Function at 0x427ee0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c05c
mov eax, dword fs:[0]
push eax
sub esp, 0xaa4
mov eax, dword [0x43ba24]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xaa4], ecx
mov dword [ebp - 0xa70], 0
mov byte [ebp - 0x814], 0
push 0x7ff
push 0
lea eax, [ebp - 0x813]
push eax
call fcn.0040e9c0
add esp, 0xc
push 0x4304f9
push 0x43f974
call fcn.0040f7d0
add esp, 8
push 0x433f88
lea ecx, [ebp - 0xa58]
push ecx
call fcn.00401380
add esp, 8
mov dword [ebp - 0xaa8], eax
mov edx, dword [ebp - 0xaa8]
mov dword [ebp - 0xa74], edx
mov dword [ebp - 4], 0
push 0x433fa8
lea eax, [ebp - 0xa5c]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0xaac], eax
mov ecx, dword [ebp - 0xaac]
mov dword [ebp - 0xa7c], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0xa74]
mov eax, dword [edx]
mov dword [ebp - 0xa78], eax
mov ecx, dword [ebp - 0xa7c]
mov edx, dword [ecx]
mov dword [ebp - 0xa80], edx
lea eax, [ebp - 0x814]
push eax
mov ecx, dword [ebp - 0xa78]
push ecx
mov edx, dword [ebp - 0xa80]
push edx
push 0x80000001
mov ecx, dword [ebp - 0xaa4]
call fcn.00427b70
mov dword [ebp - 0xa54], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa5c]
call fcn.004019a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa58]
call fcn.004019a0
cmp dword [ebp - 0xa54], 0
je 0x42806d
push 0x433fcc
lea eax, [ebp - 0x814]
push eax
call fcn.0040fb0b
add esp, 8
mov dword [ebp - 0x10], eax
push 0x433fd0
push 0
call fcn.0040fb0b
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x428052
mov ecx, dword [ebp - 0x10]
push ecx
push 0x43f974
call fcn.0040f7d0
add esp, 8
push 0x4304fa
push 0x43f974
call fcn.0040f740
add esp, 8
test eax, eax
je 0x42806d
jmp 0x428340
push 0x4304fb
push 0x43f974
call fcn.0040f740
add esp, 8
test eax, eax
jne 0x428309
mov dword [ebp - 0xa50], 0x100
mov dword [ebp - 0xa3c], 1
mov byte [ebp - 0xa34], 0
push 0x103
push 0
lea edx, [ebp - 0xa33]
push edx
call fcn.0040e9c0
add esp, 0xc
mov byte [ebp - 0x924], 0
push 0x103
push 0
lea eax, [ebp - 0x923]
push eax
call fcn.0040e9c0
add esp, 0xc
mov dword [ebp - 0xa4c], 0x104
mov dword [ebp - 0x818], 1
mov dword [ebp - 0x928], 0x104
push 0x433fd8
lea ecx, [ebp - 0xa64]
push ecx
call fcn.00401380
add esp, 8
mov dword [ebp - 0xa8c], eax
mov edx, dword [ebp - 0xa8c]
mov eax, dword [edx]
mov dword [ebp - 0xa90], eax
lea ecx, [ebp - 0xa40]
push ecx
push 0x20019
push 0
mov edx, dword [ebp - 0xa90]
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0xa5d], al
lea ecx, [ebp - 0xa64]
call fcn.004019a0
movzx eax, byte [ebp - 0xa5d]
test eax, eax
je 0x428309
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xa48]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0xa40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 0xa38], 0
mov dword [ebp - 0xa44], 0
jmp 0x4281af
mov eax, dword [ebp - 0xa38]
add eax, 1
mov dword [ebp - 0xa38], eax
mov ecx, dword [ebp - 0xa38]
cmp ecx, dword [ebp - 0xa48]
jae 0x428309
mov dword [ebp - 0xa4c], 0x104
mov byte [ebp - 0xa34], 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0xa4c]
push edx
lea eax, [ebp - 0xa34]
push eax
mov ecx, dword [ebp - 0xa38]
push ecx
mov edx, dword [ebp - 0xa40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0xa44], eax
cmp dword [ebp - 0xa44], 0
jne 0x428304
mov dword [ebp - 0x818], 1
mov dword [ebp - 0x928], 0x104
push 0x434038
lea eax, [ebp - 0xa6c]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0xa98], eax
mov ecx, dword [ebp - 0xa70]
or ecx, 1
mov dword [ebp - 0xa70], ecx
mov edx, dword [ebp - 0xa98]
mov eax, dword [edx]
mov dword [ebp - 0xa9c], eax
lea ecx, [ebp - 0x928]
push ecx
lea edx, [ebp - 0x924]
push edx
lea eax, [ebp - 0x818]
push eax
lea ecx, [ebp - 0xa34]
push ecx
mov edx, dword [ebp - 0xa9c]
push edx
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4282b0
push 0x43fdc8
lea eax, [ebp - 0x924]
push eax
call fcn.0040f740
add esp, 8
test eax, eax
jne 0x4282b0
mov dword [ebp - 0xab0], 1
jmp 0x4282ba
mov dword [ebp - 0xab0], 0
mov cl, byte [ebp - 0xab0]
mov byte [ebp - 0xa65], cl
mov edx, dword [ebp - 0xa70]
and edx, 1
je 0x4282e3
and dword [ebp - 0xa70], 0xfffffffe
lea ecx, [ebp - 0xa6c]
call fcn.004019a0
movzx eax, byte [ebp - 0xa65]
test eax, eax
je 0x428304
lea ecx, [ebp - 0xa34]
push ecx
push 0x43f974
call fcn.0040f7d0
add esp, 8
jmp 0x428309
jmp 0x4281a0
push 0x43050b
push 0x43f974
call fcn.0040f740
add esp, 8
test eax, eax
jne 0x428340
push 0x43f974
call fcn.0040f71c
cdq
mov ecx, 0x13
idiv ecx
add edx, 9
push edx
mov ecx, dword [ebp - 0xaa4]
call fcn.00424900
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040e83e
mov esp, ebp
pop ebp
ret