Function at 0x425070
Capabilities:
Delete registry key
Encode data using xor
Get installed programs

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bd9f4
mov eax, dword fs:[0]
push eax
sub esp, 0xf68
mov eax, dword [0x634274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xf68], eax
call fcn.00460579
test al, al
je 0x4250c3
or byte [ecx - 0xf677b], cl
invalid
mov al, byte [0x69facd89]
inc ebx
arpl word [edi + 0x7ba3d612], si
add eax, 0x3223151d
int3
call fcn.00460351
test al, al
je 0x4250eb
push edx
mov ebx, 0x25042dc1
arpl word [edi - 0x360bb041], sp
out 0x82, al
sbb ebx, esp
jge fcn.00425070
jg 0x4250a0
into
pushal
cmp al, 0x36
sahf
add dword [esp + esi*4 + 0x3be82d0d], 0xffffffb7
add eax, dword [eax]
call fcn.0046082b
test al, al
je 0x42510c
sub cl, ah
push eax
sub ebx, esi
pushal
invalid
call fcn.0046082b
test al, al
je 0x42512d
mov dl, 0xbe
movsb byte es:[edi], byte [esi]
mov ds, word [edi]
adc eax, 0xaeac504d
xchg ebp, eax
mov ebx, 0xdce08cec
test al, 0xb6
sub ah, ah
and bh, byte [eax]
push cs
xchg al, ch
push eax
mov cl, 3
add byte [eax + eax*8 - 0xbbfe18c], al
xchg esi, eax
pop edx
sahf
jle 0x425159
call fcn.00460282
test al, al
je 0x425154
inc eax
hlt
push es
jge 0x4251ac
popfd
pop ds
add al, 0x7f
fsubr dword [esi + 0x4b91fab7]
shl byte [edi], cl
inc ebp
push es
mov bl, 0x44
inc esp
xchg byte [ebp - 0xf537b], cl
lea eax, [ebp - 0xf54]
mov dword [ebp - 0xf54], 0
inc edi
test dword [eax + esi*8 + 0xffff], ebp
add byte [eax], al
push eax
push 0xf003f
push 0
push str.SoftWareMicrosoftWindowsCurrentVersionUninstall
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42519d
push str.SmartCloudWB
push dword [ebp - 0xf54]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0xf54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add al, ch
jle 0x425152
call fcn.00460420
add eax, dword [eax]
test al, al
je 0x4251bc
adc bl, bl
add dh, ah
xor ebx, dword [eax - 0x76daac14]
sahf
insd dword es:[edi], dx
push ebp
in al, dx
push ebx
and eax, 0x556d9e89
xchg eax, ebp
cmp eax, 0x65e6a0fc
pop ebp
bnd call fcn.0046023d
call fcn.0046023d
test al, al
je 0x4251db
loop 0x4251d5
fidivr dword [edx + 9]
cmp dword [0x96c6fdf6], ebp
jl 0x42519c
lodsb al, byte [esi]
popal
mov dl, 0xb9
push ebx
mov esp, 0x54e85849
mov bl, 3
add byte [eax + eax*8 - 0x6ec8ea8c], al
mov ecx, 0x49bc5367
pop eax
call fcn.00460534
test al, al
je 0x4251f9
aaa
xchg ecx, eax
fild qword [edx]
push eax
pop dword [edi + 0x5e798bc3]
or eax, esp
sbb eax, 0x764e8993
xor esi, 0xffffffe8
lodsb al, byte [esi]
mov dl, 3
add byte [eax + eax*8 + 0x16ca2074], al
mov ebp, edi
cmp ch, bh
invalid
call fcn.004604aa
test al, al
je 0x425222
retf 0x8b16
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0xf54], 0
push 0
push eax
mov dword [ebp - 0xf5c], 0
mov dword [ebp - 0xf58], 0
mov dword [ebp - 0xf64], 0
call fcn.00486960
add esp, 0xc
lea eax, [ebp - 0xf54]
push eax
push 0xf003f
push 0
push str.SoftWare
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xf60], eax
call fcn.00460717
test al, al
