Function at 0x428538
Capabilities:
Get common file path
Query or enumerate registry key
Query or enumerate registry value
Set environment variable

Disassembly:
push 0x478
mov eax, 0x46a0c2
call fcn.00467994
call fcn.00429800
call fcn.00429946
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 0x45c], ebx
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
test eax, eax
jns 0x42856f
mov eax, 0x800401f0
jmp 0x428d36
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
mov dword [ebp - 0x460], ebx
push ecx
push ecx
mov dword [ebp - 4], ebx
call fcn.004397a6
test al, al
je 0x42868f
lea eax, [ebp - 0x440]
mov edx, 0x407598
push eax
push 9
push ecx
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00441760
test eax, eax
jne 0x42868f
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x448]
mov edi, 0xff
push eax
lea eax, [ebp - 0x214]
mov esi, ebx
push eax
push ebx
jmp 0x428669
push 0x407628
mov edx, edi
lea ecx, [ebp - 0x214]
call fcn.0042f0c9
lea eax, [ebp - 0x44c]
push eax
push 1
push ecx
mov ecx, dword [ebp - 0x440]
lea edx, [ebp - 0x214]
call fcn.00441760
test eax, eax
jne 0x428655
lea eax, [ebp - 0x458]
mov dword [ebp - 0x458], edi
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x454], 1
push eax
lea eax, [ebp - 0x454]
push eax
push ebx
push 0x407630
push dword [ebp - 0x44c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x428649
lea ecx, [ebp - 0x414]
call fcn.0043787f
push dword [ebp - 0x44c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x448]
inc esi
push eax
lea eax, [ebp - 0x214]
push eax
push esi
push dword [ebp - 0x440]
mov dword [ebp - 0x448], edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
je 0x4285d2
push dword [ebp - 0x440]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push ecx
push ecx
call fcn.00429041
test byte [0x4a2fc2], 8
je 0x4286b8
lea eax, [ebp - 0x42c]
mov edx, 0x406d40
push eax
push 1
push ecx
mov ecx, 0x4a0818
call fcn.00479253
test byte [0x4a2fc1], 8
je 0x4286d7
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
push eax
mov edx, 0x4070d0
mov ecx, 0x4a0818
call fcn.004792a1
mov ecx, 0x40764c
call fcn.00440ba5
call fcn.00429cc9
push 0x20
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetPriorityClass]
push ebx
push ebx
push 0x42f8e0
push 0x4a1a70
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitOnceExecuteOnce]
cmp byte [0x4a194a], 0
je 0x428715
call fcn.0047afea
mov byte [ebp - 0x457], 1
push 8
mov byte [ebp - 4], 2
call fcn.0042c877
pop ecx
push 2
push 8
push eax
mov dword [ebp - 0x44c], eax
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_InitializeAcl]
test eax, eax
je 0x428d93
lea ecx, [ebp - 0x484]
mov byte [ebp - 4], 3
call fcn.00429680
push 0x4a1414
push 1
push 0x4a13fc
lea ecx, [ebp - 0x448]
mov byte [ebp - 4], 4
call fcn.00428e62
push 0x4a142c
push 2
push 0x4a140c
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 5
call fcn.00428e62
lea eax, [ebp - 0x41c]
mov byte [ebp - 4], 6
push eax
push ebx
push ebx
push 0x801c
push ebx
call dword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
jns 0x42881d
mov ecx, dword [ebp + 4]
mov edx, 0xfd
push esi
push 0x40755c
call fcn.00478527
push esi
