Function at 0x4278c0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b66b9
mov eax, dword fs:[0]
push eax
sub esp, 0x1c8
mov eax, dword [0x4ef7d0]
xor eax, esp
mov dword [esp + 0x1c0], eax
push ebx
push esi
push edi
mov eax, dword [0x4ef7d0]
xor eax, esp
push eax
lea eax, [esp + 0x1d8]
mov dword fs:[0], eax
mov dword [esp + 0x48], ecx
xor esi, esi
xor edi, edi
mov dword [esp + 0x1c], esi
lea eax, [esp + 0x24]
push eax
push 0x20019
push edi
push str.SoftwareNotepad2Formatting
push 0x80000001
mov dword [esp + 0x1f4], edi
mov dword [esp + 0x38], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x42793e
mov esi, dword [esp + 0x24]
mov dword [esp + 0x1c], esi
push edi
push edi
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x48]
push edx
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push esi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x70], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp esi, edi
je 0x42796f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x1c], edi
cmp dword [esp + 0x3c], edi
jbe 0x427d26
cmp dword [esp + 0x40], edi
jbe 0x427d26
mov eax, dword [0x4f1218]
mov ebx, dword [0x4f1214]
cmp ebx, eax
mov edi, eax
jbe 0x4279a4
call fcn.0049ed6a
mov eax, dword [0x4f1218]
mov ebx, dword [0x4f1214]
cmp ebx, eax
mov esi, 0x4f1210
jbe 0x4279b2
call fcn.0049ed6a
push edi
push esi
push ebx
mov eax, 0x4f1210
push eax
lea eax, [esp + 0x24]
push eax
mov ecx, 0x4f1210
call fcn.00424010
xor esi, esi
mov eax, 0xf
mov edi, 0xff
mov dword [esp + 0x38], edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], esi
mov byte [esp + 0x50], 0
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc0], esi
mov byte [esp + 0xb0], 0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov byte [esp + 0x1e0], 1
nop
lea ecx, [esp + 0x20]
push ecx
push 0x20019
push 0
push str.SoftwareNotepad2Formatting
push 0x80000001
call ebx
test eax, eax
jne 0x427aa0
mov ecx, dword [esp + 0x20]
push eax
push eax
push eax
push eax
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0xe0]
push eax
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
mov edx, dword [esp + 0x20]
push edx
jne 0x427a9a
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0xcc]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x427a62
sub eax, edx
push eax
lea eax, [esp + 0xd0]
push eax
lea ecx, [esp + 0x54]
call fcn.004068a0
lea ecx, [esp + 0x4c]
push ecx
mov ecx, 0x4f1210
call fcn.00410a60
mov dword [esp + 0x38], edi
add esi, 1
jmp 0x427a10
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [0x4f1214]
mov ecx, dword [0x4f1218]
xor edi, edi
cmp ebx, edi
je 0x427cc3
mov esi, ecx
sub esi, ebx
mov eax, 0x84210843
imul esi
add edx, esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x427cc3
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
push 0x20019
push str.SoftwareNotepad2Formatting
push 0x80000001
lea ecx, [esp + 0x28]
mov byte [esp + 0x1ec], 2
call fcn.004013c0
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov ebx, dword [0x4f1214]
test ebx, ebx
mov edi, dword [esp + 0x1c]
mov ecx, dword [0x4f1218]
jne 0x427b1b
xor eax, eax
jmp 0x427b32
mov esi, ecx