je 0x4252a3
stosd dword es:[edi], eax
xchg ebx, eax
or bl, dh
invalid
call fcn.004603db
test al, al
je 0x4252c4
push eax
pop ds
sbb dword [eax], 0xd78ef8e0
lodsb al, byte [esi]
cld
pop ss
test byte [ebx], 0x81
push edx
mov esi, 0xa810e46e
push edx
les edx, [edx + 0x3b562e8]
add byte [eax + eax*8 - 0x385ce38c], al
pop ecx
mov byte [0xd45fd2e2], al
call fcn.0046082b
test al, al
je 0x4252e9
mov dword [0xe2a259c7], eax
rcr byte [edi - 0x2c], cl
aam 0xfd
std
inc edx
adc esi, dword [ebp + 0x25e3f023]
xchg edi, eax
int3
cmp dword [ebp - 0xf60], 0
jne 0x4261a2
call fcn.004601b3
test al, al
je 0x425312
cmp esp, ebx
mov ah, 0x97
cmpsd dword [esi], dword es:[edi]
stosd dword es:[edi], eax
rol dword [ebx + 0x7f4757ac], 0x73
sub dh, byte [eax - 0x3b]
jo 0x4252d4
cdq
out 0xe8, eax
xchg ebx, eax
mov cl, 3
add byte [eax + eax*8 - 0x5e73df8c], al
pop ss
arpl word cs:[eax + 0xed26f36], ax
call fcn.004604aa
test al, al
je 0x42533b
mov word [ecx - 0x7f9cd1e9], fs
outsd dx, dword ss:[esi]
ror byte [esi], cl
sti
push ebx
fldln2
xchg esi, eax
das
jno 0x425358
movsb byte es:[edi], byte [esi]
add byte [esi], al
adc al, 0x4b
jbe 0x42530d
fsubr dword [edx - 0x3e614f4d]
sub byte [edx], ch
push 0
lea eax, [ebp - 0xf64]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SmartCloudWB
push dword [ebp - 0xf54]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x425378
lodsb al, byte [esi]
invalid
push dword [ebp - 0xf54]
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
jmp 0x4261a2
call fcn.004606d2
test al, al
je 0x42539a
movsd dword es:[edi], dword [esi]
mov cs, esi
cmp ebx, dword [esi]
cli
push edi
dec dl
adc byte [ebp - 0x35], bl
fisubr dword [ebp + 0x563c2488]
lcall 0xcd03, 0x2deccbb7
call fcn.00460648
test al, al
je 0x4253c3
dec eax
or dh, bh
sbb al, 0x44
mov ebp, 0x4216ec2e
sub eax, 0xfe2b594e
invalid
call fcn.004607e6
test al, al
je 0x4253e4
mov edi, 0xd4b41a11
cmp dl, byte [eax - 0x6068fbd6]
out 0xb3, eax
xchg ebx, eax
fsubr st(0)
mov edx, 0x4f7688a4
add byte [edx + 0x57], dh
call fcn.00409250
mov ecx, eax
call fcn.004617bd
push eax
lea ecx, [ebp - 0xea8]
call fcn.004023b0
cmp dword [ebp - 0xe94], 8
lea ecx, [ebp - 0xea8]
mov dword [ebp - 4], 0
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0xea8]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x425420
call fcn.004607e6
test al, al
je 0x42544c
int3
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.InstallPath
push dword [ebp - 0xf64]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xf64]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push dword [ebp - 0xf54]
call ebx
mov dword [ebp - 0xf54], 0
call fcn.004607e6
test al, al
je 0x4254b6
xor eax, 0xb9e04e0b
cmpsd dword [esi], dword es:[edi]
mov dh, 0x33
sub al, 0x4d
jae 0x4254be
ret 0x542a
call fcn.004600e4
test al, al
je 0x4254d0
adc dword [edx + 0x29805754], ebp
xor dword [ecx], esp
mov ecx, 0x25ae144c
stosb byte es:[edi], al
push esp
push edi
sub byte [ecx], 0x31
and dword [ecx + 0x25ae144c], edi
fdivr qword [eax - 0x171464f8]
push esp
lodsb al, byte [esi]
