Function at 0x426c50
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6f96
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x26c]
mov esi, dword [ebp + 8]
push eax
push 0x20019
push 0
push edi
push dword [ebx + 4]
mov dword [ebp - 0x270], esi
mov dword [ebp - 0x27c], edi
mov dword [ebp - 0x26c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x426d0a
cmp eax, 2
jne 0x426cc6
mov byte [ebp - 0x265], 0
jmp 0x426d11
cmp byte [ebx + 0x128], 0
je 0x426cd4
add ebx, 0x18
jmp 0x426cd7
mov ebx, dword [ebx + 0x14]
push eax
mov ecx, esi
call fcn.00429880
push 0x505984
mov esi, eax
push 0x50258c
push esi
call fcn.00405280
lea ecx, [ebx + 4]
push ecx
push 0x50258c
push esi
call fcn.00405280
add esp, 0x18
xor al, al
jmp 0x4270bc
mov byte [ebp - 0x265], 1
push dword [ebp - 0x26c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x265], 0
jne 0x426d84
cmp byte [ebp + 0xc], 0
je 0x4270ba
cmp byte [ebx + 0x128], 0
je 0x426d3e
add ebx, 0x18
jmp 0x426d41
mov ebx, dword [ebx + 0x14]
push 0x5059fc
mov ecx, esi
call fcn.004062d0
lea ecx, [ebx + 4]
mov esi, eax
push ecx
push 0x50258c
push esi
call fcn.00405280
push 0x4fb6d8
push 0x50258c
push esi
call fcn.00405280
push edi
push 0x50258c
push esi
call fcn.00405280
add esp, 0x24
xor al, al
jmp 0x4270bc
push edi
push dword [ebp + 0xc]
mov ecx, ebx
push esi
call fcn.00426ab0
test al, al
jne 0x4270ba
lea ecx, [ebp - 0x258]
mov dword [ebp - method.t_reg.virtual_0], vtable.t_reg.0
call fcn.00403e10
cmp byte [ebx + 0x128], 0
lea eax, [ebx + 0x18]
jne 0x426dbc
mov eax, dword [ebx + 0x14]
add eax, 4
lea ecx, [ebp - 0x264]
push eax
push dword [ebx + 4]
call fcn.004262d0
push 1
push 0
push 1
push edi
push esi
lea ecx, [ebp - 0x264]
mov dword [ebp - 4], 0
call fcn.00426590
test al, al
jne 0x426df9
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
jmp 0x427033
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x274]
mov dword [ebp - 0x274], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x260]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x426e7d
cmp byte [ebp - 0x13c], 0
lea edi, [ebp - 0x24c]
push eax
cmove edi, dword [ebp - 0x250]
mov ecx, esi
call fcn.00429880
push 0x505a38
mov esi, eax
push 0x50258c
push esi
call fcn.00405280
lea ecx, [edi + 4]
push ecx
push 0x50258c
push esi
call fcn.00405280
mov edi, dword [ebp - 0x270]
add esp, 0x18
mov ecx, edi
call fcn.004288e0
jmp 0x426e83
mov edi, dword [ebp - 0x270]
xor esi, esi
mov dword [ebp - 0x26c], esi
cmp dword [ebp - 0x274], esi
jbe 0x427003
nop word [eax + eax]
lea ecx, [ebp - 0x134]
call fcn.00403e10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12c]
push 0x401
mov dword [ebp - 0x14], 0x401
call fcn.00406110
cmp byte [ebp - 0x18], 0
lea eax, [ebp - 0x128]
push 0x3ff
cmove eax, dword [ebp - 0x12c]
add eax, 4
push eax
push 0
push dword [ebp - 0x260]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [ebp - 0x278], eax
lea ecx, [ebp - 0x134]
test eax, eax
je 0x426f92
call fcn.004048d0
push 1
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x130], 0
call fcn.00406110
cmp byte [ebp - 0x18], 0
lea eax, [ebp - 0x128]
push dword [ebp - 0x278]
cmove eax, dword [ebp - 0x12c]
lea edi, [ebp - 0x24c]
xor ecx, ecx
mov word [eax + 4], cx
cmp byte [ebp - 0x13c], cl
mov ecx, dword [ebp - 0x270]
cmove edi, dword [ebp - 0x250]
call fcn.00429880
push 0x505a68
mov esi, eax
push 0x50258c
push esi
call fcn.00405280
lea ecx, [edi + 4]
push ecx
push 0x50258c
push esi
call fcn.00405280
mov esi, dword [ebp - 0x26c]
add esp, 0x18
mov edi, dword [ebp - 0x270]
jmp 0x426f97
call fcn.004048d0
cmp byte [ebp - 0x18], 0
lea eax, [ebp - 0x128]
lea ecx, [ebp - 0x264]
cmove eax, dword [ebp - 0x12c]
add eax, 4
push eax
push dword [ebp + 0xc]
push edi
call fcn.00426c50
test al, al
je 0x427084
mov byte [ebp - 4], 0
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x426ff0
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x426ff0
push eax
call fcn.0049c7b1
add esp, 4
inc esi
mov dword [ebp - 0x26c], esi
cmp esi, dword [ebp - 0x274]
jb 0x426ea0
mov eax, dword [ebp - 0x260]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x427016
push eax
call esi
push dword [ebp - 0x27c]
mov ecx, ebx
mov dword [ebp - 0x260], 0
push dword [ebp + 0xc]
push edi
call fcn.00426ab0
mov bl, al
mov eax, dword [ebp - 0x260]
mov dword [ebp - method.t_reg.virtual_0], vtable.t_reg.0
test eax, eax
je 0x42704a
push eax
call esi
cmp byte [ebp - 0x13c], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x427080
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x24c]
cmp eax, ecx
je 0x427080
push eax
call fcn.0049c7b1
add esp, 4
mov al, bl
jmp 0x4270bc
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4270ad
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x4270ad
push eax
call fcn.0049c7b1
add esp, 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
jmp 0x427033
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret 0xc