sub esi, ebx
mov eax, 0x84210843
imul esi
add edx, esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov esi, dword [esp + 0x20]
cmp esi, eax
jge 0x427c84
test ebx, ebx
mov dword [esp + 0x28], 0
je 0x427b63
sub ecx, ebx
mov eax, 0x84210843
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jb 0x427b6e
call fcn.0049ed6a
mov ebx, dword [0x4f1214]
mov ecx, dword [esp + 0x24]
add ebx, ecx
cmp dword [ebx + 0x18], 0x10
lea esi, [ebx + 4]
jb 0x427b81
mov eax, dword [esi]
jmp 0x427b83
mov eax, esi
lea edx, [esp + 0x28]
push edx
push 0
lea ecx, [esp + 0x4c]
push ecx
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x427c75
cmp dword [esp + 0x44], 3
jne 0x427c75
mov eax, dword [esp + 0x28]
test eax, eax
je 0x427c75
add eax, 2
cmp dword [esp + 0x34], eax
jae 0x427bcb
push eax
lea ecx, [esp + 0x34]
call fcn.00402b50
cmp dword [ebx + 0x18], 0x10
jb 0x427bd5
mov eax, dword [esi]
jmp 0x427bd7
mov eax, esi
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x28]
push edx
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push eax
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x427c75
cmp dword [esp + 0x2c], 3
jne 0x427c75
cmp dword [esp + 0x28], eax
je 0x427c75
mov edx, dword [esp + 0x30]
lea eax, [ebx + 0x1c]
mov esi, edx
mov edi, eax
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
movzx eax, word [eax]
lea ecx, [edx + eax]
mov edx, dword [esp + 0x28]
push 0
sub edx, eax
shr edx, 1
push 0xffffffffffffffff
mov word [ecx + edx*2], 0
push ecx
lea ecx, [esp + 0x20]
call fcn.0041c0e0
mov eax, dword [eax + 4]
push eax
lea ecx, [ebx + 0x60]
mov byte [esp + 0x1e4], 3
call fcn.00407dc0
mov eax, dword [esp + 0x18]
test eax, eax
mov byte [esp + 0x1e0], 2
mov dword [esp + 0x14], vtable.util::utf8::string_convert_base_char_.0
je 0x427c75
push eax
call fcn.0049ed7a
add esp, 4
add dword [esp + 0x20], 1
add dword [esp + 0x24], 0x7c
jmp 0x427b03
test edi, edi
je 0x427ca3
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x4f1218]
mov ebx, dword [0x4f1214]
mov dword [esp + 0x1c], 0
cmp dword [esp + 0x30], 0
je 0x427cc3
mov eax, dword [esp + 0x30]
push eax
call fcn.0049ed7a
mov ecx, dword [0x4f1218]
mov ebx, dword [0x4f1214]
add esp, 4
mov esi, 0x10
cmp dword [esp + 0xc4], esi
mov byte [esp + 0x1e0], 0
jb 0x427cf5
mov ecx, dword [esp + 0xb0]
push ecx
call fcn.0049ea7d
mov ecx, dword [0x4f1218]
mov ebx, dword [0x4f1214]
add esp, 4
cmp dword [esp + 0x64], esi
mov dword [esp + 0xc4], 0xf
mov dword [esp + 0xc0], 0
mov byte [esp + 0xb0], 0
jb 0x427d32
mov edx, dword [esp + 0x50]
push edx
call fcn.0049ea7d
add esp, 4
mov ebx, dword [0x4f1214]
mov ecx, dword [0x4f1218]
test ebx, ebx
je 0x427d51
sub ecx, ebx
mov eax, 0x84210843
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x4281d9
mov eax, 0xf
xor edi, edi
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], edi
mov byte [esp + 0x50], 0
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc0], edi
mov byte [esp + 0xb0], 0
push 4
push str.ansi
lea ecx, [esp + 0x54]
mov byte [esp + 0x1e8], 4
call fcn.004068a0
push 0x43
lea ecx, [esp + 0x6c]
push edi
push ecx
call fcn.0049e8b0
add esp, 0xc
push edi
push 0xffffffffffffffff