add eax, dword [eax]
call fcn.00460129
test al, al
je 0x4254ee
rcl byte [ebx + 0x373fdbd2], cl
pop ecx
pop esp
and byte [esi - 0x79], 0x9b
invalid
lea eax, [ebp - 0xf54]
push eax
push 0xf003f
push 0
push str.softwareMicrosoftWindowsCurrentVersion
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x426184
call fcn.00460579
test al, al
je 0x425536
aas
sub al, byte [esi]
sbb dword [edx - 0x5287523c], edi
out dx, eax
invalid
call fcn.0046082b
test al, al
je 0x425559
push edx
int 9
mov byte [0x86d840f5], al
inc edi
retf 0x50f0
lea eax, [ebp - 0xf5c]
push eax
push 0xf003f
push 0
add byte [edi], cl
add byte [edx], ch
push str.Uninstall
push dword [ebp - 0xf54]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xf60], eax
call fcn.004604ef
test al, al
je 0x42559c
xchg ecx, eax
sbb byte [si - 0x62], dh
test al, 0xca
mov al, 0xee
js 0x425562
mov bh, 9
dec edx
das
invalid
call fcn.00460465
test al, al
je 0x4255c3
add cl, 0x45
push 0x27
mov ch, 0x57
mov bl, 0x99
sbb al, 8
test al, 0xfb
push es
sbb al, 0x7d
test eax, 0xe5cb746c
jnp 0x42553d
aaa
inc eax
xor al, 0x10
lcall 0x3b1, 0x4fe8edfc
add byte [eax + eax*8 - 0x66c0df8c], al
call fcn.00460717
test al, al
je 0x4255ec
aas
cdq
xor ah, byte [edx - 0x25c04b5]
mov eax, dword [0xb6d8d35c]
xor ebp, dword [esi - 0x3a85f787]
ret 0x5a95
cmp dword [ebp - 0xf60], 0
je 0x425632
push 0
lea eax, [ebp - 0xf5c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.Uninstall
push dword [ebp - 0xf54]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x425632
add byte [ebp - 0xed8b40], al
mov ch, 0xac
invalid
push dword [ebp - 0xf54]
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
jmp 0x426184
call fcn.004606d2
test al, al
je 0x425651
pushal
into
jns 0x42561b
std
and byte [ebx - 0x5988e633], al
mov dl, 4
sbb ebx, dword [edx - 0x566d6550]
sbb ah, byte [ebp + 0x12]
call fcn.00460465
test al, al
je 0x425673
test bl, ch
cwde
invalid
call fcn.00460282
test al, al
je 0x425690
ljmp 0xf6c2:0xa944da73
push 0
lea eax, [ebp - 0xf58]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SmartCloudWB
push dword [ebp - 0xf5c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4256cd
push dword [ebp - 0xf5c]
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
jmp 0x426184
call fcn.0046068d
test al, al
je 0x4256ec
stc
push 0x37
push es
in eax, 0x78
insd dword es:[edi], dx
xchg esp, eax
iretd
call fcn.0046023d
test al, al
je 0x42570e
into
sub al, 0x76
mov ebx, 0xeda6a9f1
pop ebp
mov ah, 0xaf
loopne 0x42577f
salc
jo 0x425711
ror byte [ecx], cl
dec esi
push ds
cmpsd dword [esi], dword es:[edi]
xchg esi, eax
or byte [0x20868], 0
push 0x208
add byte [eax], al
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.00486960
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00486960
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00486960
push 0x208
lea eax, [ebp - 0xc40]
push 0
push eax
call fcn.00486960
push 0x208
lea eax, [ebp - 0xe48]
push 0
push eax
call fcn.00486960
push 0x208
lea eax, [ebp - 0xa38]
push 0
push eax