push 0x407678
push 0xfe
push 0x407708
call fcn.0043494a
xor ebx, ebx
add esp, 0x10
inc ebx
cmp dword [ebp - 0x440], 0
je 0x4287e8
push dword [ebp - 0x440]
call fcn.0042c5d6
pop ecx
cmp dword [ebp - 0x448], 0
je 0x4287fd
push dword [ebp - 0x448]
call fcn.0042c5d6
pop ecx
lea ecx, [ebp - 0x484]
call fcn.00429901
push dword [ebp - 0x44c]
call fcn.0042c5d6
pop ecx
mov byte [ebp - 4], 1
jmp 0x428cba
lea eax, [ebp - 0x41c]
push eax
push 0x407780
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x42885b
mov ecx, dword [ebp + 4]
mov edx, 0x107
push 0x40755c
call fcn.0047b157
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push eax
push 0x4077a0
push 0x108
jmp 0x4287c3
lea ecx, [ebp - 0x484]
call fcn.0042982d
mov esi, dword [ebp - 0x448]
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x454]
mov byte [ebp - 0x444], bl
push eax
lea eax, [ebp - 0x450]
mov dword [ebp - 0x450], esi
push eax
push ecx
push ecx
mov edi, 0xc0100000
lea ecx, [ebp - 0x44c]
mov dword [ebp - 0x454], edi
call fcn.0042a759
lea eax, [ebp - 0x444]
mov dword [ebp - 0x450], edi
mov edi, dword [ebp - 0x440]
push eax
lea eax, [ebp - 0x450]
mov byte [ebp - 0x444], bl
push eax
lea eax, [ebp - 0x454]
mov dword [ebp - 0x454], edi
push eax
push ecx
push ecx
lea ecx, [ebp - 0x44c]
call fcn.0042a759
push ecx
push dword [ebp - 0x44c]
push ecx
lea ecx, [ebp - 0x484]
call fcn.00429713
lea eax, [ebp - 0x484]
mov dword [ebp - 0x428], 0xc
mov dword [ebp - 0x424], eax
mov eax, ebx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x440], ebx
cmp eax, 0xf
jae 0x428a3e
push 0x407818
push 1
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov ecx, dword [0x4a2d60]
mov dword [ebp - 0x450], eax
test ecx, ecx
je 0x428953
cmp ecx, 0xffffffff
je 0x428953
call fcn.00431e2e
mov eax, dword [ebp - 0x450]
mov dword [0x4a2d60], eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
mov ecx, 0x4a2d60
mov dword [ebp - 0x450], edx
call fcn.0043baca
test al, al
je 0x42897c
test edx, edx
je 0x428a3e
mov ecx, dword [0x4a2d60]
test ecx, ecx
je 0x428996
cmp ecx, 0xffffffff
je 0x428996
call fcn.00431e2e
mov edx, dword [ebp - 0x450]
mov eax, 0xb7
mov dword [0x4a2d60], ebx
cmp edx, eax
jne 0x4289ee
push eax
push 0x4078b0
push 0x136
push 0x407708
call fcn.0043b3bf
add esp, 0x10
cmp dword [ebp - 0x440], 0xe
je 0x428a22
lea ecx, [ebp - 0x440]
call fcn.00437a40
push 0x7d0
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
mov eax, dword [ebp - 0x440]
inc eax
mov dword [ebp - 0x440], eax
jmp 0x428916
push edx
push 0x407840
push 0x131
push 0x407708
call fcn.0043494a
xor ebx, ebx
add esp, 0x10
inc ebx
test edi, edi
je 0x428a14
push edi
call fcn.0042c5d6
pop ecx
test esi, esi
je 0x4287fd
push esi
jmp 0x4287f7
push 0x407938
push 0x13a
push 0x407708
call fcn.0043494a
add esp, 0xc
push 2
pop ebx
jmp 0x428a09
test edi, edi
je 0x428a49
push edi
call fcn.0042c5d6
pop ecx
test esi, esi
je 0x428a54
push esi
call fcn.0042c5d6
pop ecx
lea ecx, [ebp - 0x484]
call fcn.00429901
push dword [ebp - 0x44c]
call fcn.0042c5d6
pop ecx
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 8
call fcn.004407b8
mov esi, eax
mov dword [ebp - 0x460], esi
test esi, esi
jne 0x428ac3
