Function at 0x424140
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dac09
mov eax, dword fs:[0]
push eax
mov eax, 0x22ac
call fcn.00451480
mov eax, dword [0x66f33c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x22a0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x22b8], eax
call fcn.00454588
test al, al
je 0x4241ac
pop esp
pop edx
push ecx
push esi
pop edx
pop ebx
pop edi
push esi
pop ebp
pop ecx
pop esp
push eax
pop ebp
pop edx
push ebp
pop ecx
push ebx
pop esi
pop eax
pop edx
push ebx
push esi
pop ecx
push ebp
push ebx
pop ebp
pop ecx
push edx
push edx
pop edi
push eax
call fcn.0045469c
test al, al
je 0x4241d2
pop ebx
push ecx
push ebp
pop edi
push edx
pop ecx
push esp
pop ebx
pop ecx
pop edi
push ebx
push ebx
push esp
pop edi
pop edx
push ebx
push ebx
pop edi
pop eax
pop ebp
pop esi
pop edi
pop ebx
push esp
pop ebp
pop eax
pop esi
pop edi
pop ecx
mov dword [ebp - 0x22b0], 0
mov dword [ebp - 0x22ac], 0
mov dword [ebp - 0x22a8], 0
push 0x20
push str.28d2571ef4cce1033757ae1db06c9eb0
lea ecx, [ebp - 0x2248]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2234], 0xf
mov dword [ebp - 0x2238], 0
mov byte [ebp - 0x2248], 0
call fcn.00405be0
lea eax, [ebp - 0x2248]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x22b0]
call fcn.00411b00
mov eax, dword [ebp - 0x2234]
mov byte [ebp - 4], 0
cmp eax, 0x10
jb 0x42425c
inc eax
lea ecx, [ebp - 0x2248]
push eax
push dword [ebp - 0x2248]
call fcn.004053c0
push 0x20
push str.b4e5c2f891e0360c3ade558d2d548e5b
lea ecx, [ebp - 0x2248]
mov dword [ebp - 0x2234], 0xf
mov dword [ebp - 0x2238], 0
mov byte [ebp - 0x2248], 0
call fcn.00405be0
lea eax, [ebp - 0x2248]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x22b0]
call fcn.00411b00
mov eax, dword [ebp - 0x2234]
mov byte [ebp - 4], 0
cmp eax, 0x10
jb 0x4242c1
inc eax
lea ecx, [ebp - 0x2248]
push eax
push dword [ebp - 0x2248]
call fcn.004053c0
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x229c], 0
push 0
push eax
call fcn.0047be90
mov esi, dword [ebp - 0x22a0]
lea eax, [ebp - 0x218]
add esp, 0xc
xor ebx, ebx
mov dword [ebp - 0x2294], ebx
mov dword [ebp - 0x22a4], ebx
push 0x104
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x42482c
test ebx, ebx
jne 0x42482c
lea eax, [ebp - 0x229c]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4247f8
call fcn.00454993
test al, al
je 0x424356
push esi
push edi
push ecx
pop edi
push eax
pop ebx
pop esp
push esp
pop esp
pop edi
push ebx
pop edx
push esi
pop esp
push eax
push eax
pop ebx
pop ecx
push esp
pop ebp
pop esi
pop edx
push ecx
call fcn.004547b0
test al, al
je 0x42437e
push ebx
push edx
pop edx
push ebx
pop ebx
pop ecx
push eax
pop eax
pop esp
push edx
pop edx
pop ecx
push eax
pop esp
pop esp
push esp
push ebx
push esi
pop ebx
push edx
pop ebp
push ecx
push esp
push edx
pop edx
pop esp
pop edx
push ebx
push edx
pop esp
push ecx
call fcn.0045483a
test al, al
je 0x424397
push eax
push esp
pop edi
push esi
push edi
pop ebp
push ebx
push edx
pop ecx
push edi
push esp
pop esi
pop edx
pop ebx
pop esi
pop ebp
call fcn.0045494e
test al, al
je 0x4243b3
push esp
push edi
push ebx
pop ebp
pop esi
pop eax
pop ebx
push esi
pop ebx
push esi