call fcn.00486960
add esp, 0x48
call fcn.00460351
add byte [ebx - 0x3617b73c], al
stosd dword es:[edi], eax
add eax, dword [eax]
test al, al
je 0x42579f
or esi, 2
sahf
jne 0x4257a2
mov dh, bl
rcr dword [ebp + eax*8 - 0x41], 1
rcr dword [edx], 1
invalid
call fcn.004602c7
add eax, dword [eax]
test al, al
je 0x4257bf
jb 0x425818
cmp eax, 0x7ac6735b
invalid
push str.1.7.1.0
lea ecx, [ebp - 0xf08]
call fcn.004023b0
push 0x5c6704
lea ecx, [ebp - 0xe90]
mov byte [ebp - 4], 1
call fcn.004023b0
mov ebx, dword [ebp - 0xf68]
lea ecx, [ebp - 0xf38]
push ebx
mov byte [ebp - 4], 2
call fcn.004023b0
mov byte [ebp - 4], 3
call fcn.004600e4
test al, al
je 0x42581c
mov esp, 0x17031bf5
out dx, al
and eax, 0x4fef1595
nop
imul eax, dword [ecx], 0x9d8bda0c
cwde
invalid
call fcn.004601b3
test al, al
je 0x425839
jae 0x425847
sbb al, 0x4b
xor byte [ebx - 0x5c], 0x48
ret
cmp dword [ebp - 0xf28], 0
je 0x42594b
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xf38]
push eax
lea ecx, [ebp - 0xf08]
call fcn.00402760
mov dword [ebp - 0xf74], 0
mov dword [ebp - 0xf70], 0
mov dword [ebp - 0xf6c], 0
push 0x626010
lea ecx, [ebp - 0xec0]
mov byte [ebp - 4], 4
call fcn.004023b0
push ebx
lea ecx, [ebp - 0xf50]
mov byte [ebp - 4], 5
call fcn.004023b0
lea eax, [ebp - 0xf74]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0xec0]
push eax
lea eax, [ebp - 0xf50]
push eax
call fcn.0046e149
add esp, 0xc
lea ecx, [ebp - 0xf50]
call fcn.00402370
lea ecx, [ebp - 0xec0]
mov byte [ebp - 4], 4
call fcn.00402370
mov ecx, dword [ebp - 0xf70]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0xf74]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 4
jne 0x42593c
jmp [edx]
lea eax, [ebp - 0xe90]
cmp eax, esi
je 0x425913
push 0xffffffffffffffff
push 0
push esi
mov ecx, eax
call fcn.00402760
push 0x626010
lea ecx, [ebp - 0xe90]
call fcn.00403ea0
mov eax, dword [ebp - 0xf74]
lea ecx, [ebp - 0xe90]
push 0xffffffffffffffff
add eax, 0x18
push 0
push eax
call fcn.004042c0
lea ecx, [ebp - 0xf74]
mov byte [ebp - 4], 3
call fcn.00406170
call fcn.004601b3
test al, al
je 0x425966
push ecx
dec esp
add bl, byte [esi - 0x6ee93756]
inc ecx
leave
inc edx
xlatb
invalid
call fcn.00427060
mov edi, eax
mov dword [ebp - 0xe4c], 7
xor eax, eax
mov dword [ebp - 0xf60], edi
mov dword [ebp - 0xe50], 0
mov word [ebp - 0xe60], ax
mov dword [ebp - 0xe64], 7
mov dword [ebp - 0xe68], eax
mov word [ebp - 0xe78], ax
mov byte [ebp - 4], 8
call fcn.004601f8
test al, al
je 0x4259ce
push edx
add bl, dh
adc edx, dword [ebx + 0x33]
push ss
push edi
int1
mov eax, 0x11154538
insd dword es:[edi], dx
out 0x9d, eax
out 0xa2, al
adc cl, byte [ebx - 0xf5f43]
invalid
call fcn.004607a1
test al, al
je 0x4259e7
invalid
test edi, edi
je 0x425a35
mov eax, dword [edi]
lea ecx, [ebp - 0xec0]
push ecx
mov ecx, edi
call dword [eax + 0x18]
push eax
lea ecx, [ebp - 0xe60]
call fcn.00403f10
lea ecx, [ebp - 0xec0]
call fcn.00402370
mov eax, dword [edi]
lea ecx, [ebp - 0xec0]
push ecx
mov ecx, edi
call dword [eax + 0x1c]
push eax
lea ecx, [ebp - 0xe78]
