Function at 0x42b430
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56368b
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x5d26e8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x258], ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x254], edi
cmp byte [ebx + 0x450], 0
je 0x42b562
push 1
push 0x58a919
call fcn.0042a5b0
test al, al
je 0x42b562
cmp word [ebx + 0x12], 0
jne 0x42b8eb
lea esi, [ebx + 0x14]
lea eax, [ebp - 0x244]
push eax
push 0x17
push esi
call fcn.00469d00
mov word [ebx + 0x12], ax
test ax, ax
jne 0x42b4c7
mov cx, word [ebp - 0x244]
mov word [ebp - 0x262], cx
lea edx, [ebp - 0x244]
push edx
push 0x18
push esi
call fcn.00469d00
mov word [ebx + 0x12], ax
test ax, ax
jne 0x42b554
mov ax, word [ebp - 0x244]
mov word [ebp - 0x264], ax
push 0
call fcn.004d0877
add esp, 4
mov edi, eax
mov ecx, edx
mov eax, dword [ebp - 0x264]
cdq
cmp ecx, edx
jg 0x42b515
jl 0x42b50c
cmp edi, eax
ja 0x42b515
cmp dword [ebp - 0x254], 0
jne 0x42b54e
push 0
mov ecx, edi
sar ecx, 0x10
push ecx
push 0x17
push 0x97ba
push esi
call fcn.00469d60
mov word [ebx + 0x12], ax
push 0
push edi
push 0x18
push 0x97ba
push esi
call fcn.00469d60
mov word [ebx + 0x12], ax
test ax, ax
jne 0x42b54e
mov dword [ebx + 4], 0xffffffff
mov edi, dword [ebp - 0x254]
push 0
mov ecx, ebx
call fcn.00428070
jmp 0x42b8eb
xor edi, edi
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
lea edx, [ebp - 0x278]
push edx
lea eax, [ebp - 0x118]
push eax
push 0x104
push str..ini
push str.TasManager
push edi
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
je 0x42b5db
lea ecx, [ebp - 0x240]
push ecx
lea edx, [ebp - 0x118]
push edx
call fcn.004a1e94
test eax, eax
je 0x42b5db
mov esi, dword [ebp - 0x240]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x25c], eax
jmp 0x42b5e6
mov dword [ebp - 0x25c], edi
mov esi, 0x41b43985
push edi
call fcn.004d0877
add esp, 4
mov edi, eax
mov dword [ebp - 0x264], edx
lea ecx, [ebp - 0x24c]
push ecx
push 0xf003f
push 0
push str.SoftwareDataEnvDesSolLtdManager
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x250], 4
test eax, eax
jne 0x42b6f1
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x274]
push ecx
push 0
push str.LastEnv
mov edx, dword [ebp - 0x24c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp - 0x244]
mov dword [ebp - 0x244], 0
rol ecx, 0x17
mov dword [ebp - 0x244], ecx
mov eax, ecx
shr eax, 0x18
mov cl, byte [ebp - 0x244]
xor al, cl
mov byte [ebp - 0x241], al
mov dl, byte [ebp - 0x243]
xor dl, cl
mov byte [ebp - 0x243], dl
xor byte [ebp - 0x242], dl
xor cl, dl
mov byte [ebp - 0x244], cl
mov edx, dword [ebp - 0x244]
mov ecx, edx
shr ecx, 0x1e
and cl, 3
mov eax, edx
shr eax, 0x18
xor cl, al
mov eax, edx
shr eax, 0x12
xor cl, al
mov eax, edx
shr eax, 0xc
xor cl, al
mov eax, edx
shr eax, 6
xor cl, al
and cl, 0x3f
mov eax, edx
and eax, 0x3f
cmp al, cl
je 0x42b6db
mov edx, 0x7fffffc0
jmp 0x42b6de
and edx, 0xffffffc0
mov dword [ebp - 0x244], edx
cmp dword [ebp - 0x25c], 0
je 0x42b7cc
lea ecx, [ebp - 0x270]
push ecx
lea edx, [ebp - 0x24c]
push edx
push 0
push 0xf003f
push 0
push str.REG_DWORD
push 0