mov ebx, 2
push 0x4c91b0
lea ecx, [esp + 0x20]
mov byte [esp + 0x76], 0x63
mov word [esp + 0x77], 4
mov word [esp + 0x87], bx
mov byte [esp + 0x7c], 0
call fcn.0041c0e0
mov ecx, dword [eax + 4]
mov eax, ecx
mov byte [esp + 0x1e0], 5
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x427de2
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0xb4]
call fcn.004068a0
mov eax, dword [esp + 0x18]
cmp eax, edi
mov byte [esp + 0x1e0], 4
mov dword [esp + 0x14], vtable.util::utf8::string_convert_base_char_.0
je 0x427e1c
push eax
call fcn.0049ed7a
add esp, 4
lea edx, [esp + 0x4c]
push edx
mov ecx, 0x4f1210
call fcn.00410a60
push 3
push 0x4c91ac
lea ecx, [esp + 0x54]
call fcn.004068a0
push 0x43
lea eax, [esp + 0x6c]
push edi
push eax
call fcn.0049e8b0
add esp, 0xc
push edi
push 0xffffffffffffffff
push str.GNU_style_formatting_indenting._n_nnamespace_foospace_n___n____int_Foo___n_______n________if__isBar__n___________n____________bar____n____________return_1__n___________n________else_n__________return_0__n_______n_n
lea ecx, [esp + 0x20]
mov byte [esp + 0x76], 0x63
mov word [esp + 0x77], bx
mov word [esp + 0x87], bx
mov byte [esp + 0x7d], 1
call fcn.0041c0e0
mov ecx, dword [eax + 4]
mov eax, ecx
mov byte [esp + 0x1e0], 6
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x427e83
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0xb4]
call fcn.004068a0
mov eax, dword [esp + 0x18]
cmp eax, edi
mov byte [esp + 0x1e0], 4
mov dword [esp + 0x14], vtable.util::utf8::string_convert_base_char_.0
je 0x427ebd
push eax
call fcn.0049ed7a
add esp, 4
lea ecx, [esp + 0x4c]
push ecx
mov ecx, 0x4f1210
call fcn.00410a60
push ebx
push 0x4c9008
lea ecx, [esp + 0x54]
call fcn.004068a0
push 0x43
lea edx, [esp + 0x6c]
push edi
push edx
call fcn.0049e8b0
add esp, 0xc
push edi
push 0xffffffffffffffff
push str.KernighanRitchie_style_formatting_indenting._n_nnamespace_foospace__n____int_Foo____n________if__isBar___n____________bar____n____________return_1__n_________else_n____________return_0__n_____n_n
lea ecx, [esp + 0x20]
mov byte [esp + 0x76], 0x63
mov word [esp + 0x77], 4
mov word [esp + 0x87], 1
mov byte [esp + 0x7c], 0
call fcn.0041c0e0
mov ecx, dword [eax + 4]
mov eax, ecx
mov byte [esp + 0x1e0], 7
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x427f27
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0xb4]
call fcn.004068a0
mov eax, dword [esp + 0x18]
cmp eax, edi
mov byte [esp + 0x1e0], 4
mov dword [esp + 0x14], vtable.util::utf8::string_convert_base_char_.0
je 0x427f61
push eax
call fcn.0049ed7a
add esp, 4
lea eax, [esp + 0x4c]
push eax
mov ecx, 0x4f1210
call fcn.00410a60
push 5
push str.linux
lea ecx, [esp + 0x54]
call fcn.004068a0
push 0x43
lea ecx, [esp + 0x6c]
push edi
push ecx
call fcn.0049e8b0
add esp, 0xc
push edi
push 0xffffffffffffffff
mov ebx, 8
push str.Linux_style_formatting_indenting__brackets_are_broken_apart_from_class_function_declarations__but_connected_to_command_lines__and_indents_are_set_to_8_spaces_._n_nnamespace_foospace_n_n________int_Foo___n_________n________________if__isBar___n________________________bar____n________________________return_1__n_________________else_n________________________return_0__n_________n_n
