Function at 0x427960
Capabilities:
Check if file exists
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4496e7
mov eax, dword fs:[0]
push eax
sub esp, 0x3b8
mov eax, dword [0x4a0cb8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x354], ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x34c]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x350], 0x401524
call fcn.004253b2
mov dword [ebp - 0x350], 0x4014c0
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2b4], 0
push 0
push 0xf003f
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x350]
push dword [esi]
push edi
call fcn.00429520
test eax, eax
js 0x45438b
mov edi, dword [ebp - 0x354]
xor ebx, ebx
mov dword [ebp - 0x364], ebx
push 0
mov dword [ebp - 0x388], 0x100
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, dword [ebp - 0x2b4]
test eax, eax
je 0x4543b2
lea ecx, [ebp - 0x3c4]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x388]
push ecx
lea ecx, [ebp - 0x210]
push ecx
push ebx
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
jne 0x428224
lea ebx, [eax + 1]
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
cmp esi, 0x103
je 0x42828e
test ebx, ebx
je 0x45439c
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x2a4], 0x41
mov dword [ebp - 0x2a8], eax
xor eax, eax
mov dword [ebp - 0x2a0], 0
mov word [ebp - 0x29c], ax
mov dword [ebp - fcn.0042be10], 0x401028
mov dword [ebp - 0x2b0], 0x4014c0
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
push eax
push 0xf003f
lea eax, [ebp - 0x210]
mov byte [ebp - 4], 1
push eax
push dword [ebp - 0x2b4]
lea ecx, [ebp - 0x2b0]
call fcn.00429520
test eax, eax
js 0x45459f
mov eax, dword [0x4a1724]
mov dword [ebp - 0x3bc], 0x40154c
mov esi, dword [eax + 0xc]
cmp esi, fcn.00428b50
jne 0x4543c1
mov ecx, 0x4a1724
call fcn.00428b50
add eax, 0x10
mov dword [ebp - 0x3b8], eax
mov eax, dword [0x4a1724]
mov esi, dword [eax + 0xc]
cmp esi, fcn.00428b50
jne 0x4543d5
mov ecx, 0x4a1724
call fcn.00428b50
add eax, 0x10
mov dword [ebp - 0x3b4], eax
mov byte [ebp - 4], 2
mov eax, dword [0x4a1724]
mov dword [ebp - 0x384], 0
mov dword [ebp - 0x380], 0
mov dword [ebp - 0x37c], 0
mov esi, dword [eax + 0xc]
mov dword [ebp - 0x378], 0
cmp esi, fcn.00428b50
jne 0x4543e9
mov ecx, 0x4a1724
call fcn.00428b50
add eax, 0x10
mov dword [ebp - 0x374], eax
mov eax, dword [0x4a1724]
mov esi, dword [eax + 0xc]
cmp esi, fcn.00428b50
jne 0x4543fd
mov ecx, 0x4a1724
call fcn.00428b50
add eax, 0x10
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x384]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp - 0x3bc]
call fcn.00426fb0
test eax, eax
js 0x427f7c
mov esi, dword [edi]
xor eax, eax
mov ebx, dword [ebp - 0x380]
mov dword [ebp - 0x358], eax
cmp esi, dword [edi + 0x14]
je 0x427cdb
test eax, eax
jne 0x454429
cmp ebx, dword [esi + 4]
je 0x427c1e
seta al
test al, al
jne 0x427ee5
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x427c8a
mov esi, dword [esi + 0x54]
mov edi, dword [ebp - 0x354]
mov eax, dword [ebp - 0x358]
jmp 0x427be5
xor edi, edi
test ebx, ebx
je 0x427c06
mov edx, dword [ebp - 0x384]
mov dword [ebp - 0x35c], edx
cmp edi, ebx
jae 0x45458b
cmp edi, dword [esi + 4]
jae 0x45458b
mov eax, dword [esi]
lea ecx, [eax + edi*8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x360], ecx
cmp eax, dword [ecx + 4]
jne 0x42811e
test eax, eax
jne 0x427c77
push dword [ecx]
push dword [edx]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x4280a0
mov edx, dword [ebp - 0x35c]