push str.SoftwareDataEnvDesSolLtdManager
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, eax
mov eax, esi
shr eax, 6
xor eax, esi
shr eax, 6
xor eax, esi
shr eax, 6
xor eax, esi
and eax, 0xfc0
mov ecx, esi
shr ecx, 0x18
mov dword [ebp - 0x25c], 0
mov edx, esi
xor eax, ecx
and edx, 0xffffffc0
shr eax, 6
or eax, edx
mov ecx, eax
mov dword [ebp - 0x244], eax
shr ecx, 8
mov al, byte [ebp - 0x244]
xor al, cl
mov dl, byte [ebp - 0x243]
mov ecx, dword [ebp - 0x250]
xor byte [ebp - 0x242], dl
push ecx
lea edx, [ebp - 0x244]
mov byte [ebp - 0x244], al
xor byte [ebp - 0x243], al
xor byte [ebp - 0x241], al
push edx
mov eax, dword [ebp - 0x244]
push 4
ror eax, 0x17
push 0
mov dword [ebp - 0x244], eax
push str.LastEnv
mov eax, dword [ebp - 0x24c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, esi
mov dword [ebp - 0x244], edx
test ebx, ebx
mov ebx, dword [ebp - 0x258]
jne 0x42b8d8
cmp edi, edx
jae 0x42b7dd
cmp dword [ebp - 0x254], 0
jne 0x42b8d8
mov eax, edi
shr eax, 6
xor eax, edi
shr eax, 6
xor eax, edi
shr eax, 6
xor eax, edi
and eax, 0xfc0
mov ecx, edi
shr ecx, 0x18
xor eax, ecx
shr eax, 6
mov edx, edi
and edx, 0xffffffc0
or eax, edx
mov dword [ebp - 0x244], eax
mov ecx, eax
shr ecx, 8
mov al, byte [ebp - 0x244]
xor al, cl
mov byte [ebp - 0x244], al
mov cl, byte [ebp - 0x243]
xor byte [ebp - 0x242], cl
xor cl, al
mov byte [ebp - 0x243], cl
xor byte [ebp - 0x241], al
mov edx, dword [ebp - 0x244]
ror edx, 0x17
mov dword [ebp - 0x244], edx
mov eax, dword [ebp - 0x250]
push eax
lea ecx, [ebp - 0x244]
push ecx
push 4
xor esi, esi
push esi
push str.LastEnv
mov edx, dword [ebp - 0x24c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, esi
jne 0x42b8d8
mov dword [ebp - 0x240], edi
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x23c], eax
lea ecx, [ebp - 0x268]
call fcn.00495712
mov dword [ebp - 4], esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x240]
push ecx
lea edx, [ebp - 0x118]
push edx
call fcn.004a2066
mov dword [ebp - 4], esi
jmp 0x42b8ca
or esi, 0xffffffff
mov dword [ebp - 4], esi
call fcn.00495728
mov dword [ebx + 4], esi
mov ecx, dword [ebp - 0x24c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x254]
test edi, edi
je 0x42b990
inc dword [ebx + 4]
mov eax, dword [ebx + 4]
cmp eax, 2
jle 0x42b921
cmp eax, 7
jge 0x42b921
cdq
mov ecx, 3
idiv ecx
test edx, edx
jne 0x42b921
push edx
push 0x66
push 0x111
mov edx, dword [edi + 0x1c]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [ebx + 4]
cmp eax, 7
jle 0x42b948
cmp eax, 0xd
jge 0x42b948
cdq
mov ecx, 3
idiv ecx
test edx, edx
jne 0x42b948
push edx
push edx
push 0x10
mov edx, dword [edi + 0x1c]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [ebx + 4]
cmp eax, 0xd
jle 0x42b968
cmp eax, 0x13
jge 0x42b968
cdq
mov ecx, 3
idiv ecx
test edx, edx
jne 0x42b968
push edx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ebx, dword [ebx + 4]
cmp ebx, 0x13
jle 0x42b990
mov eax, ebx
cdq
mov ecx, 3
idiv ecx
test edx, edx
jne 0x42b990
push edx
push 0x68
push 0x111
mov edx, dword [edi + 0x1c]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004cdc91
mov esp, ebp
pop ebp
ret 4