call fcn.00403f10
lea ecx, [ebp - 0xec0]
call fcn.00402370
cmp dword [ebp - 0xe50], 0
jne 0x425a4e
push 0x5c7818
lea ecx, [ebp - 0xe60]
call fcn.004024c0
call fcn.00460420
test al, al
je 0x425a67
leave
push edi
push 2
lcall 0x8a2c, 0x60f8d208
add bl, byte [edx + 0x60f8d208]
sub al, 0x8a
xor byte [ecx + 0x6fe84ff4], dl
test eax, 0xc0840003
call fcn.004603db
test al, al
add byte [eax + eax*8 + 0x1f401774], al
je 0x425a87
inc eax
pop ds
lds edi, [ebx]
mov word [ebx + 0x27], ds
or eax, 0x14480119
insd dword es:[edi], dx
mov ebx, 0x87e03f3d
pop ebp
jmp 0x425a6b
cmp dword [ebp - 0xe68], 0
jne 0x425aa0
push str.http:__www.znshuru.com_
lea ecx, [ebp - 0xe78]
call fcn.004024c0
call fcn.00460648
test al, al
je 0x425ac7
pop esp
push edx
or ch, byte [ebx + edi + 0x3e]
int3
call fcn.00460603
test al, al
je 0x425ae0
xor cl, byte [esi - 0x66f3353a]
jo 0x425a5b
xchg ecx, eax
mov esp, ebp
and dword [esp + ecx*8 - 0x54121721], eax
add eax, dword [eax]
call fcn.004606d2
test al, al
je 0x425b06
push ss
arpl word [edi], dx
push esp
fsubr dword [ebp - 0x24e7db10]
push esp
or ch, byte cs:[ebx]
push ebp
sub dword [ecx + edi*8 - 0x5c259cc3], ebx
push ds
mov ebp, dword [esp + ecx + 0x68ac49c4]
cmp byte [ebx - 0x7272ffa4], al
mov al, byte [0xe8fffff1]
mov ah, bl
std
jmp [edx - 1]
push 0x5c8338
lea ecx, [ebp - 0xe60]
call fcn.00403ea0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xe90]
push eax
lea ecx, [ebp - 0xe60]
call fcn.004042c0
call fcn.00409250
mov ecx, eax
call fcn.004617b1
push eax
lea ecx, [ebp - 0xef0]
call fcn.004023b0
push 0x5c71a0
lea ecx, [ebp - 0xef0]
mov byte [ebp - 4], 9
call fcn.00403ea0
call fcn.004606d2
test al, al
je 0x425b7c
cmp edx, dword [ecx + 0x7ca956f2]
push esp
mov ecx, 0x280002d2
mov bl, dl
jb 0x425bbc
pop esp
mov ah, byte [esi - 0x31]
inc esi
aas
mov dword [0xe8699f7d], eax
sub dword [ecx - 0x3f7bfffd], ebp
call fcn.004604aa
test al, al
je 0x425b96
scasb al, byte es:[edi]
in al, dx
in al, dx
add esp, 0xffffffc3
stc
adc byte [ecx + 0x4fba5fcc], bh
cdq
fild dword [ebx - 0x53f91763]
add eax, dword [eax]
call fcn.004607a1
test al, al
je 0x425baf
arpl word [edx + 0x16], ax
test byte [ecx], bl
add dword [ebx - 0x667cb707], 0x8122ebd5
push ss
call fcn.00409250
mov ecx, eax
call fcn.004617b1
push eax
lea ecx, [ebp - 0xed8]
call fcn.004023b0
push 0x5c833c
lea ecx, [ebp - 0xed8]
mov byte [ebp - 4], 0xa
call fcn.00403ea0
call fcn.004604ef
test al, al
test eax, 0xc0840003
je 0x425bf9
fsubrp st(7)
jns 0x425c06
out 0x79, eax
push ds
aaa
ja 0x425c1f
sbb al, 0x17
or al, 0xaf
inc esp
xchg dword [edi], ebp
stc
jg 0x425be5
invalid
call fcn.00460465
add eax, dword [eax]
test al, al
je 0x425c20
sbb ebp, dword [esi]
and dword [eax + 0x740720f3], 0xfffffff1
and byte [edi], al
je 0x425bfc
nop
out dx, al
ja 0x425bdd
div byte [edx - 0x56]
fld xword [eax - 0x52376fae]
lahf
add eax, 0xe2c7d0b8
in eax, 0xe8
repne stosb byte es:[edi], al
add eax, dword [eax]
call fcn.00460717
test al, al
je 0x425c49
mov edx, dword [esi + ebp*8 + 0x62ccc195]
inc ebp
sbb eax, 0xcab716c2