inc edi
add edx, 8
mov dword [ebp - 0x35c], edx
cmp edi, ebx
jb 0x427c38
jmp 0x427c06
xor edi, edi
test eax, eax
je 0x45441c
cmp edi, eax
jae 0x45458b
mov eax, dword [esi]
cmp dword [eax + edi*8 + 4], 0
jne 0x428181
mov ecx, dword [ebp - 0x384]
cmp edi, ebx
jae 0x45458b
push dword [ecx + edi*8]
push dword [eax + edi*8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x427c0d
mov eax, dword [esi + 4]
inc edi
cmp edi, eax
jb 0x427c9c
jmp 0x45441c
test eax, eax
jne 0x454429
cmp dword [edi + 8], 0
je 0x4281bd
mov esi, dword [edi + 8]
lea eax, [ebp - 0x384]
push eax
mov ecx, esi
mov dword [ebp - 0x360], esi
call fcn.00428dd0
lea eax, [ebp - 0x3bc]
mov byte [ebp - 4], 4
push eax
lea ecx, [esi + 0x20]
call fcn.00426dd0
mov byte [ebp - 4], 3
lea ebx, [esi + 0x58]
mov dword [esi + 0x4c], 1
mov ecx, edi
mov dword [ebx], 0
mov eax, dword [edi + 8]
mov dword [ebp - 0x390], ebx
mov eax, dword [eax + 0x50]
mov dword [edi + 8], eax
lea eax, [esi + 0x50]
push eax
mov dword [esi + 0x4c], 0
call fcn.00428d80
lea eax, [esi + 0x54]
mov ecx, edi
push eax
call fcn.00428d80
push ebx
mov ecx, edi
call fcn.00428d80
inc dword [edi + 4]
xor eax, eax
mov esi, dword [edi]
mov ebx, dword [ebp - 0x380]
mov dword [ebp - 0x358], eax
cmp esi, dword [edi + 0x14]
je 0x427e5d
mov dword [ebp - 0x358], esi
cmp ebx, dword [esi + 4]
je 0x427da3
seta al
test al, al
jne 0x427ef3
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x427e0c
mov esi, dword [esi + 0x54]
mov edi, dword [ebp - 0x354]
jmp 0x427d72
xor edi, edi
test ebx, ebx
je 0x427d91
mov edx, dword [ebp - 0x384]
mov dword [ebp - 0x35c], edx
cmp edi, ebx
jae 0x45458b
cmp edi, dword [esi + 4]
jae 0x45458b
mov eax, dword [esi]
lea ecx, [eax + edi*8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x38c], ecx
cmp eax, dword [ecx + 4]
jne 0x42812b
test eax, eax
jne 0x427dfc
push dword [ecx]
push dword [edx]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x4280c6
mov edx, dword [ebp - 0x35c]
inc edi
add edx, 8
mov dword [ebp - 0x35c], edx
cmp edi, ebx
jb 0x427dbd
jmp 0x427d91
xor edi, edi
test eax, eax
je 0x454497
cmp edi, eax
jae 0x45458b
mov eax, dword [esi]
cmp dword [eax + edi*8 + 4], 0
jne 0x42819f
mov ecx, dword [ebp - 0x384]
cmp edi, ebx
jae 0x45458b
push dword [ecx + edi*8]
push dword [eax + edi*8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x427d98
mov eax, dword [esi + 4]
inc edi
cmp edi, eax
jb 0x427e1e
jmp 0x454497
mov ecx, dword [ebp - 0x390]
mov eax, dword [ebp - 0x358]
mov dword [ecx], eax
test eax, eax
je 0x428281
push eax
lea ecx, [ebp - 0x384]
call fcn.00429980
mov edx, dword [ebp - 0x358]
test al, al
jne 0x427eda
mov eax, dword [edx + 4]
cmp eax, ebx
jne 0x427efb
xor esi, esi
test eax, eax
je 0x427eda
cmp esi, eax
jae 0x45458b
mov eax, dword [edx]
cmp dword [eax + esi*8 + 4], 0
jne 0x428206
mov ecx, dword [ebp - 0x384]
cmp esi, ebx
jae 0x45458b
push dword [ecx + esi*8]
push dword [eax + esi*8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
mov edx, dword [ebp - 0x358]
add esp, 8
test eax, eax
jne 0x427efb
mov eax, dword [edx + 4]
inc esi
cmp esi, eax
jb 0x427e9e
mov ebx, dword [ebp - 0x360]
mov dword [edx + 0x50], ebx
jmp 0x427f04
mov esi, dword [esi + 0x50]
mov eax, dword [ebp - 0x358]
jmp 0x427be5
mov esi, dword [esi + 0x50]
jmp 0x427d72
mov ebx, dword [ebp - 0x360]
mov dword [edx + 0x54], ebx
mov dword [ebx + 0x4c], 0
mov eax, dword [edi]
cmp ebx, eax
je 0x427f61
mov ecx, dword [ebx + 0x58]
cmp dword [ecx + 0x4c], 0