lea ecx, [esp + 0x20]
mov byte [esp + 0x76], 0x63
mov word [esp + 0x77], bx
mov word [esp + 0x87], 3
mov byte [esp + 0x7c], 0
call fcn.0041c0e0
mov ecx, dword [eax + 4]
mov eax, ecx
mov byte [esp + 0x1e0], bl
lea esi, [eax + 1]
mov edi, edi
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x427fd0
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0xb4]
call fcn.004068a0
mov eax, dword [esp + 0x18]
cmp eax, edi
mov ebx, vtable.util::utf8::string_convert_base_char_.0
mov byte [esp + 0x1e0], 4
mov dword [esp + 0x14], ebx
je 0x42800b
push eax
call fcn.0049ed7a
add esp, 4
lea edx, [esp + 0x4c]
push edx
mov ecx, 0x4f1210
call fcn.00410a60
push 4
push str.java
lea ecx, [esp + 0x54]
call fcn.004068a0
push 0x43
lea eax, [esp + 0x6c]
push edi
push eax
call fcn.0049e8b0
add esp, 0xc
push edi
push 0xffffffffffffffff
push str.Java_style_formatting_indenting._n_nclass_foospace__n____int_Foo____n________if__isBar___n____________bar____n____________return_1__n_________else_n____________return_0__n_____n_n
lea ecx, [esp + 0x20]
mov byte [esp + 0x76], 0x6a
mov word [esp + 0x77], 4
mov word [esp + 0x87], 1
mov byte [esp + 0x7c], 0
call fcn.0041c0e0
mov ecx, dword [eax + 4]
mov eax, ecx
mov byte [esp + 0x1e0], 9
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x428076
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0xb4]
call fcn.004068a0
mov eax, dword [esp + 0x18]
cmp eax, edi
mov byte [esp + 0x1e0], 4
mov dword [esp + 0x14], ebx
je 0x4280ac
push eax
call fcn.0049ed7a
add esp, 4
lea ecx, [esp + 0x4c]
push ecx
mov ecx, 0x4f1210
call fcn.00410a60
push 7
push str.bluenet
lea ecx, [esp + 0x54]
call fcn.004068a0
push 0x43
lea edx, [esp + 0x6c]
push edi
push edx
call fcn.0049e8b0
add esp, 0xc
push edi
push 0xffffffffffffffff
push 0x4c89d0
lea ecx, [esp + 0x20]
mov byte [esp + 0x76], 0x63
mov word [esp + 0x77], 0xff04
mov word [esp + 0x87], 2
mov byte [esp + 0x8b], 1
call fcn.0041c0e0
mov ecx, dword [eax + 4]
mov eax, ecx
mov byte [esp + 0x1e0], 0xa
lea esi, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x428120
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0xb4]
call fcn.004068a0
mov eax, dword [esp + 0x18]
cmp eax, edi
mov byte [esp + 0x1e0], 4
mov dword [esp + 0x14], ebx
je 0x428156
push eax
call fcn.0049ed7a
add esp, 4
lea eax, [esp + 0x4c]
push eax
mov ecx, 0x4f1210
call fcn.00410a60
push edi
push 0x4c7b75
lea ecx, [esp + 0x54]
call fcn.004068a0
lea ecx, [esp + 0x4c]
push ecx
mov ecx, 0x4f1210
call fcn.00410a60
mov ecx, dword [esp + 0x48]
call fcn.0041f0e0
mov esi, 0x10
cmp dword [esp + 0xc4], esi
jb 0x4281aa
mov edx, dword [esp + 0xb0]
push edx
call fcn.0049ea7d
add esp, 4
cmp dword [esp + 0x64], esi
mov dword [esp + 0xc4], 0xf
mov dword [esp + 0xc0], edi
mov byte [esp + 0xb0], 0
jb 0x4281db
mov eax, dword [esp + 0x50]
push eax
call fcn.0049ea7d
add esp, 4
jmp 0x4281db
xor edi, edi
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x4281ea
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c0]
xor ecx, esp
call fcn.0049ec31
mov esp, ebp
pop ebp
ret