push edx
push edi
push ebp
pop ebx
pop edx
pop ebx
pop esp
pop esp
push edi
xor eax, eax
mov dword [ebp - 0x2234], 7
mov dword [ebp - 0x2238], 0
mov word [ebp - 0x2248], ax
cmp word [ebp - 0x218], ax
jne 0x4243dd
xor ecx, ecx
jmp 0x4243f5
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4243e6
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2248]
call fcn.00403000
lea eax, [ebp - 0x2248]
mov byte [ebp - 4], 3
push eax
call fcn.0045abba
add esp, 4
mov dword [ebp - 0x224c], 7
xor eax, eax
mov dword [ebp - 0x2250], 0
mov word [ebp - 0x2260], ax
lea ecx, [ebp - 0x2260]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x2248]
push eax
call fcn.00402ee0
push 1
push 0x5e28c0
lea ecx, [ebp - 0x2260]
mov byte [ebp - 4], 4
call fcn.00405290
push 0x12
push 0x5e28c4
lea ecx, [ebp - 0x2260]
call fcn.00405290
lea eax, [ebp - 0x2260]
push eax
lea eax, [ebp - 0x2278]
push eax
call fcn.004599b0
add esp, 8
mov esi, dword [ebp - 0x22b0]
mov ebx, dword [ebp - 0x22ac]
mov byte [ebp - 4], 5
mov dword [ebp - 0x2298], 0
cmp esi, ebx
je 0x424503
nop dword [eax]
cmp dword [esi + 0x14], 0x10
jb 0x4244ba
mov edi, dword [esi]
jmp 0x4244bc
mov edi, esi
lea ecx, [ebp - 0x2278]
call fcn.00427b50
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x4244e7
test cl, cl
je 0x4244e3
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x4244e7
add eax, 2
add edi, 2
test cl, cl
jne 0x4244c7
xor eax, eax
jmp 0x4244ec
sbb eax, eax
or eax, 1
test eax, eax
je 0x4244f9
add esi, 0x18
cmp esi, ebx
jne 0x4244b0
jmp 0x424503
mov dword [ebp - 0x2298], 1
call fcn.00454588
test al, al
je 0x42451e
pop edx
pop edi
push edx
pop ebx
pop ebp
pop edx
push esp
pop edx
push esp
push ebp
pop ebp
pop edi
push eax
push esp
push esp
push ebx
pop edi
pop edi
call fcn.004547b0
test al, al
je 0x424542
push edi
push edi
push eax
push edi
pop ecx
push ebp
push esp
pop ebp
push ebp
push ebp
pop edi
pop ebp
push ebp
pop esp
pop ecx
push esp
push eax
pop esp
push esi
pop esp
push ebp
push esi
push eax
push edi
pop edx
push edx
push esp
call fcn.00454612
test al, al
je 0x42455d
pop edi
push edi
push ebx
push edx
pop esi
pop edi
push ebx
pop ebx
push esp
push eax
pop eax
push ebx
pop esi
push ebx
push ebx
push esp
pop ecx
pop ebx
cmp dword [ebp - 0x2298], 0
je 0x42475d
push 0x2000
lea eax, [ebp - 0x2218]
mov dword [ebp - 0x2298], 0x1000
push 0
push eax
call fcn.0047be90
xor eax, eax
mov dword [ebp - 0x22b4], 1
add esp, 0xc
mov dword [ebp - 0x221c], 7
mov dword [ebp - 0x2220], 0
mov word [ebp - 0x2230], ax
lea eax, [ebp - 0x2298]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x2218]
push eax
lea eax, [ebp - 0x22b4]
push eax
push 0
push str.UninstallString
push dword [ebp - 0x229c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x424733
lea eax, [ebp - 0x2218]
mov dword [ebp - 0x2294], 1
push eax
lea eax, [ebp - 0x2290]
push eax
call fcn.00458c77
add esp, 8
mov esi, eax
lea eax, [ebp - 0x2230]
cmp eax, esi
je 0x424658
mov eax, dword [ebp - 0x221c]
cmp eax, 8
jb 0x42462f
inc eax
lea ecx, [ebp - 0x2230]
push eax
push dword [ebp - 0x2230]
call fcn.00403100
xor eax, eax
mov dword [ebp - 0x221c], 7
push esi
lea ecx, [ebp - 0x2230]
mov dword [ebp - 0x2220], 0
