
mov dword [ebp - 0x2294], 1
push eax
lea eax, [ebp - 0x2290]
push eax
call fcn.00455f3e
add esp, 8
mov esi, eax
lea eax, [ebp - 0x2230]
cmp eax, esi
je 0x42603e
mov eax, dword [ebp - 0x221c]
cmp eax, 8
jb 0x426015
inc eax
lea ecx, [ebp - 0x2230]
push eax
push dword [ebp - 0x2230]
call fcn.00402750
xor eax, eax
mov dword [ebp - 0x221c], 7
push esi
lea ecx, [ebp - 0x2230]
mov dword [ebp - 0x2220], 0
mov word [ebp - 0x2230], ax
call fcn.00405590
mov eax, dword [ebp - 0x227c]
mov byte [ebp - 4], 6
cmp eax, 8
jb 0x426060
inc eax
lea ecx, [ebp - 0x2290]
push eax
push dword [ebp - 0x2290]
call fcn.00402750
push 0xa
push 0
push str.MailMaster
lea ecx, [ebp - 0x2230]
call fcn.00405890
cmp eax, 0xffffffff
jle 0x426107
push eax
push 0
lea eax, [ebp - 0x2290]
push eax
lea ecx, [ebp - 0x2230]
call fcn.0041a1e0
mov esi, eax
lea eax, [ebp - 0x2230]
cmp eax, esi
je 0x4260e5
mov eax, dword [ebp - 0x221c]
cmp eax, 8
jb 0x4260bc
inc eax
lea ecx, [ebp - 0x2230]
push eax
push dword [ebp - 0x2230]
call fcn.00402750
xor eax, eax
mov dword [ebp - 0x221c], 7
push esi
lea ecx, [ebp - 0x2230]
mov dword [ebp - 0x2220], 0
mov word [ebp - 0x2230], ax
call fcn.00405590
mov eax, dword [ebp - 0x227c]
mov byte [ebp - 4], 6
cmp eax, 8
jb 0x426107
inc eax
lea ecx, [ebp - 0x2290]
push eax
push dword [ebp - 0x2290]
call fcn.00402750
mov ecx, dword [ebp - 0x22b8]
lea eax, [ebp - 0x2230]
push eax
call fcn.00429970
push dword [ebp - 0x229c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x221c]
cmp eax, 8
jb 0x426143
inc eax
lea ecx, [ebp - 0x2230]
push eax
push dword [ebp - 0x2230]
call fcn.00402750
mov eax, dword [ebp - 0x2264]
cmp eax, 0x10
jb 0x426161
inc eax
lea ecx, [ebp - 0x2278]
push eax
push dword [ebp - 0x2278]
call fcn.00405840
mov eax, dword [ebp - 0x224c]
mov dword [ebp - 0x2264], 0xf
mov dword [ebp - 0x2268], 0
mov byte [ebp - 0x2278], 0
cmp eax, 8
jb 0x42619a
inc eax
lea ecx, [ebp - 0x2260]
push eax
push dword [ebp - 0x2260]
call fcn.00402750
xor eax, eax
mov dword [ebp - 0x224c], 7
mov word [ebp - 0x2260], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x2234]
mov dword [ebp - 0x2250], 0
cmp eax, 8
jb 0x4261d8
inc eax
lea ecx, [ebp - 0x2248]
push eax
push dword [ebp - 0x2248]
call fcn.00402750
mov ebx, dword [ebp - 0x2294]
mov eax, dword [ebp - 0x22a4]
lea ecx, [ebp - 0x218]
push 0x104
inc eax
push ecx
push eax
push dword [ebp - 0x22a0]
mov dword [ebp - 0x22a4], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, dword [ebp - 0x22a0]
test eax, eax
je 0x425d25
call fcn.004737cc
test al, al
je 0x42622b
cmp ecx, dword [edi - 0x7f4daa03]
in al, 0x2d
mov ebp, 0xac7d32b0
pop eax
loop 0x42626c
call fcn.004735e9
test al, al
je 0x42624b
popal
push edi
invalid
lea ecx, [ebp - 0x22b0]
call fcn.00406540
mov eax, dword [ebp - 0x2294]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046ce06
mov esp, ebp
pop ebp
ret 8
invalid