and byte [ebp + 0x66], 0x50
inc esi
lodsd eax, dword [esi]
add dword [eax - 0xe], eax
xor al, 0x80
inc ebx
inc edi
mov byte ds:[0xecd7fa74], al
push 0x5c7818
lea ecx, [ebp - 0xf20]
call fcn.004023b0
cmp dword [ebp - 0xedc], 8
lea ecx, [ebp - 0xef0]
mov byte [ebp - 4], 0xb
lea edx, [ebp - 0x830]
cmovae ecx, dword [ebp - 0xef0]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x425c77
cmp dword [ebp - 0xe4c], 8
lea ecx, [ebp - 0xe60]
lea edx, [ebp - 0x420]
cmovae ecx, dword [ebp - 0xe60]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x425ca2
cmp dword [ebp - 0xec4], 8
lea ecx, [ebp - 0xed8]
lea edx, [ebp - 0x628]
cmovae ecx, dword [ebp - 0xed8]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x425cd0
cmp dword [ebp - 0xf0c], 8
lea ecx, [ebp - 0xf20]
lea edx, [ebp - 0xc40]
cmovae ecx, dword [ebp - 0xf20]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x425d00
cmp dword [ebp - 0xe64], 8
lea ecx, [ebp - 0xe78]
lea edx, [ebp - 0xe48]
cmovae ecx, dword [ebp - 0xe78]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x425d30
cmp dword [ebp - 0xef4], 8
lea ecx, [ebp - 0xf08]
lea edx, [ebp - 0xa38]
cmovae ecx, dword [ebp - 0xf08]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x425d60
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425d80
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
push 0
push 0x5c8358
push dword [ebp - 0xf58]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call fcn.00460579
test al, al
je 0x425dcf
std
out 0xe8, al
lodsd eax, dword [esi]
mov cl, 0xb6
into
hlt
inc ebx
call fcn.00460351
test al, al
je 0x425df7
push esp
invalid
call fcn.0046082b
test al, al
je 0x425e18
in al, dx
mov ebx, dword [ebx]
mov esp, 0xb5054ffa
and eax, 0x96d4aea
invalid
cli
dec edi
add eax, 0x4aea25b5
insd dword es:[edi], dx
or eax, esi
sal dword [eax + eax*4], cl
clc
mov byte [0x2bbb6fda], al
mov ecx, 0x3aa0ee8
add byte [eax + eax*8 + 0x32e81874], al
loop 0x425e2a
call fcn.0046082b
test al, al
je 0x425e39
call 0x7b484058
cmpsd dword [esi], dword es:[edi]
jnp 0x425dce
xor bh, ch
xor eax, 0xe6e7114c
leave
dec esp
adc edi, esp
out 0xc9, al
jl 0x425e04
int1
inc edx
xchg dh, ah
outsd dx, dword cs:[esi]
push esp
call fcn.00460282
test al, al
je 0x425e60
mov edi, 0xb491aab1
add eax, 0x5957a95e
test al, 0x3c
invalid
lea ecx, [ebp - 0x628]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425e70
sub ecx, edx
sar ecx, 1
stc
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x628]
push eax
push 1
push 0
push str.UninstallString
push dword [ebp - 0xf58]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call fcn.00460420
test al, al
je 0x425ec2
ret 0xde59
call fcn.0046023d
test al, al
je 0x425ee1
pop esp
loopne 0x425e7e
pop ss
xchg ebx, eax
push ebx
fistp dword [edi + 0x506d8b5b]
movsb byte es:[edi], byte [esi]
invalid
call fcn.00460534
test al, al
je 0x425eff
invalid
call fcn.004604aa
test al, al
je 0x425f28
out dx, al
dec esp
imul ecx, ebp, 0xf81bb006
invalid
lea ecx, [ebp - 0x830]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425f31