mov word [ebp - 0x2230], ax
call fcn.00405110
mov eax, dword [ebp - 0x227c]
mov byte [ebp - 4], 6
cmp eax, 8
jb 0x42467a
inc eax
lea ecx, [ebp - 0x2290]
push eax
push dword [ebp - 0x2290]
call fcn.00403100
push 0xa
push 0
push str.MailMaster
lea ecx, [ebp - 0x2230]
call fcn.00405410
cmp eax, 0xffffffff
jle 0x424721
push eax
push 0
lea eax, [ebp - 0x2290]
push eax
lea ecx, [ebp - 0x2230]
call fcn.00419070
mov esi, eax
lea eax, [ebp - 0x2230]
cmp eax, esi
je 0x4246ff
mov eax, dword [ebp - 0x221c]
cmp eax, 8
jb 0x4246d6
inc eax
lea ecx, [ebp - 0x2230]
push eax
push dword [ebp - 0x2230]
call fcn.00403100
xor eax, eax
mov dword [ebp - 0x221c], 7
push esi
lea ecx, [ebp - 0x2230]
mov dword [ebp - 0x2220], 0
mov word [ebp - 0x2230], ax
call fcn.00405110
mov eax, dword [ebp - 0x227c]
mov byte [ebp - 4], 6
cmp eax, 8
jb 0x424721
inc eax
lea ecx, [ebp - 0x2290]
push eax
push dword [ebp - 0x2290]
call fcn.00403100
mov ecx, dword [ebp - 0x22b8]
lea eax, [ebp - 0x2230]
push eax
call fcn.00427bb0
push dword [ebp - 0x229c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x221c]
cmp eax, 8
jb 0x42475d
inc eax
lea ecx, [ebp - 0x2230]
push eax
push dword [ebp - 0x2230]
call fcn.00403100
mov eax, dword [ebp - 0x2264]
cmp eax, 0x10
jb 0x42477b
inc eax
lea ecx, [ebp - 0x2278]
push eax
push dword [ebp - 0x2278]
call fcn.004053c0
mov eax, dword [ebp - 0x224c]
mov dword [ebp - 0x2264], 0xf
mov dword [ebp - 0x2268], 0
mov byte [ebp - 0x2278], 0
cmp eax, 8
jb 0x4247b4
inc eax
lea ecx, [ebp - 0x2260]
push eax
push dword [ebp - 0x2260]
call fcn.00403100
xor eax, eax
mov dword [ebp - 0x224c], 7
mov word [ebp - 0x2260], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x2234]
mov dword [ebp - 0x2250], 0
cmp eax, 8
jb 0x4247f2
inc eax
lea ecx, [ebp - 0x2248]
push eax
push dword [ebp - 0x2248]
call fcn.00403100
mov ebx, dword [ebp - 0x2294]
mov eax, dword [ebp - 0x22a4]
lea ecx, [ebp - 0x218]
push 0x104
inc eax
push ecx
push eax
push dword [ebp - 0x22a0]
mov dword [ebp - 0x22a4], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, dword [ebp - 0x22a0]
test eax, eax
je 0x424311
call fcn.004543ea
test al, al
je 0x424854
push ebx
push ecx
pop edx
pop ecx
pop edx
push eax
pop ecx
push edi
push ebx
push edx
push edx
push edi
pop esi
pop ebx
push esp
push esi
push eax
pop edi
pop eax
push esp
push edx
pop edi
pop esi
push ebp
pop eax
pop edx
pop esi
push ebx
push ebp
pop ebp
push esi
call fcn.00454726
test al, al
je 0x42487b
pop esi
pop ebp
pop ebx
pop ecx
push ecx
push ebp
pop eax
push esi
pop ecx
pop eax
pop edx
push ebp
pop eax
push esp
pop esi
pop esi
push edi
pop ecx
pop ebx
push eax
push esi
pop edi
pop ecx
push ecx
pop eax
push esi
push ebp
pop eax
push edi
pop ecx
call fcn.00454909
test al, al
je 0x4248a3
push esp
pop eax
push ecx
pop edi
push ecx
pop ecx
pop eax
push esp
pop ecx
pop edi
pop edi
push ebx
pop ecx
pop edx
pop ecx
push eax
pop esp
pop eax
push edx
pop ecx
pop eax
pop ebx
pop eax
pop ecx
pop edx
push ebp
push ecx
pop eax
push edi
push esp
pop edx
lea ecx, [ebp - 0x22b0]
call fcn.004060c0
mov eax, dword [ebp - 0x2294]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045132d
mov esp, ebp
pop ebp
ret 8