Function at 0x428adb
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x42b004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x42c], eax
mov esi, ecx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x418], ebx
push edi
mov edi, edx
test esi, esi
je 0x428ea6
test edi, edi
jne 0x428b22
test eax, eax
je 0x428ea6
push esi
push 0x404054
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00418481
add esp, 0x10
test eax, eax
js 0x428ea6
push esi
push 0x403130
push 0x4097a0
lea eax, [ebp - 0x414]
push 0x103
push eax
call fcn.00418481
add esp, 0x14
xor esi, esi
test eax, eax
js 0x428c02
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], esi
push eax
push 1
push esi
lea eax, [ebp - 0x414]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x428c02
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 0x208
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x424], 1
push eax
lea eax, [ebp - 0x424]
push eax
push esi
push 0x403eb0
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x428bf6
cmp dword [ebp - 0x424], 1
jne 0x428bf6
lea eax, [ebp - 0x414]
push 0x401b58
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x428bf6
xor ebx, ebx
inc ebx
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x420]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x428ea6
mov dword [ebp - 0x41c], 1
test edi, edi
je 0x428e5d
push 0x7b
pop eax
cmp ax, word [edi]
jne 0x428e5d
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x41c]
push eax
push esi
push 0x401058
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x428d3f
cmp dword [ebp - 0x41c], 1
jne 0x428d3f
test ebx, ebx
jne 0x428ce1
xor edx, edx
lea ecx, [ebp - 0x20c]
inc edx
call fcn.0042887f
test eax, eax
jne 0x428ce1
lea eax, [ebp - 0x20c]
push 0x4096d8
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x428ce1
lea eax, [ebp - 0x20c]
push 0x409728
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x428d70
xor edx, edx
lea ecx, [ebp - 0x20c]
call fcn.0042887f
test eax, eax
jne 0x428d2d
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x428cfb
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x409778
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x428d32
jmp 0x428d4f
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x428d44
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push esi
push 0x401058
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
push 0x4097c4
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x424], esi
push 0x103
push eax
call fcn.00418481
add esp, 0x10
lea eax, [ebp - 0x424]
mov edi, SysReAllocString
push eax
push 1
push esi
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x428e5d
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x41c]
push eax
push esi
push esi
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x428e51
cmp dword [ebp - 0x41c], 1
jne 0x428e51
lea eax, [ebp - 0x418]
mov dword [ebp - 0x428], esi
push eax
lea eax, [ebp - 0x428]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x428e51
push 4
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 1
push eax
push 4
push esi
push 0x4097e4
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x42c]
test esi, esi
je 0x428e9a
mov ecx, esi
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x428e6e
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push ebx
push 0x404090
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429770
mov esp, ebp
pop ebp
ret 4