jne 0x427f61
mov edx, dword [ecx + 0x58]
mov eax, dword [edx + 0x50]
cmp ecx, eax
je 0x428138
test eax, eax
je 0x4280ec
cmp dword [eax + 0x4c], 0
jne 0x4280ec
mov dword [ecx + 0x4c], 1
mov dword [eax + 0x4c], 1
mov eax, dword [ebx + 0x58]
mov eax, dword [eax + 0x58]
mov dword [eax + 0x4c], 0
mov eax, dword [ebx + 0x58]
mov ebx, dword [eax + 0x58]
mov eax, dword [edi]
cmp ebx, eax
jne 0x427f11
mov dword [eax + 0x4c], 1
mov ecx, dword [edi]
add ecx, 0x58
mov byte [ebp - 4], 5
je 0x454595
mov eax, dword [edi + 0x14]
mov dword [ecx], eax
mov ebx, dword [ebp - 0x364]
or eax, 0xffffffff
mov byte [ebp - 4], 2
inc ebx
mov ecx, dword [ebp - 0x370]
mov dword [ebp - 0x364], ebx
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jle 0x4544d7
mov ecx, dword [ebp - 0x374]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jle 0x4544f6
mov edx, dword [ebp - 0x384]
test edx, edx
je 0x42800b
xor esi, esi
cmp dword [ebp - 0x380], esi
jbe 0x428001
mov ecx, dword [edx + esi*8]
or eax, 0xffffffff
sub ecx, 0x10
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jle 0x454515
inc esi
cmp esi, dword [ebp - 0x380]
jb 0x427fd5
mov edi, dword [ebp - 0x354]
mov ebx, dword [ebp - 0x364]
push edx
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov ecx, dword [ebp - 0x3b4]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jle 0x454534
mov ecx, dword [ebp - 0x3b8]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jle 0x454553
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x2b0], 0x4014c0
test eax, eax
je 0x42806b
cmp dword [ebp - 0x218], 0
je 0x42806b
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x2b0], 0x401524
mov dword [ebp - fcn.0042be10], 0x401028
test eax, eax
je 0x427a01
lea ecx, [ebp - 0x29c]
cmp eax, ecx
je 0x427a01
jmp 0x454572
mov eax, dword [ebp - 0x360]
push dword [eax]
mov eax, dword [ebp - 0x35c]
push dword [eax]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jns 0x427c06
jmp 0x454411
mov eax, dword [ebp - 0x38c]
push dword [eax]
mov eax, dword [ebp - 0x35c]
push dword [eax]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 8
test eax, eax
jns 0x427d91
jmp 0x454497
cmp ebx, dword [ecx + 0x50]
je 0x4544c8
mov eax, dword [ebx + 0x58]
mov ecx, edi
mov dword [eax + 0x4c], 1
mov eax, dword [ebx + 0x58]
mov eax, dword [eax + 0x58]
mov dword [eax + 0x4c], 0
mov eax, dword [ebx + 0x58]
push dword [eax + 0x58]
call fcn.00429a39
jmp 0x427f5b
test eax, eax
jne 0x427c06
jmp 0x454411
test eax, eax
jne 0x427d91
jmp 0x454497
mov eax, dword [edx + 0x54]
test eax, eax
je 0x428149
cmp dword [eax + 0x4c], 0
je 0x4544a2
cmp ebx, dword [ecx + 0x54]
jne 0x428158
mov ebx, ecx
mov ecx, edi
push ebx
call fcn.00429a39
mov eax, dword [ebx + 0x58]
mov ecx, edi
mov dword [eax + 0x4c], 1
mov eax, dword [ebx + 0x58]
mov eax, dword [eax + 0x58]
mov dword [eax + 0x4c], 0
mov eax, dword [ebx + 0x58]
push dword [eax + 0x58]
call fcn.0042a0ce
jmp 0x427f5b
cmp edi, ebx
jae 0x45458b
mov ecx, dword [ebp - 0x384]
cmp dword [ecx + edi*8 + 4], 0
jne 0x427cce
jmp 0x427caf
cmp edi, ebx
jae 0x45458b
mov ecx, dword [ebp - 0x384]
cmp dword [ecx + edi*8 + 4], 0
jne 0x427e50
jmp 0x427e31
cmp dword [edi + 0x14], 0
je 0x428232
mov edx, dword [edi + 0x10]
lea ecx, [edi + 0xc]
push 0x5c
call fcn.0042a55c
mov edx, eax
test edx, edx
je 0x454581
mov ecx, dword [edi + 0x10]
add edx, 0xffffffa8
imul eax, ecx, 0x5c
add edx, eax
add ecx, 0xffffffff
js 0x427ced
mov edi, edi
mov eax, dword [edi + 8]
mov dword [edx + 0x50], eax