push 0x407a50
push 0x156
push 0x407708
call fcn.0043494a
mov edx, 0x158
mov ecx, dword [ebp + 4]
add esp, 0xc
xor ebx, ebx
inc ebx
push 0x80070057
push 0x40755c
call fcn.00478527
jmp 0x428814
cmp dword [ebp - 0x440], 2
jne 0x428b3a
xor edi, edi
inc edi
cmp edi, dword [ebp - 0x440]
jge 0x428b3a
mov ecx, dword [esi + edi*4]
movzx eax, word [ecx]
mov edx, eax
cmp eax, 0x2f
je 0x428ae9
cmp edx, 0x2d
jne 0x428b01
lea eax, [ecx + 2]
push 0x407b1c
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x428b1c
inc edi
jmp 0x428acf
push 0x407ab8
push 0x162
push 0x407708
call fcn.0043494a
mov edx, 0x164
jmp 0x428aa6
push 0x407ab8
push 0x16e
push 0x407708
call fcn.0043494a
mov edx, 0x170
jmp 0x428aa6
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
mov edi, eax
mov dword [ebp - 0x448], edi
mov ecx, dword [ebp + 4]
mov esi, dword [ebp - 0x448]
test esi, esi
jns 0x428b6c
push esi
push 0x40755c
mov edx, 0x178
call fcn.00475b3c
jmp 0x428c19
lea eax, [ebp - 0x440]
mov dword [ebp - 0x440], ebx
push eax
push 0x407c24
push 1
push ebx
push 0x405484
mov byte [ebp - 4], 0xa
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov ecx, dword [ebp + 4]
mov edi, 0x40755c
test eax, eax
jns 0x428ba8
push eax
push edi
mov edx, 0x180
call fcn.00475b3c
mov eax, dword [ebp - 0x440]
test eax, eax
je 0x428bd9
mov ecx, dword [eax]
push 1
push 5
push eax
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x4a47a8]
call esi
mov ecx, dword [ebp + 4]
test eax, eax
jns 0x428bd9
push eax
push edi
mov edx, 0x183
call fcn.00475b3c
push ecx
call fcn.00429072
mov ecx, dword [ebp + 4]
mov esi, eax
mov dword [ebp - 0x450], esi
test esi, esi
jns 0x428bfa
push esi
push edi
mov edx, 0x187
call fcn.00475b3c
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 9
call fcn.004193ae
test esi, esi
jns 0x428c46
mov esi, dword [ebp - 0x448]
mov edi, dword [ebp - 0x450]
push edi
push 0x407b30
push 0x18c
push 0x407708
call fcn.0043494a
add esp, 0x10
mov ebx, edi
test esi, esi
js 0x428814
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
jmp 0x428814
push ecx
push 3
pop esi
mov edx, esi
mov byte [ebp - 0x440], bl
mov ecx, 0x4074d8
call fcn.0043e8fc
test eax, eax
jne 0x428c6c
mov byte [ebp - 0x440], 1
call fcn.004395c8
push dword [ebp - 0x440]
call fcn.00429992
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x450], esi
call fcn.00437769
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
jmp 0x428cb3
mov dword [ebp - 4], 1
call dword [sym.imp.MSSRCH.DLL_public:_static_void___stdcall_CSearchServiceObj::Cleanup_void_]
lea edx, [ebp - 0x444]
mov byte [ebp - 0x444], 1
call fcn.00437733
test byte [0x4a2fc1], 8
je 0x428cf1
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
push eax
mov edx, 0x4070c0
mov ecx, 0x4a0818
call fcn.004792a1
test byte [0x4a2fc2], 8
je 0x428d13
lea eax, [ebp - 0x43c]
mov edx, 0x406d20
push eax
push 1
push ecx
mov ecx, 0x4a0818
call fcn.00479253
call fcn.0047ca21
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
lea ecx, [ebp - 0x458]
call fcn.0043808d
lea ecx, [ebp - 0x460]
call fcn.004380af
mov eax, ebx
call fcn.004678ce
ret 0x10
mov ecx, dword [ebp + 4]
mov edx, 0x16a
push 0x407c38
call fcn.0047bf5a
int3