Function at 0x428d70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x5d26e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [str.localhost]
mov dx, word [0x57cca8]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x36
mov dword [ebp - 0x44], eax
mov esi, ecx
mov ecx, dword [0x57cca4]
lea eax, [ebp - 0x3a]
push 0
push eax
mov dword [ebp - 0x40], ecx
mov word [ebp - 0x3c], dx
call fcn.004cdca0
add esp, 0xc
cmp byte [esi + 0x45c], 0
jne 0x428fdc
lea ecx, [ebp - 0x48]
push ecx
push 0x20019
push 0
push str.SoftwareEDSLTasManager
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x428e03
lea edx, [ebp - 0x4c]
push edx
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
push str.LicSvr
push edx
mov dword [ebp - 0x4c], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x44]
push ecx
mov esi, str.rnbo_standalone
call fcn.004d208c
add esp, 4
mov edi, edi
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x428e40
test cl, cl
je 0x428e3c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x428e40
add eax, 2
add esi, 2
test cl, cl
jne 0x428e20
xor eax, eax
jmp 0x428e45
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x428fc9
lea edx, [ebp - 0x44]
push edx
mov esi, str.rnbo_spn_driver
call fcn.004d208c
add esp, 4
mov edi, edi
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x428e80
test cl, cl
je 0x428e7c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x428e80
add eax, 2
add esi, 2
test cl, cl
jne 0x428e60
xor eax, eax
jmp 0x428e85
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x428fc9
lea eax, [ebp - 0x44]
push eax
mov esi, str.rnbo_spn_all_modes
call fcn.004d208c
add esp, 4
mov edi, edi
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x428ec0
test cl, cl
je 0x428ebc
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x428ec0
add eax, 2
add esi, 2
test cl, cl
jne 0x428ea0
xor eax, eax
jmp 0x428ec5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x428fc9
lea ecx, [ebp - 0x44]
push ecx
mov esi, str.rnbo_spn_local
call fcn.004d208c
add esp, 4
mov edi, edi
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x428f00
test cl, cl
je 0x428efc
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x428f00
add eax, 2
add esi, 2
test cl, cl
jne 0x428ee0
xor eax, eax
jmp 0x428f05
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x428fc9
lea edx, [ebp - 0x44]
push edx
mov esi, str.rnbo_spn_broadcast
call fcn.004d208c
add esp, 4
mov edi, edi
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x428f40
test cl, cl
je 0x428f3c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x428f40
add eax, 2
add esi, 2
test cl, cl
jne 0x428f20
xor eax, eax
jmp 0x428f45
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x428fc9
lea eax, [ebp - 0x44]
push eax
mov esi, str.rnbo_spn_all_modes
call fcn.004d208c
add esp, 4
mov edi, edi
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x428f80
test cl, cl
je 0x428f7c
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x428f80
add eax, 2
add esi, 2
test cl, cl
jne 0x428f60
xor eax, eax
jmp 0x428f85
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x428fc9
lea ecx, [ebp - 0x44]
push ecx
mov esi, 0x57cc38
call fcn.004d208c
add esp, 4
lea ebx, [ebx]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x428fc0
test cl, cl
je 0x428fbc
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x428fc0
add eax, 2
add esi, 2
test cl, cl
jne 0x428fa0
xor eax, eax
jmp 0x428fc5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x428fdc
push str.localhost
lea edx, [ebp - 0x44]
push 0x40
push edx
call fcn.004cf19e
add esp, 0xc
lea eax, [ebp - 0x44]
mov edx, edi
mov ecx, eax
pop edi
sub edx, ecx
pop esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x428fe7
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cdc91
mov esp, ebp
pop ebp
ret 4