Function at 0x428980
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4b7983
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x4e1370]
xor eax, esp
mov dword [esp + 0x148], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e1370]
xor eax, esp
push eax
lea eax, [esp + 0x160]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x4c]
push edx
push str.blacktip
push str.SOFTWARE360Safe_softmgr
mov ebx, 4
xor ebp, ebp
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x3c], esi
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x44], ebp
mov dword [esp + 0x50], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x2c], ebp
jne 0x428add
push ebx
lea eax, [esp + 0x30]
push eax
push ebx
push str.blacktip
push str.SOFTWARE360Safe_softmgr
mov edi, 1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x44], edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp eax, 5
je 0x428add
push 0x4c8638
lea ecx, [esp + 0x5c]
push 0x80
push ecx
mov dword [esp + 0x60], edi
call fcn.00491f5c
add esp, 0xc
push str.publiccustom_msgbox_information.png
push 0x4e8bdc
lea edi, [esp + 0x28]
call fcn.0040c470
mov dword [esp + 0x168], ebp
mov eax, dword [eax]
lea edx, [esp + 0x1c]
push edx
mov edi, eax
call fcn.00407360
mov byte [esp + 0x168], 2
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428aa1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x428aad
mov eax, dword [eax]
jmp 0x428aaf
xor eax, eax
lea ecx, [esp + 0x54]
push ecx
push eax
call fcn.0042a690
lea edi, [esp + 0x1c]
cmp eax, 2
jne 0x428acd
call fcn.00407310
jmp 0x428ea7
mov dword [esp + 0x168], 0xffffffff
call fcn.00407310
lea edx, [esp + 0x30]
push edx
mov ecx, 0x4c86d4
call fcn.00405a20
mov dword [esp + 0x168], 3
mov eax, dword [esi + 0xd0]
mov ecx, dword [eax + 8]
lea edx, [esp + 0x34]
push edx
call fcn.00405a20
mov byte [esp + 0x168], bl
test byte [0x4ea4dc], 1
jne 0x428b40
or dword [0x4ea4dc], 1
push ebp
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push ebp
mov dword [0x4ea4d8], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [0x4e8be8], ebp
jne 0x428b55
mov ecx, 0x60
mov dword [0x4ea4d8], ecx
jmp 0x428b5b
mov ecx, dword [0x4ea4d8]
lea ecx, [ecx + ecx*2]
shl ecx, 4
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov edi, edx
shr edi, 0x1f
lea esi, [esp + 0x20]
add edi, edx
mov dword [esp + 0x1c], ebp
call fcn.0046b230
mov byte [esp + 0x168], 5
cmp dword [esp + 0x20], ebp
je 0x428bdb
mov eax, dword [esp + 0x34]
cmp dword [eax - 0xc], ebp
je 0x428bdb
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [esp + 0x28], esi
cmp esi, ebp
jne 0x428bb1
push 0x8007000e
call fcn.004058d0
push edi
mov byte [esp + 0x16c], 6
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x38]
push edi
push esi
push eax
call edx
push esi
mov dword [esp + 0x20], eax
mov byte [esp + 0x16c], 5
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call fcn.004025b0
mov ecx, eax
call fcn.00402620
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xd0]
cmp dword [eax + 0x20], ebp
je 0x428c69
mov ecx, dword [esp + 0x30]
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x20]
mov dword [esp + 0x3c], ecx
push 1
lea ecx, [esp + 0x20]
mov dword [esp + 0x44], edx
push ecx
lea edx, [esp + 0x44]
mov dword [esp + 0x30], eax
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.004025b0
lea ecx, [esp + 0x38]
mov edx, eax
call fcn.00402d60
call fcn.004025b0
mov ebx, eax
call fcn.00402a20
mov eax, dword [0x4e8c08]
lea ecx, [esp + 0x18]
push ecx
push 0x1f4
push 2
lea edx, [esp + 0x54]
push edx
push ebp
push 0x4a
push eax
mov dword [esp + 0x64], 0x560b
mov dword [esp + 0x68], ebp
mov dword [esp + 0x6c], ebp
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push 0x4c4788
push str.puri_detail_addblack
call fcn.00413050
mov ebx, eax
call fcn.00413450
mov edx, dword [esp + 0x24]
push ecx
mov esi, esp
mov dword [esp + 0x1c], esp
mov dword [esi], ebp
mov eax, dword [edx + 0x38]
push ecx
mov ecx, esp
mov bl, 1
mov edi, 0x58a
mov dword [esp + 0x20], esp
mov dword [ecx], eax
cmp eax, ebp
je 0x428cab
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
call fcn.004120b0
cmp eax, ebp
jge 0x428cc1
cmp eax, 0x80004002
je 0x428cc1
push eax
call fcn.0048ff60
lea eax, [esp + 0x2c]
push eax
mov cl, bl
mov edx, edi
call fcn.0040e020
mov byte [esp + 0x170], 7
mov eax, dword [eax]
add esp, 4
mov ecx, esp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], esp
mov dword [ecx], eax
cmp eax, ebp
je 0x428cf4
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
lea esi, [esp + 0x20]
call fcn.0040ea50
cmp eax, ebp
jge 0x428d0e
cmp eax, 0x80004002
je 0x428d0e
push eax
call fcn.0048ff60
mov bl, 9
mov byte [esp + 0x168], bl
mov eax, dword [esp + 0x28]
cmp eax, ebp
je 0x428d27
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov esi, dword [esp + 0x1c]
cmp esi, ebp
je 0x428e28
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
mov edi, 0x4c870c
call fcn.00407360
mov byte [esp + 0x16c], 0xa
mov ecx, esi
mov byte [esp + 0x16c], bl
call fcn.0040f1d0
mov edx, dword [esp + 0x24]
push ebp
push ecx
mov dword [esp + 0x20], esp
mov edi, esp
push ecx
mov esi, esp
mov dword [esp + 0x24], esp
mov dword [esi], 0
mov eax, dword [edx + 0x38]
push ecx
mov ecx, esp
mov bl, 1
mov ebp, 0x58a
mov dword [esp + 0x28], esp
mov dword [ecx], eax
test eax, eax
je 0x428d93
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
call fcn.004120b0
test eax, eax
jge 0x428da9
cmp eax, 0x80004002
je 0x428da9
push eax
call fcn.0048ff60
push edi
mov cl, bl
mov edx, ebp
call fcn.0040e020
add esp, 8
call fcn.0040d850
mov eax, dword [esp + 0x2c]
add esp, 8
push 0
push ecx
mov dword [esp + 0x20], esp
mov edi, esp
push ecx
mov esi, esp
mov dword [esp + 0x24], esp
mov dword [esi], 0
mov eax, dword [eax + 0x38]
push ecx
mov ecx, esp
mov bl, 1
mov ebp, 0x43e
mov dword [esp + 0x28], esp
mov dword [ecx], eax
test eax, eax
je 0x428df7
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
call fcn.004120b0
test eax, eax
jge 0x428e0d
cmp eax, 0x80004002
je 0x428e0d
push eax
call fcn.0048ff60
push edi
mov cl, bl
mov edx, ebp
call fcn.0040e020
add esp, 8
call fcn.0040d850
mov esi, dword [esp + 0x24]
add esp, 8
xor ebp, ebp
mov byte [esp + 0x168], 5
cmp esi, ebp
je 0x428e3c
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov byte [esp + 0x168], 4
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x428e54
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov byte [esp + 0x168], 3
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428e7c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x168], 0xffffffff
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428ea7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x160]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x148]
xor ecx, esp
call fcn.0049021b
add esp, 0x158
ret