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x830]
push eax
push 1
push 0
push str.DisplayIcon
push dword [ebp - 0xf58]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call fcn.00460717
test al, al
je 0x425f83
loop 0x425f48
mov esi, eax
add eax, 0xbbed5265
sbb byte [edi - 0x26], dl
das
push eax
hlt
call fcn.004603db
test al, al
je 0x425fa4
cmp ah, byte [0x34613382]
or cl, 0xd4
sbb dword [ebp + 0x46027a3], 0x4b
inc ecx
add eax, edi
stc
push ss
mov bh, 0xe6
sub al, 0xe8
sub byte [eax - 0x3f7bfffd], 0x74
sbb al, 0xce
call fcn.0046082b
test al, al
je 0x425fc9
into
mov eax, 0xad2e34a8
shr byte [ebx], 1
mov dword es:[0xf1a306b3], eax
inc ebp
add eax, 0xb26e3de2
mov ds, word [edi + esi*8]
add byte [ebx], ch
stc
invalid
lea ecx, [ebp - 0xa38]
lea edx, [ecx + 2]
push ecx
add ah, byte [esi - 0x75]
add dword [ebx - 0x7a99fd3f], eax
sal byte [ebp - 0xb], 0x8b
xor eax, sym.imp.ADVAPI32.dll_RegSetValueExW
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425fd2
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add byte [ebx], ch
retf 0xf9d1
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0xa38]
push eax
push 1
push 0
push str.DisplayVersion
push dword [ebp - 0xf58]
call esi
call fcn.004601b3
test al, al
je 0x426029
mov ch, 0x75
mov dh, 0x22
test bh, dl
jp 0x425fe2
sub esi, eax
sub ah, byte [ebp - 0x7fd22fb1]
sub ecx, ebx
add cl, byte [ebx + 0x5c504835]
add al, ch
jl 0x425fd0
call fcn.004604aa
add eax, dword [eax]
test al, al
je 0x426052
clc
dec ecx
aam 0x71
mov edx, 0xcabc3a6
loope 0x426020
aam 0x7a
pop edx
adc dword [ecx + 0x3d], ecx
mul byte [ecx]
hlt
lea ecx, [ebp - 0xc40]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426060
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0xc40]
push eax
push 1
push 0
push str.Publisher
push dword [ebp - 0xf58]
call esi
call fcn.004607a1
test al, al
je 0x4260b5
xchg ebp, eax
fidiv dword [ebp - 0x2a65f9a8]
in eax, dx
xor al, 0x42
pop ss
push es
and ch, byte [ecx + 0x65]
cmpsb byte [esi], byte es:[edi]
retf
call fcn.00460579
test al, al
je 0x4260da
mov esp, 0xc6492936
stosd dword es:[edi], eax
cwde
retf 0x3e53
lea ecx, [ebp - 0xe48]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4260e3
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0xe48]
push eax
push 1
push 0
push str.URLInfoAbout
push dword [ebp - 0xf58]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xf58]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push dword [ebp - 0xf5c]
call ebx
lea ecx, [ebp - 0xf20]
call fcn.00402370
lea ecx, [ebp - 0xed8]
call fcn.00402370
lea ecx, [ebp - 0xef0]
call fcn.00402370
lea ecx, [ebp - 0xe78]
call fcn.00402370
lea ecx, [ebp - 0xe60]
call fcn.00402370
lea ecx, [ebp - 0xf38]
call fcn.00402370
lea ecx, [ebp - 0xe90]
call fcn.00402370
lea ecx, [ebp - 0xf08]
call fcn.00402370
mov eax, dword [ebp - 0xe94]
cmp eax, 8
jb 0x4261a2
inc eax
lea ecx, [ebp - 0xea8]
push eax
push dword [ebp - 0xea8]
call fcn.00402610
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455afe
mov esp, ebp
pop ebp
ret 4