mov dword [edi + 8], edx
sub edx, 0x5c
sub ecx, 1
jns 0x4281f0
jmp 0x427ced
cmp esi, ebx
jae 0x45458b
mov ecx, dword [ebp - 0x384]
cmp dword [ecx + esi*8 + 4], 0
jne 0x427ed2
jmp 0x427eb1
push eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor ebx, ebx
jmp 0x427a4f
push 0x5c
call dword [sym.imp.msvcrt.dll_malloc]
add esp, 4
mov dword [edi + 0x14], eax
test eax, eax
je 0x454581
push 0x5c
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [edi + 0x14]
add esp, 0xc
mov dword [eax + 0x4c], 1
mov eax, dword [edi + 0x14]
mov dword [eax + 0x54], eax
mov ecx, dword [edi + 0x14]
mov eax, dword [ecx + 0x54]
mov dword [ecx + 0x50], eax
mov ecx, dword [edi + 0x14]
mov eax, dword [ecx + 0x50]
mov dword [ecx + 0x58], eax
mov eax, dword [edi + 0x14]
mov dword [edi], eax
jmp 0x4281c3
mov ebx, dword [ebp - 0x360]
mov dword [edi], ebx
jmp 0x427f04
xor esi, esi
lea ecx, [ebp - 0x350]
call fcn.0042535f
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043b590
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x42828e
test esi, esi
jle 0x428290
movzx esi, si
or esi, 0x80070000
jmp 0x428290
push 6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor ebx, ebx
jmp 0x427a4f
mov ecx, esi
call dword [0x4a3670]
mov ecx, 0x4a1724
call esi
jmp 0x427b06
mov ecx, esi
call dword [0x4a3670]
mov ecx, 0x4a1724
call esi
jmp 0x427b2d
mov ecx, esi
call dword [0x4a3670]
mov ecx, 0x4a1724
call esi
jmp 0x427b80
mov ecx, esi
call dword [0x4a3670]
mov ecx, 0x4a1724
call esi
jmp 0x427ba7
mov edi, dword [ebp - 0x354]
jmp 0x427ee5
mov edi, dword [ebp - 0x354]
mov eax, esi
jmp 0x427bdf
push eax
mov ecx, edi
call fcn.00435c83
mov esi, eax
test esi, esi
je 0x454451
push esi
lea ecx, [ebp - 0x384]
call fcn.00435c12
test al, al
je 0x454451
mov eax, esi
mov dword [ebp - 0x358], eax
jmp 0x454429
mov esi, dword [ebp - 0x358]
test esi, esi
je 0x427ce3
mov ecx, dword [esi + 0x28]
sub ecx, 0x10
mov dword [esi + 0x20], 0x40154c
call fcn.00429900
mov ecx, dword [esi + 0x24]
sub ecx, 0x10
call fcn.00429900
lea eax, [ebp - 0x3bc]
mov dword [esi + 0x20], 0x403060
push eax
lea ecx, [esi + 0x20]
call fcn.00426dd0
jmp 0x427f7c
mov edi, dword [ebp - 0x354]
jmp 0x427ef3
mov dword [ecx + 0x4c], 1
mov dword [eax + 0x4c], 1
mov eax, dword [ebx + 0x58]
mov eax, dword [eax + 0x58]
mov dword [eax + 0x4c], 0
mov eax, dword [ebx + 0x58]
mov ebx, dword [eax + 0x58]
jmp 0x427f5b
mov ebx, ecx
mov ecx, edi
push ebx
call fcn.0042a0ce
jmp 0x4280f5
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4a3670]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x354]
jmp 0x427fa7
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4a3670]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x354]
jmp 0x427fc1
mov ebx, dword [ecx]
push ecx
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x4a3670]
mov ecx, ebx
call edi
mov edx, dword [ebp - 0x384]
jmp 0x427fec
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4a3670]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x354]
jmp 0x428029
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4a3670]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x354]
jmp 0x428043
push eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
jmp 0x427a01
mov ecx, 0x8007000e
call fcn.0045fefb
mov ecx, 0x80070057
call fcn.0045fefb
mov ecx, 0x80004005
call fcn.0045fefb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4545b4
movzx esi, si
or esi, 0x80070000
lea ecx, [ebp - 0x2b0]
call fcn.0042535f
jmp 0x428290